Play interactive tour

Edit tour

Windows Analysis Report PI-0387991.exe

Overview

General Information

Sample Name:	PI-0387991.exe
Analysis ID:	452542
MD5:	655318bec9b30d5a2f2dedf399d87438
SHA1:	23f37c9bddcd8393f499fee9b77220765288020c
SHA256:	8cd1a5c6360cc1c0e513d4cc39f649bcb33b61c47c4b498b992ea8e9a41a48cd
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

PI-0387991.exe (PID: 5736 cmdline: 'C:\Users\user\Desktop\PI-0387991.exe' MD5: 655318BEC9B30D5A2F2DEDF399D87438)

RegSvcs.exe (PID: 3328 cmdline: {path} MD5: 2867A3817C9245F7CF518524DFD18F28)

explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

explorer.exe (PID: 5076 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

cmd.exe (PID: 4860 cmdline: /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.bodymoisturizer.online/q4kr/"], "decoy": ["realmodapk.com", "hanoharuka.com", "shivalikspiritualproducts.com", "womenshealthclinincagra.com", "racketpark.com", "startuporig.com", "azkachinas.com", "klanblog.com", "linuxradio.tools", "siteoficial-liquida.com", "glsbuyer.com", "bestdeez.com", "teens2cash.com", "valleyviewconstruct.com", "myfortniteskins.com", "cambecare.com", "csec2011.com", "idookap.com", "warmwallsrecords.com", "smartmirror.one", "alertreels.com", "oiop.online", "61cratoslot.com", "hispanicassoclv.com", "pennyforyourprep.com", "fayansistanbul.com", "superbartendergigs.club", "herr-nourimann.com", "oatkc.net", "romahony.com", "sportcrea.com", "crystalnieblas.com", "lcmet.com", "nwaymyatthu-mm.com", "edsufferen.club", "apispotlight.com", "shadowcatrecording.com", "capwisefin.com", "themesinsider.com", "kadrisells.com", "db-82.com", "rentyoursubmarine.com", "rin-ronshop.com", "donzfamilia.com", "loyalcollegeofart.com", "socialize.site", "shadesailstructure.com", "smcenterbiz.com", "zcdonghua.com", "1420radiolider.com", "ckenpo.com", "trucksitasa.com", "getthistle.com", "usvisanicaragua.com", "josiemaxwrites.com", "dehaagennutraceuticals.com", "noiaapp.com", "blinbins.com", "getreitive.com", "turmericbar.com", "manifestwealthrightnow.com", "garagekuhn.com", "longviewfinancialadvisor.com", "hallworthcapital.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xe8af0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xe8e8a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x10ff10:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1102aa:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xf4b9d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x11bfbd:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xf4689:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x11baa9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xf4c9f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x11c0bf:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xf4e17:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x11c237:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xe98a2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x110cc2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xf3904:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x11ad24:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xea61a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x111a3a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xf9c8f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1210af:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xfad32:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xf6bc1:$sqlite3step: 68 34 1C 7B E1 0xf6cd4:$sqlite3step: 68 34 1C 7B E1 0x11dfe1:$sqlite3step: 68 34 1C 7B E1 0x11e0f4:$sqlite3step: 68 34 1C 7B E1 0xf6bf0:$sqlite3text: 68 38 2A 90 C5 0xf6d15:$sqlite3text: 68 38 2A 90 C5 0x11e010:$sqlite3text: 68 38 2A 90 C5 0x11e135:$sqlite3text: 68 38 2A 90 C5 0xf6c03:$sqlite3blob: 68 53 D8 7F 8C 0xf6d2b:$sqlite3blob: 68 53 D8 7F 8C 0x11e023:$sqlite3blob: 68 53 D8 7F 8C 0x11e14b:$sqlite3blob: 68 53 D8 7F 8C
0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: PI-0387991.exe PID: 5736	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
8.2.RegSvcs.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19797:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1a83a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
8.2.RegSvcs.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x166c9:$sqlite3step: 68 34 1C 7B E1 0x167dc:$sqlite3step: 68 34 1C 7B E1 0x166f8:$sqlite3text: 68 38 2A 90 C5 0x1681d:$sqlite3text: 68 38 2A 90 C5 0x1670b:$sqlite3blob: 68 53 D8 7F 8C 0x16833:$sqlite3blob: 68 53 D8 7F 8C
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x138a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x139a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x85aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1260c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9322:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18997:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19a3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
8.2.RegSvcs.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x158c9:$sqlite3step: 68 34 1C 7B E1 0x159dc:$sqlite3step: 68 34 1C 7B E1 0x158f8:$sqlite3text: 68 38 2A 90 C5 0x15a1d:$sqlite3text: 68 38 2A 90 C5 0x1590b:$sqlite3blob: 68 53 D8 7F 8C 0x15a33:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe', CommandLine: /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\SysWOW64\explorer.exe, ParentImage: C:\Windows\SysWOW64\explorer.exe, ParentProcessId: 5076, ProcessCommandLine: /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe', ProcessId: 4860

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.bodymoisturizer.online/q4kr/"], "decoy": ["realmodapk.com", "hanoharuka.com", "shivalikspiritualproducts.com", "womenshealthclinincagra.com", "racketpark.com", "startuporig.com", "azkachinas.com", "klanblog.com", "linuxradio.tools", "siteoficial-liquida.com", "glsbuyer.com", "bestdeez.com", "teens2cash.com", "valleyviewconstruct.com", "myfortniteskins.com", "cambecare.com", "csec2011.com", "idookap.com", "warmwallsrecords.com", "smartmirror.one", "alertreels.com", "oiop.online", "61cratoslot.com", "hispanicassoclv.com", "pennyforyourprep.com", "fayansistanbul.com", "superbartendergigs.club", "herr-nourimann.com", "oatkc.net", "romahony.com", "sportcrea.com", "crystalnieblas.com", "lcmet.com", "nwaymyatthu-mm.com", "edsufferen.club", "apispotlight.com", "shadowcatrecording.com", "capwisefin.com", "themesinsider.com", "kadrisells.com", "db-82.com", "rentyoursubmarine.com", "rin-ronshop.com", "donzfamilia.com", "loyalcollegeofart.com", "socialize.site", "shadesailstructure.com", "smcenterbiz.com", "zcdonghua.com", "1420radiolider.com", "ckenpo.com", "trucksitasa.com", "getthistle.com", "usvisanicaragua.com", "josiemaxwrites.com", "dehaagennutraceuticals.com", "noiaapp.com", "blinbins.com", "getreitive.com", "turmericbar.com", "manifestwealthrightnow.com", "garagekuhn.com", "longviewfinancialadvisor.com", "hallworthcapital.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: PI-0387991.exe	Virustotal: Detection: 50%			Perma Link
Source: PI-0387991.exe	ReversingLabs: Detection: 43%

Yara detected FormBook

Show sources

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY

Machine Learning detection for sample

Show sources

Source: PI-0387991.exe

Joe Sandbox ML: detected

Source: 8.2.RegSvcs.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: PI-0387991.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: PI-0387991.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: explorer.pdbUGP source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000009.00000000.342044175.0000000006FE0000.00000002.00000001.sdmp
Source:	Binary string: RegSvcs.pdb, source: explorer.exe, 0000000A.00000002.501905978.0000000005AE7000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, explorer.exe, 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, explorer.exe
Source:	Binary string: explorer.pdb source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp
Source:	Binary string: RegSvcs.pdb source: explorer.exe, 0000000A.00000002.501905978.0000000005AE7000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000009.00000000.342044175.0000000006FE0000.00000002.00000001.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then pop edi		8_2_004162D8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 4x nop then pop edi		10_2_033A62D8

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49696 -> 162.241.2.50:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49696 -> 162.241.2.50:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49696 -> 162.241.2.50:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.bodymoisturizer.online/q4kr/

Source: global traffic	HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHZjowo3ayyv HTTP/1.1Host: www.romahony.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=8Twh4s36gZRno0YiIaK1Aog0Jq5SRxj1tGC/kNtcN6cj6UbdIOqmSeR7M7wA7kAlsS0+ HTTP/1.1Host: www.idookap.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D HTTP/1.1Host: www.siteoficial-liquida.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=+adpk/1z85ABQgFM8KoV7nh2RN9wNRyN3NacL4PKZthW2WB1UYKLVSKaUBe2HmITnYf8 HTTP/1.1Host: www.hispanicassoclv.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	ASN Name: WEST263GO-HKWest263InternationalLimitedHK WEST263GO-HKWest263InternationalLimitedHK
Source: Joe Sandbox View	ASN Name: OIS1US OIS1US

Source: global traffic	HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHZjowo3ayyv HTTP/1.1Host: www.romahony.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=8Twh4s36gZRno0YiIaK1Aog0Jq5SRxj1tGC/kNtcN6cj6UbdIOqmSeR7M7wA7kAlsS0+ HTTP/1.1Host: www.idookap.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D HTTP/1.1Host: www.siteoficial-liquida.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /q4kr/?m4z=hZWT6D&KdPxHVdh=+adpk/1z85ABQgFM8KoV7nh2RN9wNRyN3NacL4PKZthW2WB1UYKLVSKaUBe2HmITnYf8 HTTP/1.1Host: www.hispanicassoclv.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.romahony.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 22 Jul 2021 13:06:49 GMTServer: Apache/2.4.41 (Ubuntu)Status: 404 Not FoundVary: Accept-Encodingreferer: http://image.baidu.comContent-Length: 0Connection: closeContent-Type: text/html;charset=utf-8;

Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PI-0387991.exe, 00000000.00000003.235322005.0000000005F7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: PI-0387991.exe, 00000000.00000003.235286861.0000000005F7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comUfee
Source: PI-0387991.exe, 00000000.00000003.235173657.0000000005F7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com_f
Source: PI-0387991.exe, 00000000.00000003.235173657.0000000005F7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.come
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PI-0387991.exe, 00000000.00000003.235286861.0000000005F7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: PI-0387991.exe, 00000000.00000003.235106286.0000000001A0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comporFxlei
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PI-0387991.exe, 00000000.00000003.239980062.0000000001A0B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/de
Source: explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PI-0387991.exe, 00000000.00000003.320350638.0000000005F50000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: PI-0387991.exe, 00000000.00000003.320350638.0000000005F50000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comt
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PI-0387991.exe, 00000000.00000003.234500396.0000000005F7E000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn-i-d)
Source: PI-0387991.exe, 00000000.00000003.234373089.0000000005F7B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PI-0387991.exe, 00000000.00000003.243163796.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm3
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp, PI-0387991.exe, 00000000.00000003.236602049.0000000005F5B000.00000004.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/)
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: PI-0387991.exe, 00000000.00000003.236914102.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/f
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PI-0387991.exe, 00000000.00000003.236232775.0000000005F53000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/)
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/7
Source: PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/k-e
Source: PI-0387991.exe, 00000000.00000003.235849740.0000000005F53000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/oil
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comd
Source: PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comx
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: PI-0387991.exe, 00000000.00000003.234687612.0000000005F5B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com~
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PI-0387991.exe, 00000000.00000003.234998306.0000000005F7D000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cne
Source: PI-0387991.exe, 00000000.00000003.235106286.0000000001A0C000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnobt

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004181D0 NtCreateFile,	8_2_004181D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00418280 NtReadFile,	8_2_00418280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00418300 NtClose,	8_2_00418300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004183B0 NtAllocateVirtualMemory,	8_2_004183B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004181CD NtCreateFile,	8_2_004181CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004182FA NtClose,	8_2_004182FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004183AA NtAllocateVirtualMemory,	8_2_004183AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329910 NtAdjustPrivilegesToken,LdrInitializeThunk,	8_2_01329910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013299A0 NtCreateSection,LdrInitializeThunk,	8_2_013299A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329860 NtQuerySystemInformation,LdrInitializeThunk,	8_2_01329860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329840 NtDelayExecution,LdrInitializeThunk,	8_2_01329840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013298F0 NtReadVirtualMemory,LdrInitializeThunk,	8_2_013298F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329A20 NtResumeThread,LdrInitializeThunk,	8_2_01329A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329A00 NtProtectVirtualMemory,LdrInitializeThunk,	8_2_01329A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329A50 NtCreateFile,LdrInitializeThunk,	8_2_01329A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329540 NtReadFile,LdrInitializeThunk,	8_2_01329540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013295D0 NtClose,LdrInitializeThunk,	8_2_013295D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329710 NtQueryInformationToken,LdrInitializeThunk,	8_2_01329710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013297A0 NtUnmapViewOfSection,LdrInitializeThunk,	8_2_013297A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329780 NtMapViewOfSection,LdrInitializeThunk,	8_2_01329780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329FE0 NtCreateMutant,LdrInitializeThunk,	8_2_01329FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329660 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_01329660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013296E0 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_013296E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329950 NtQueueApcThread,	8_2_01329950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013299D0 NtCreateProcessEx,	8_2_013299D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329820 NtEnumerateKey,	8_2_01329820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0132B040 NtSuspendThread,	8_2_0132B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013298A0 NtWriteVirtualMemory,	8_2_013298A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329B00 NtSetValueKey,	8_2_01329B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0132A3B0 NtGetContextThread,	8_2_0132A3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329A10 NtQuerySection,	8_2_01329A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329A80 NtOpenDirectoryObject,	8_2_01329A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0132AD30 NtSetContextThread,	8_2_0132AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329520 NtWaitForSingleObject,	8_2_01329520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329560 NtWriteFile,	8_2_01329560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013295F0 NtQueryInformationFile,	8_2_013295F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329730 NtQueryVirtualMemory,	8_2_01329730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0132A710 NtOpenProcessToken,	8_2_0132A710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329770 NtSetInformationFile,	8_2_01329770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0132A770 NtOpenThread,	8_2_0132A770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329760 NtOpenProcess,	8_2_01329760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329610 NtEnumerateValueKey,	8_2_01329610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329670 NtQueryInformationProcess,	8_2_01329670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01329650 NtQueryValueKey,	8_2_01329650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013296D0 NtCreateKey,	8_2_013296D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619540 NtReadFile,LdrInitializeThunk,	10_2_05619540
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619910 NtAdjustPrivilegesToken,LdrInitializeThunk,	10_2_05619910
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056195D0 NtClose,LdrInitializeThunk,	10_2_056195D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056199A0 NtCreateSection,LdrInitializeThunk,	10_2_056199A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619860 NtQuerySystemInformation,LdrInitializeThunk,	10_2_05619860
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619840 NtDelayExecution,LdrInitializeThunk,	10_2_05619840
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619710 NtQueryInformationToken,LdrInitializeThunk,	10_2_05619710
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619FE0 NtCreateMutant,LdrInitializeThunk,	10_2_05619FE0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619780 NtMapViewOfSection,LdrInitializeThunk,	10_2_05619780
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619660 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_05619660
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619650 NtQueryValueKey,LdrInitializeThunk,	10_2_05619650
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619A50 NtCreateFile,LdrInitializeThunk,	10_2_05619A50
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056196E0 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_056196E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056196D0 NtCreateKey,LdrInitializeThunk,	10_2_056196D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619560 NtWriteFile,	10_2_05619560
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619950 NtQueueApcThread,	10_2_05619950
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619520 NtWaitForSingleObject,	10_2_05619520
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0561AD30 NtSetContextThread,	10_2_0561AD30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056195F0 NtQueryInformationFile,	10_2_056195F0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056199D0 NtCreateProcessEx,	10_2_056199D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0561B040 NtSuspendThread,	10_2_0561B040
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619820 NtEnumerateKey,	10_2_05619820
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056198F0 NtReadVirtualMemory,	10_2_056198F0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056198A0 NtWriteVirtualMemory,	10_2_056198A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619760 NtOpenProcess,	10_2_05619760
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619770 NtSetInformationFile,	10_2_05619770
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0561A770 NtOpenThread,	10_2_0561A770
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619730 NtQueryVirtualMemory,	10_2_05619730
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619B00 NtSetValueKey,	10_2_05619B00
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0561A710 NtOpenProcessToken,	10_2_0561A710
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056197A0 NtUnmapViewOfSection,	10_2_056197A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0561A3B0 NtGetContextThread,	10_2_0561A3B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619670 NtQueryInformationProcess,	10_2_05619670
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619A20 NtResumeThread,	10_2_05619A20
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619A00 NtProtectVirtualMemory,	10_2_05619A00
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619610 NtEnumerateValueKey,	10_2_05619610
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619A10 NtQuerySection,	10_2_05619A10
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05619A80 NtOpenDirectoryObject,	10_2_05619A80
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A8300 NtClose,	10_2_033A8300
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A83B0 NtAllocateVirtualMemory,	10_2_033A83B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A8280 NtReadFile,	10_2_033A8280
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A81D0 NtCreateFile,	10_2_033A81D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A83AA NtAllocateVirtualMemory,	10_2_033A83AA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A82FA NtClose,	10_2_033A82FA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A81CD NtCreateFile,	10_2_033A81CD

Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D31A8	0_2_019D31A8
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D10C8	0_2_019D10C8
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D22A8	0_2_019D22A8
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D1880	0_2_019D1880
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5A50	0_2_019D5A50
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D1D60	0_2_019D1D60
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D41B8	0_2_019D41B8
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D41A8	0_2_019D41A8
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D30B1	0_2_019D30B1
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D1016	0_2_019D1016
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5038	0_2_019D5038
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5048	0_2_019D5048
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D53F8	0_2_019D53F8
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D229A	0_2_019D229A
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D0480	0_2_019D0480
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5408	0_2_019D5408
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D0472	0_2_019D0472
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D3691	0_2_019D3691
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D36A0	0_2_019D36A0
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5619	0_2_019D5619
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5628	0_2_019D5628
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5888	0_2_019D5888
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5878	0_2_019D5878
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D1870	0_2_019D1870
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D5A40	0_2_019D5A40
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D4D30	0_2_019D4D30
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D4D20	0_2_019D4D20
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D1D51	0_2_019D1D51
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05903FD0	0_2_05903FD0
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05900980	0_2_05900980
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_0590602D	0_2_0590602D
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05901446	0_2_05901446
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05903FC0	0_2_05903FC0
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05901629	0_2_05901629
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05900E50	0_2_05900E50
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05901980	0_2_05901980
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_059019B0	0_2_059019B0
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05900970	0_2_05900970
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_059000FF	0_2_059000FF
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05900007	0_2_05900007
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05900040	0_2_05900040
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05901390	0_2_05901390
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_0590138A	0_2_0590138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00401030	8_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00401174	8_2_00401174
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004012FB	8_2_004012FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041A302	8_2_0041A302
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041CBDF	8_2_0041CBDF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041CBF8	8_2_0041CBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00408C6B	8_2_00408C6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00408C70	8_2_00408C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041B4B6	8_2_0041B4B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402D87	8_2_00402D87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402D90	8_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041B67D	8_2_0041B67D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041CF41	8_2_0041CF41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041B76D	8_2_0041B76D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00402FB0	8_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01304120	8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012EF900	8_2_012EF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1002	8_2_013A1002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012FB090	8_2_012FB090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131EBB0	8_2_0131EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E0D20	8_2_012E0D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B1D55	8_2_013B1D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01306E30	8_2_01306E30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A1D55	10_2_056A1D55
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DF900	10_2_055DF900
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D0D20	10_2_055D0D20
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F4120	10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055ED5E0	10_2_055ED5E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E841F	10_2_055E841F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691002	10_2_05691002
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EB090	10_2_055EB090
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560EBB0	10_2_0560EBB0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F6E30	10_2_055F6E30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033AA302	10_2_033AA302
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033ACBF8	10_2_033ACBF8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033ACBDF	10_2_033ACBDF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033ACF41	10_2_033ACF41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03392FB0	10_2_03392FB0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033AB67D	10_2_033AB67D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03392D90	10_2_03392D90
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03392D87	10_2_03392D87
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03398C70	10_2_03398C70
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03398C6B	10_2_03398C6B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033AB4B6	10_2_033AB4B6

Source: C:\Windows\SysWOW64\explorer.exe

Code function: String function: 055DB150 appears 32 times

Source: PI-0387991.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: PI-0387991.exe, 00000000.00000000.228213118.000000000106D000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCVhq8.exe2 vs PI-0387991.exe
Source: PI-0387991.exe, 00000000.00000002.326381081.0000000005F20000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResource_Meter.dll> vs PI-0387991.exe
Source: PI-0387991.exe, 00000000.00000002.325475852.0000000005860000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs PI-0387991.exe
Source: PI-0387991.exe, 00000000.00000002.330341241.0000000007E90000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs PI-0387991.exe
Source: PI-0387991.exe	Binary or memory string: OriginalFilenameCVhq8.exe2 vs PI-0387991.exe

Source: PI-0387991.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: PI-0387991.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@5/3

Source: C:\Users\user\Desktop\PI-0387991.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PI-0387991.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PI-0387991.exe	Mutant created: \Sessions\1\BaseNamedObjects\QXSFoHSgVnhv
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1064:120:WilError_01

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\explorer.exe

Source: PI-0387991.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PI-0387991.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\PI-0387991.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: PI-0387991.exe	Virustotal: Detection: 50%
Source: PI-0387991.exe	ReversingLabs: Detection: 43%

Source: unknown	Process created: C:\Users\user\Desktop\PI-0387991.exe 'C:\Users\user\Desktop\PI-0387991.exe'
Source: C:\Users\user\Desktop\PI-0387991.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PI-0387991.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'	Jump to behavior

Source: C:\Users\user\Desktop\PI-0387991.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PI-0387991.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PI-0387991.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: explorer.pdbUGP source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000009.00000000.342044175.0000000006FE0000.00000002.00000001.sdmp
Source:	Binary string: RegSvcs.pdb, source: explorer.exe, 0000000A.00000002.501905978.0000000005AE7000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, explorer.exe, 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, explorer.exe
Source:	Binary string: explorer.pdb source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp
Source:	Binary string: RegSvcs.pdb source: explorer.exe, 0000000A.00000002.501905978.0000000005AE7000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000009.00000000.342044175.0000000006FE0000.00000002.00000001.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: PI-0387991.exe, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.PI-0387991.exe.f90000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.PI-0387991.exe.f90000.0.unpack, uNotepad/Form1.cs	.Net Code: TGBNJUYHFDERWS System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_00FEE9EE push ss; iretd	0_2_00FEE9F4
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_019D61E9 push ebx; iretd	0_2_019D61EA
Source: C:\Users\user\Desktop\PI-0387991.exe	Code function: 0_2_05909235 push FFFFFF8Bh; iretd	0_2_05909237
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004161E2 push ecx; iretd	8_2_004161E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041C309 pushfd ; iretd	8_2_0041C30A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041B3C5 push eax; ret	8_2_0041B418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041B47C push eax; ret	8_2_0041B482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041B412 push eax; ret	8_2_0041B418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0041B41B push eax; ret	8_2_0041B482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00415F53 pushfd ; iretd	8_2_00415F86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_004157CE push edi; ret	8_2_004157D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_00415F93 pushfd ; iretd	8_2_00415F86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0133D0D1 push ecx; ret	8_2_0133D0E4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0562D0D1 push ecx; ret	10_2_0562D0E4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033AC309 pushfd ; iretd	10_2_033AC30A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033AB3C5 push eax; ret	10_2_033AB418
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A61E2 push ecx; iretd	10_2_033A61E3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A5F53 pushfd ; iretd	10_2_033A5F86
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A5F93 pushfd ; iretd	10_2_033A5F86
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033A57CE push edi; ret	10_2_033A57D4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033AB41B push eax; ret	10_2_033AB482
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033AB412 push eax; ret	10_2_033AB418
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_033AB47C push eax; ret	10_2_033AB482

Source: initial sample

Static PE information: section name: .text entropy: 7.71928782893

Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI-0387991.exe PID: 5736, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe	RDTSC instruction interceptor: First address: 00000000033985F4 second address: 00000000033985FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe	RDTSC instruction interceptor: First address: 000000000339898E second address: 0000000003398994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_004088C0 rdtsc

8_2_004088C0

Source: C:\Users\user\Desktop\PI-0387991.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\PI-0387991.exe TID: 1456

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PI-0387991.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 00000009.00000000.346102181.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: explorer.exe, 00000009.00000000.345439561.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000009.00000000.360069289.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000009.00000000.328026407.0000000003767000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000009.00000000.356898558.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000009.00000000.346165392.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000009.00000000.345439561.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000009.00000000.366899720.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000009.00000000.345439561.0000000008270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000009.00000000.346165392.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: PI-0387991.exe, 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000009.00000000.345439561.0000000008270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PI-0387991.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_004088C0 rdtsc

8_2_004088C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_00409B30 LdrLoadDll,

8_2_00409B30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01304120 mov eax, dword ptr fs:[00000030h]	8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01304120 mov eax, dword ptr fs:[00000030h]	8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01304120 mov eax, dword ptr fs:[00000030h]	8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01304120 mov eax, dword ptr fs:[00000030h]	8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01304120 mov ecx, dword ptr fs:[00000030h]	8_2_01304120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E9100 mov eax, dword ptr fs:[00000030h]	8_2_012E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E9100 mov eax, dword ptr fs:[00000030h]	8_2_012E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E9100 mov eax, dword ptr fs:[00000030h]	8_2_012E9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012EB171 mov eax, dword ptr fs:[00000030h]	8_2_012EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012EB171 mov eax, dword ptr fs:[00000030h]	8_2_012EB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0130B944 mov eax, dword ptr fs:[00000030h]	8_2_0130B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0130B944 mov eax, dword ptr fs:[00000030h]	8_2_0130B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0130C182 mov eax, dword ptr fs:[00000030h]	8_2_0130C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131A185 mov eax, dword ptr fs:[00000030h]	8_2_0131A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012EB1E1 mov eax, dword ptr fs:[00000030h]	8_2_012EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012EB1E1 mov eax, dword ptr fs:[00000030h]	8_2_012EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012EB1E1 mov eax, dword ptr fs:[00000030h]	8_2_012EB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012FB02A mov eax, dword ptr fs:[00000030h]	8_2_012FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012FB02A mov eax, dword ptr fs:[00000030h]	8_2_012FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012FB02A mov eax, dword ptr fs:[00000030h]	8_2_012FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012FB02A mov eax, dword ptr fs:[00000030h]	8_2_012FB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01367016 mov eax, dword ptr fs:[00000030h]	8_2_01367016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01367016 mov eax, dword ptr fs:[00000030h]	8_2_01367016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01367016 mov eax, dword ptr fs:[00000030h]	8_2_01367016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A2073 mov eax, dword ptr fs:[00000030h]	8_2_013A2073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B1074 mov eax, dword ptr fs:[00000030h]	8_2_013B1074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131F0BF mov ecx, dword ptr fs:[00000030h]	8_2_0131F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131F0BF mov eax, dword ptr fs:[00000030h]	8_2_0131F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131F0BF mov eax, dword ptr fs:[00000030h]	8_2_0131F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013290AF mov eax, dword ptr fs:[00000030h]	8_2_013290AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E9080 mov eax, dword ptr fs:[00000030h]	8_2_012E9080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A131B mov eax, dword ptr fs:[00000030h]	8_2_013A131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B8B58 mov eax, dword ptr fs:[00000030h]	8_2_013B8B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B5BA5 mov eax, dword ptr fs:[00000030h]	8_2_013B5BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A138A mov eax, dword ptr fs:[00000030h]	8_2_013A138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0139B260 mov eax, dword ptr fs:[00000030h]	8_2_0139B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0139B260 mov eax, dword ptr fs:[00000030h]	8_2_0139B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E9240 mov eax, dword ptr fs:[00000030h]	8_2_012E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E9240 mov eax, dword ptr fs:[00000030h]	8_2_012E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E9240 mov eax, dword ptr fs:[00000030h]	8_2_012E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E9240 mov eax, dword ptr fs:[00000030h]	8_2_012E9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h]	8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h]	8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h]	8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h]	8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E52A5 mov eax, dword ptr fs:[00000030h]	8_2_012E52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131D294 mov eax, dword ptr fs:[00000030h]	8_2_0131D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131D294 mov eax, dword ptr fs:[00000030h]	8_2_0131D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B8D34 mov eax, dword ptr fs:[00000030h]	8_2_013B8D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012EAD30 mov eax, dword ptr fs:[00000030h]	8_2_012EAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0130C577 mov eax, dword ptr fs:[00000030h]	8_2_0130C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0130C577 mov eax, dword ptr fs:[00000030h]	8_2_0130C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01307D50 mov eax, dword ptr fs:[00000030h]	8_2_01307D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01323D43 mov eax, dword ptr fs:[00000030h]	8_2_01323D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013135A1 mov eax, dword ptr fs:[00000030h]	8_2_013135A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h]	8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h]	8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h]	8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h]	8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E2D8A mov eax, dword ptr fs:[00000030h]	8_2_012E2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01398DF1 mov eax, dword ptr fs:[00000030h]	8_2_01398DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131BC2C mov eax, dword ptr fs:[00000030h]	8_2_0131BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B740D mov eax, dword ptr fs:[00000030h]	8_2_013B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B740D mov eax, dword ptr fs:[00000030h]	8_2_013B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B740D mov eax, dword ptr fs:[00000030h]	8_2_013B740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A1C06 mov eax, dword ptr fs:[00000030h]	8_2_013A1C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0130746D mov eax, dword ptr fs:[00000030h]	8_2_0130746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013A14FB mov eax, dword ptr fs:[00000030h]	8_2_013A14FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B8CD6 mov eax, dword ptr fs:[00000030h]	8_2_013B8CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E4F2E mov eax, dword ptr fs:[00000030h]	8_2_012E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012E4F2E mov eax, dword ptr fs:[00000030h]	8_2_012E4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0131E730 mov eax, dword ptr fs:[00000030h]	8_2_0131E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0137FF10 mov eax, dword ptr fs:[00000030h]	8_2_0137FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0137FF10 mov eax, dword ptr fs:[00000030h]	8_2_0137FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B070D mov eax, dword ptr fs:[00000030h]	8_2_013B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B070D mov eax, dword ptr fs:[00000030h]	8_2_013B070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B8F6A mov eax, dword ptr fs:[00000030h]	8_2_013B8F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_012FEF40 mov eax, dword ptr fs:[00000030h]	8_2_012FEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0139FE3F mov eax, dword ptr fs:[00000030h]	8_2_0139FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013646A7 mov eax, dword ptr fs:[00000030h]	8_2_013646A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B0EA5 mov eax, dword ptr fs:[00000030h]	8_2_013B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B0EA5 mov eax, dword ptr fs:[00000030h]	8_2_013B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B0EA5 mov eax, dword ptr fs:[00000030h]	8_2_013B0EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0137FE87 mov eax, dword ptr fs:[00000030h]	8_2_0137FE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013116E0 mov ecx, dword ptr fs:[00000030h]	8_2_013116E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013B8ED6 mov eax, dword ptr fs:[00000030h]	8_2_013B8ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0139FEC0 mov eax, dword ptr fs:[00000030h]	8_2_0139FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_013136CC mov eax, dword ptr fs:[00000030h]	8_2_013136CC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F7D50 mov eax, dword ptr fs:[00000030h]	10_2_055F7D50
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FB944 mov eax, dword ptr fs:[00000030h]	10_2_055FB944
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FB944 mov eax, dword ptr fs:[00000030h]	10_2_055FB944
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05613D43 mov eax, dword ptr fs:[00000030h]	10_2_05613D43
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05653540 mov eax, dword ptr fs:[00000030h]	10_2_05653540
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FC577 mov eax, dword ptr fs:[00000030h]	10_2_055FC577
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FC577 mov eax, dword ptr fs:[00000030h]	10_2_055FC577
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DB171 mov eax, dword ptr fs:[00000030h]	10_2_055DB171
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DB171 mov eax, dword ptr fs:[00000030h]	10_2_055DB171
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DC962 mov eax, dword ptr fs:[00000030h]	10_2_055DC962
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0565A537 mov eax, dword ptr fs:[00000030h]	10_2_0565A537
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560513A mov eax, dword ptr fs:[00000030h]	10_2_0560513A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560513A mov eax, dword ptr fs:[00000030h]	10_2_0560513A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05604D3B mov eax, dword ptr fs:[00000030h]	10_2_05604D3B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05604D3B mov eax, dword ptr fs:[00000030h]	10_2_05604D3B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05604D3B mov eax, dword ptr fs:[00000030h]	10_2_05604D3B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D9100 mov eax, dword ptr fs:[00000030h]	10_2_055D9100
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D9100 mov eax, dword ptr fs:[00000030h]	10_2_055D9100
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D9100 mov eax, dword ptr fs:[00000030h]	10_2_055D9100
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A8D34 mov eax, dword ptr fs:[00000030h]	10_2_056A8D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E3D34 mov eax, dword ptr fs:[00000030h]	10_2_055E3D34
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DAD30 mov eax, dword ptr fs:[00000030h]	10_2_055DAD30
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F4120 mov eax, dword ptr fs:[00000030h]	10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F4120 mov eax, dword ptr fs:[00000030h]	10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F4120 mov eax, dword ptr fs:[00000030h]	10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F4120 mov eax, dword ptr fs:[00000030h]	10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F4120 mov ecx, dword ptr fs:[00000030h]	10_2_055F4120
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056641E8 mov eax, dword ptr fs:[00000030h]	10_2_056641E8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05688DF1 mov eax, dword ptr fs:[00000030h]	10_2_05688DF1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DB1E1 mov eax, dword ptr fs:[00000030h]	10_2_055DB1E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DB1E1 mov eax, dword ptr fs:[00000030h]	10_2_055DB1E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DB1E1 mov eax, dword ptr fs:[00000030h]	10_2_055DB1E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055ED5E0 mov eax, dword ptr fs:[00000030h]	10_2_055ED5E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055ED5E0 mov eax, dword ptr fs:[00000030h]	10_2_055ED5E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056061A0 mov eax, dword ptr fs:[00000030h]	10_2_056061A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056061A0 mov eax, dword ptr fs:[00000030h]	10_2_056061A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056035A1 mov eax, dword ptr fs:[00000030h]	10_2_056035A1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056569A6 mov eax, dword ptr fs:[00000030h]	10_2_056569A6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05601DB5 mov eax, dword ptr fs:[00000030h]	10_2_05601DB5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05601DB5 mov eax, dword ptr fs:[00000030h]	10_2_05601DB5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05601DB5 mov eax, dword ptr fs:[00000030h]	10_2_05601DB5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h]	10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h]	10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h]	10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h]	10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D2D8A mov eax, dword ptr fs:[00000030h]	10_2_055D2D8A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056551BE mov eax, dword ptr fs:[00000030h]	10_2_056551BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056551BE mov eax, dword ptr fs:[00000030h]	10_2_056551BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056551BE mov eax, dword ptr fs:[00000030h]	10_2_056551BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056551BE mov eax, dword ptr fs:[00000030h]	10_2_056551BE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FC182 mov eax, dword ptr fs:[00000030h]	10_2_055FC182
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560A185 mov eax, dword ptr fs:[00000030h]	10_2_0560A185
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05602990 mov eax, dword ptr fs:[00000030h]	10_2_05602990
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560FD9B mov eax, dword ptr fs:[00000030h]	10_2_0560FD9B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560FD9B mov eax, dword ptr fs:[00000030h]	10_2_0560FD9B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F0050 mov eax, dword ptr fs:[00000030h]	10_2_055F0050
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F0050 mov eax, dword ptr fs:[00000030h]	10_2_055F0050
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05692073 mov eax, dword ptr fs:[00000030h]	10_2_05692073
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A1074 mov eax, dword ptr fs:[00000030h]	10_2_056A1074
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560A44B mov eax, dword ptr fs:[00000030h]	10_2_0560A44B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F746D mov eax, dword ptr fs:[00000030h]	10_2_055F746D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566C450 mov eax, dword ptr fs:[00000030h]	10_2_0566C450
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566C450 mov eax, dword ptr fs:[00000030h]	10_2_0566C450
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560BC2C mov eax, dword ptr fs:[00000030h]	10_2_0560BC2C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h]	10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h]	10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h]	10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h]	10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560002D mov eax, dword ptr fs:[00000030h]	10_2_0560002D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A740D mov eax, dword ptr fs:[00000030h]	10_2_056A740D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A740D mov eax, dword ptr fs:[00000030h]	10_2_056A740D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A740D mov eax, dword ptr fs:[00000030h]	10_2_056A740D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05691C06 mov eax, dword ptr fs:[00000030h]	10_2_05691C06
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05656C0A mov eax, dword ptr fs:[00000030h]	10_2_05656C0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05656C0A mov eax, dword ptr fs:[00000030h]	10_2_05656C0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05656C0A mov eax, dword ptr fs:[00000030h]	10_2_05656C0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05656C0A mov eax, dword ptr fs:[00000030h]	10_2_05656C0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05657016 mov eax, dword ptr fs:[00000030h]	10_2_05657016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05657016 mov eax, dword ptr fs:[00000030h]	10_2_05657016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05657016 mov eax, dword ptr fs:[00000030h]	10_2_05657016
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EB02A mov eax, dword ptr fs:[00000030h]	10_2_055EB02A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EB02A mov eax, dword ptr fs:[00000030h]	10_2_055EB02A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EB02A mov eax, dword ptr fs:[00000030h]	10_2_055EB02A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EB02A mov eax, dword ptr fs:[00000030h]	10_2_055EB02A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A4015 mov eax, dword ptr fs:[00000030h]	10_2_056A4015
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A4015 mov eax, dword ptr fs:[00000030h]	10_2_056A4015
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056914FB mov eax, dword ptr fs:[00000030h]	10_2_056914FB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05656CF0 mov eax, dword ptr fs:[00000030h]	10_2_05656CF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05656CF0 mov eax, dword ptr fs:[00000030h]	10_2_05656CF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05656CF0 mov eax, dword ptr fs:[00000030h]	10_2_05656CF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566B8D0 mov ecx, dword ptr fs:[00000030h]	10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0566B8D0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A8CD6 mov eax, dword ptr fs:[00000030h]	10_2_056A8CD6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E849B mov eax, dword ptr fs:[00000030h]	10_2_055E849B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056190AF mov eax, dword ptr fs:[00000030h]	10_2_056190AF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D9080 mov eax, dword ptr fs:[00000030h]	10_2_055D9080
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560F0BF mov ecx, dword ptr fs:[00000030h]	10_2_0560F0BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560F0BF mov eax, dword ptr fs:[00000030h]	10_2_0560F0BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560F0BF mov eax, dword ptr fs:[00000030h]	10_2_0560F0BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05653884 mov eax, dword ptr fs:[00000030h]	10_2_05653884
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05653884 mov eax, dword ptr fs:[00000030h]	10_2_05653884
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A8F6A mov eax, dword ptr fs:[00000030h]	10_2_056A8F6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DF358 mov eax, dword ptr fs:[00000030h]	10_2_055DF358
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05603B7A mov eax, dword ptr fs:[00000030h]	10_2_05603B7A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05603B7A mov eax, dword ptr fs:[00000030h]	10_2_05603B7A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DDB40 mov eax, dword ptr fs:[00000030h]	10_2_055DDB40
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EEF40 mov eax, dword ptr fs:[00000030h]	10_2_055EEF40
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A8B58 mov eax, dword ptr fs:[00000030h]	10_2_056A8B58
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DDB60 mov ecx, dword ptr fs:[00000030h]	10_2_055DDB60
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EFF60 mov eax, dword ptr fs:[00000030h]	10_2_055EFF60
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FF716 mov eax, dword ptr fs:[00000030h]	10_2_055FF716
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560E730 mov eax, dword ptr fs:[00000030h]	10_2_0560E730
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A070D mov eax, dword ptr fs:[00000030h]	10_2_056A070D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A070D mov eax, dword ptr fs:[00000030h]	10_2_056A070D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560A70E mov eax, dword ptr fs:[00000030h]	10_2_0560A70E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560A70E mov eax, dword ptr fs:[00000030h]	10_2_0560A70E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0569131B mov eax, dword ptr fs:[00000030h]	10_2_0569131B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D4F2E mov eax, dword ptr fs:[00000030h]	10_2_055D4F2E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D4F2E mov eax, dword ptr fs:[00000030h]	10_2_055D4F2E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566FF10 mov eax, dword ptr fs:[00000030h]	10_2_0566FF10
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566FF10 mov eax, dword ptr fs:[00000030h]	10_2_0566FF10
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h]	10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h]	10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h]	10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h]	10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h]	10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056003E2 mov eax, dword ptr fs:[00000030h]	10_2_056003E2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056137F5 mov eax, dword ptr fs:[00000030h]	10_2_056137F5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056553CA mov eax, dword ptr fs:[00000030h]	10_2_056553CA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056553CA mov eax, dword ptr fs:[00000030h]	10_2_056553CA
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E8794 mov eax, dword ptr fs:[00000030h]	10_2_055E8794
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A5BA5 mov eax, dword ptr fs:[00000030h]	10_2_056A5BA5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E1B8F mov eax, dword ptr fs:[00000030h]	10_2_055E1B8F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E1B8F mov eax, dword ptr fs:[00000030h]	10_2_055E1B8F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0569138A mov eax, dword ptr fs:[00000030h]	10_2_0569138A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0568D380 mov ecx, dword ptr fs:[00000030h]	10_2_0568D380
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560B390 mov eax, dword ptr fs:[00000030h]	10_2_0560B390
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05657794 mov eax, dword ptr fs:[00000030h]	10_2_05657794
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05657794 mov eax, dword ptr fs:[00000030h]	10_2_05657794
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05657794 mov eax, dword ptr fs:[00000030h]	10_2_05657794
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0568B260 mov eax, dword ptr fs:[00000030h]	10_2_0568B260
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0568B260 mov eax, dword ptr fs:[00000030h]	10_2_0568B260
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A8A62 mov eax, dword ptr fs:[00000030h]	10_2_056A8A62
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0561927A mov eax, dword ptr fs:[00000030h]	10_2_0561927A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D9240 mov eax, dword ptr fs:[00000030h]	10_2_055D9240
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D9240 mov eax, dword ptr fs:[00000030h]	10_2_055D9240
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D9240 mov eax, dword ptr fs:[00000030h]	10_2_055D9240
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D9240 mov eax, dword ptr fs:[00000030h]	10_2_055D9240
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h]	10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h]	10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h]	10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h]	10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h]	10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E7E41 mov eax, dword ptr fs:[00000030h]	10_2_055E7E41
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h]	10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h]	10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h]	10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h]	10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055FAE73 mov eax, dword ptr fs:[00000030h]	10_2_055FAE73
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05664257 mov eax, dword ptr fs:[00000030h]	10_2_05664257
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E766D mov eax, dword ptr fs:[00000030h]	10_2_055E766D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055F3A1C mov eax, dword ptr fs:[00000030h]	10_2_055F3A1C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DAA16 mov eax, dword ptr fs:[00000030h]	10_2_055DAA16
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DAA16 mov eax, dword ptr fs:[00000030h]	10_2_055DAA16
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E8A0A mov eax, dword ptr fs:[00000030h]	10_2_055E8A0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0568FE3F mov eax, dword ptr fs:[00000030h]	10_2_0568FE3F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DC600 mov eax, dword ptr fs:[00000030h]	10_2_055DC600
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DC600 mov eax, dword ptr fs:[00000030h]	10_2_055DC600
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DC600 mov eax, dword ptr fs:[00000030h]	10_2_055DC600
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05608E00 mov eax, dword ptr fs:[00000030h]	10_2_05608E00
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560A61C mov eax, dword ptr fs:[00000030h]	10_2_0560A61C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560A61C mov eax, dword ptr fs:[00000030h]	10_2_0560A61C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055DE620 mov eax, dword ptr fs:[00000030h]	10_2_055DE620
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056016E0 mov ecx, dword ptr fs:[00000030h]	10_2_056016E0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05602AE4 mov eax, dword ptr fs:[00000030h]	10_2_05602AE4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05618EC7 mov eax, dword ptr fs:[00000030h]	10_2_05618EC7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0568FEC0 mov eax, dword ptr fs:[00000030h]	10_2_0568FEC0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_05602ACB mov eax, dword ptr fs:[00000030h]	10_2_05602ACB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056036CC mov eax, dword ptr fs:[00000030h]	10_2_056036CC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A8ED6 mov eax, dword ptr fs:[00000030h]	10_2_056A8ED6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055E76E2 mov eax, dword ptr fs:[00000030h]	10_2_055E76E2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056546A7 mov eax, dword ptr fs:[00000030h]	10_2_056546A7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A0EA5 mov eax, dword ptr fs:[00000030h]	10_2_056A0EA5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A0EA5 mov eax, dword ptr fs:[00000030h]	10_2_056A0EA5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_056A0EA5 mov eax, dword ptr fs:[00000030h]	10_2_056A0EA5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560FAB0 mov eax, dword ptr fs:[00000030h]	10_2_0560FAB0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0566FE87 mov eax, dword ptr fs:[00000030h]	10_2_0566FE87
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EAAB0 mov eax, dword ptr fs:[00000030h]	10_2_055EAAB0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055EAAB0 mov eax, dword ptr fs:[00000030h]	10_2_055EAAB0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560D294 mov eax, dword ptr fs:[00000030h]	10_2_0560D294
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0560D294 mov eax, dword ptr fs:[00000030h]	10_2_0560D294
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h]	10_2_055D52A5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h]	10_2_055D52A5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h]	10_2_055D52A5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h]	10_2_055D52A5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_055D52A5 mov eax, dword ptr fs:[00000030h]	10_2_055D52A5

Source: C:\Users\user\Desktop\PI-0387991.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PI-0387991.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.siteoficial-liquida.com
Source: C:\Windows\explorer.exe	Domain query: www.idookap.com
Source: C:\Windows\explorer.exe	Domain query: www.romahony.com
Source: C:\Windows\explorer.exe	Network Connect: 162.241.2.50 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.120.82.56 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.bodymoisturizer.online
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\PI-0387991.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread register set: target process: 3472			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread register set: target process: 3472			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Section unmapped: C:\Windows\SysWOW64\explorer.exe base address: F20000

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\PI-0387991.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: BFA008	Jump to behavior

Source: C:\Users\user\Desktop\PI-0387991.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe {path}			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'			Jump to behavior

Source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp, explorer.exe, 00000009.00000000.346207421.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000009.00000000.325488845.0000000001640000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000009.00000000.325488845.0000000001640000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: RegSvcs.exe, 00000008.00000002.379492526.0000000003050000.00000040.00000001.sdmp	Binary or memory string: Microsoft-Reserved-24C26ACC-DE62-4303-88AD-6CD4F1447F18SecurityConfigureWindowsPasswordsProxy DesktopProgmanSoftware\Microsoft\Windows NT\CurrentVersion\WinlogonShellSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells\AvailableShells
Source: explorer.exe, 00000009.00000000.325122928.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000009.00000000.325488845.0000000001640000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000009.00000000.325488845.0000000001640000.00000002.00000001.sdmp, explorer.exe, 0000000A.00000002.499737802.0000000003E60000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Users\user\Desktop\PI-0387991.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PI-0387991.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PI-0387991.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection712	Masquerading1	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection712	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PI-0387991.exe	50%	Virustotal		Browse
PI-0387991.exe	43%	ReversingLabs	Win32.Trojan.AgentTesla
PI-0387991.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.2.RegSvcs.exe.3050000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
8.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
10.2.explorer.exe.f20000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.0.explorer.exe.f20000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Link
hispanicassoclv.com	2%	Virustotal	Browse
www.romahony.com	0%	Virustotal	Browse
siteoficial-liquida.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.hispanicassoclv.com/q4kr/?m4z=hZWT6D&KdPxHVdh=+adpk/1z85ABQgFM8KoV7nh2RN9wNRyN3NacL4PKZthW2WB1UYKLVSKaUBe2HmITnYf8	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn-i-d)	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/7	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm3	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/oil	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.romahony.com/q4kr/?m4z=hZWT6D&KdPxHVdh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHZjowo3ayyv	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cnobt	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/)	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/)	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/)	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.comd	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.siteoficial-liquida.com/q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D	0%	Avira URL Cloud	safe
http://www.carterandcone.comporFxlei	0%	Avira URL Cloud	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.carterandcone.come	0%	URL Reputation	safe
http://www.sajatypeworks.comx	0%	Avira URL Cloud	safe
http://www.idookap.com/q4kr/?m4z=hZWT6D&KdPxHVdh=8Twh4s36gZRno0YiIaK1Aog0Jq5SRxj1tGC/kNtcN6cj6UbdIOqmSeR7M7wA7kAlsS0+	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.zhongyicts.com.cne	0%	URL Reputation	safe
http://www.zhongyicts.com.cne	0%	URL Reputation	safe
http://www.zhongyicts.com.cne	0%	URL Reputation	safe
http://www.tiro.com~	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
www.bodymoisturizer.online/q4kr/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.comt	0%	URL Reputation	safe
http://www.fontbureau.comt	0%	URL Reputation	safe
http://www.fontbureau.comt	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/)	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.carterandcone.com_f	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/f	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/f	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/f	0%	URL Reputation	safe
http://www.carterandcone.comUfee	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/k-e	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hispanicassoclv.com	34.102.136.180	true	false	2%, Virustotal, Browse	unknown
www.romahony.com	103.120.82.56	true	true	0%, Virustotal, Browse	unknown
siteoficial-liquida.com	162.241.2.50	true	true	0%, Virustotal, Browse	unknown
idookap.com	34.102.136.180	true	false		unknown
www.siteoficial-liquida.com	unknown	unknown	true		unknown
www.idookap.com	unknown	unknown	true		unknown
www.bodymoisturizer.online	unknown	unknown	true		unknown
www.hispanicassoclv.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.hispanicassoclv.com/q4kr/?m4z=hZWT6D&KdPxHVdh=+adpk/1z85ABQgFM8KoV7nh2RN9wNRyN3NacL4PKZthW2WB1UYKLVSKaUBe2HmITnYf8	false	Avira URL Cloud: safe	unknown
http://www.romahony.com/q4kr/?m4z=hZWT6D&KdPxHVdh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHZjowo3ayyv	true	Avira URL Cloud: safe	unknown
http://www.siteoficial-liquida.com/q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D	true	Avira URL Cloud: safe	unknown
http://www.idookap.com/q4kr/?m4z=hZWT6D&KdPxHVdh=8Twh4s36gZRno0YiIaK1Aog0Jq5SRxj1tGC/kNtcN6cj6UbdIOqmSeR7M7wA7kAlsS0+	false	Avira URL Cloud: safe	unknown
www.bodymoisturizer.online/q4kr/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn-i-d)	PI-0387991.exe, 00000000.00000003.234500396.0000000005F7E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com	PI-0387991.exe, 00000000.00000003.235322005.0000000005F7E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/7	PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm3	PI-0387991.exe, 00000000.00000003.243163796.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/oil	PI-0387991.exe, 00000000.00000003.235849740.0000000005F53000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cnobt	PI-0387991.exe, 00000000.00000003.235106286.0000000001A0C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/)	PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fonts.com	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comd	PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.como.	PI-0387991.exe, 00000000.00000003.235286861.0000000005F7E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sakkal.com	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/de	PI-0387991.exe, 00000000.00000003.239980062.0000000001A0B000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.carterandcone.comporFxlei	PI-0387991.exe, 00000000.00000003.235106286.0000000001A0C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.carterandcone.come	PI-0387991.exe, 00000000.00000003.235173657.0000000005F7E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comx	PI-0387991.exe, 00000000.00000003.232499400.0000000001A0C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	PI-0387991.exe, 00000000.00000003.320350638.0000000005F50000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cne	PI-0387991.exe, 00000000.00000003.234998306.0000000005F7D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com~	PI-0387991.exe, 00000000.00000003.234687612.0000000005F5B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.carterandcone.coml	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	PI-0387991.exe, 00000000.00000003.234373089.0000000005F7B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comt	PI-0387991.exe, 00000000.00000003.320350638.0000000005F50000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/)	PI-0387991.exe, 00000000.00000003.236232775.0000000005F53000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp, PI-0387991.exe, 00000000.00000003.236602049.0000000005F5B000.00000004.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.com_f	PI-0387991.exe, 00000000.00000003.235173657.0000000005F7E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers8	PI-0387991.exe, 00000000.00000002.326631678.00000000060C0000.00000002.00000001.sdmp, explorer.exe, 00000009.00000000.347910167.000000000BC30000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/f	PI-0387991.exe, 00000000.00000003.236914102.0000000005F5B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.comUfee	PI-0387991.exe, 00000000.00000003.235286861.0000000005F7E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/k-e	PI-0387991.exe, 00000000.00000003.237137879.0000000005F5C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
103.120.82.56	www.romahony.com	Hong Kong	139021	WEST263GO-HKWest263InternationalLimitedHK	true
34.102.136.180	hispanicassoclv.com	United States	15169	GOOGLEUS	false
162.241.2.50	siteoficial-liquida.com	United States	26337	OIS1US	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	452542
Start date:	22.07.2021
Start time:	15:03:58
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PI-0387991.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@5/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 33.2% (good quality ratio 29.6%) Quality average: 71.3% Quality standard deviation: 32.9%
HCA Information:	Successful, ratio: 97% Number of executed functions: 112 Number of non-executed functions: 102
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 13.64.90.137, 131.253.33.200, 13.107.22.200, 93.184.220.29, 104.43.139.144, 23.211.4.86 Excluded domains from analysis (whitelisted): www.bing.com, skypedataprdcolwus17.cloudapp.net, cs9.wac.phicdn.net, fs.microsoft.com, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, dual-a-0001.dc-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, ocsp.digicert.com, blobcollector.events.data.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.120.82.56	MX-M502N_201145.exe	Get hash	malicious	Browse	www.romahony.com/q4kr/?f48lqdCh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHE5Z4hIPAVTo&6lE=bN9T
	Fegvc0Wetr.exe	Get hash	malicious	Browse	www.gcbsclubc.com/nff/?7nz0W=/2QoJkj6lESZa4CqvOXsKAmeRzxfPdS9w4+MBqjVvCLWAIbbuF0NQEAKVb+NJ2vn791v&kT6=Ulg8GPkP8Zgp
	Payment_Advice.exe	Get hash	malicious	Browse	www.romahony.com/q4kr/?iTntSV=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHVj7gk0Diy5BlTIew==&5jo=6leTzTsHNnB4
	88DUknYBXu.exe	Get hash	malicious	Browse	www.gcbsclubc.com/nff/?_JE=/2QoJkj6lESZa4CqvOXsKAmeRzxfPdS9w4+MBqjVvCLWAIbbuF0NQEAKVYe3ZnPfhaUo&-ZkH=9rmDvr4Hp4stJhM
162.241.2.50	Payment_Swift00987.exe	Get hash	malicious	Browse	www.siteoficial-liquida.com/q4kr/?9rn0I=6lThAhBX_TDlt&b2Jd2=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq32Qk2dkUN92Swnyw==
	Payment_Advice.exe	Get hash	malicious	Browse	www.siteoficial-liquida.com/q4kr/?iTntSV=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq32Qk2dkUN92Swnyw==&5jo=6leTzTsHNnB4
	Payment_Advice.exe	Get hash	malicious	Browse	www.siteoficial-liquida.com/q4kr/?QtRl=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcpbmMVqmjhks&w2MLb=6lux

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.romahony.com	MX-M502N_201145.exe	Get hash	malicious	Browse	103.120.82.56
www.romahony.com	Payment_Advice.exe	Get hash	malicious	Browse	103.120.82.56

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WEST263GO-HKWest263InternationalLimitedHK	Inv_7623980.exe	Get hash	malicious	Browse	103.139.0.9
	fLtlowdmEG.exe	Get hash	malicious	Browse	103.139.0.9
	u5xgJUljfI.exe	Get hash	malicious	Browse	103.139.0.9
	wininit(1).exe	Get hash	malicious	Browse	103.139.0.9
	pedido pdf.exe	Get hash	malicious	Browse	219.234.31.177
	MX-M502N_201145.exe	Get hash	malicious	Browse	103.120.82.56
	Fegvc0Wetr.exe	Get hash	malicious	Browse	103.120.82.56
	Payment_Advice.exe	Get hash	malicious	Browse	103.120.82.56
	PO#006611.doc.exe	Get hash	malicious	Browse	103.43.188.130
	88DUknYBXu.exe	Get hash	malicious	Browse	103.120.82.56
	SHIPPING DOCUMENT_7048555233PDF.exe	Get hash	malicious	Browse	103.108.192.24
	Payment Advice-Pdf.exe	Get hash	malicious	Browse	103.139.0.9
	Pdf Scen Invoice 17INV06003.exe	Get hash	malicious	Browse	103.108.192.24
	PO1234EFJL_011LM000_pdf.exe	Get hash	malicious	Browse	219.234.31.216
	REQUEST FOR QUOTATION 1307-RFQ.pdf.exe	Get hash	malicious	Browse	43.224.155.141
	TT COPY (39.750,00 USD).exe	Get hash	malicious	Browse	103.120.83.153
	ntpxrxZCfL.exe	Get hash	malicious	Browse	218.247.86.90
	sgJRcWvnkP.exe	Get hash	malicious	Browse	218.247.86.90
	Shipping Doc.exe	Get hash	malicious	Browse	219.234.8.81
	Client.vbs	Get hash	malicious	Browse	103.120.80.6
OIS1US	vGXbKUQZZpb0fE8.exe	Get hash	malicious	Browse	162.241.85.193
	K7EnL0C9KJ.exe	Get hash	malicious	Browse	192.185.147.20
	Gift Card 0796907.xlsb	Get hash	malicious	Browse	162.241.3.29
	Gift Card 0796907.xlsb	Get hash	malicious	Browse	162.241.3.29
	Order 9572478.xlsb	Get hash	malicious	Browse	162.241.2.50
	Order 9572478.xlsb	Get hash	malicious	Browse	162.241.2.50
	Order 161488.xlsb	Get hash	malicious	Browse	162.241.3.14
	PO 491196.xlsb	Get hash	malicious	Browse	50.116.94.238
	Order 161488.xlsb	Get hash	malicious	Browse	162.241.3.14
	PO 491196.xlsb	Get hash	malicious	Browse	50.116.94.238
	Order 46975986.xlsb	Get hash	malicious	Browse	162.241.3.29
	WO 2308349.xlsb	Get hash	malicious	Browse	162.241.2.147
	Order 46975986.xlsb	Get hash	malicious	Browse	162.241.3.29
	WO 2308349.xlsb	Get hash	malicious	Browse	162.241.2.147
	PO 0314935.xlsb	Get hash	malicious	Browse	162.241.3.29
	WO 2825876.xlsb	Get hash	malicious	Browse	162.241.3.14
	PO 0314935.xlsb	Get hash	malicious	Browse	162.241.3.29
	WO 2825876.xlsb	Get hash	malicious	Browse	162.241.3.14
	Order 1744163.xlsb	Get hash	malicious	Browse	50.116.94.238
	statistic-1496367785.xls	Get hash	malicious	Browse	162.241.2.112

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PI-0387991.exe.log Download File
Process:	C:\Users\user\Desktop\PI-0387991.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.040818063614607
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PI-0387991.exe
File size:	899584
MD5:	655318bec9b30d5a2f2dedf399d87438
SHA1:	23f37c9bddcd8393f499fee9b77220765288020c
SHA256:	8cd1a5c6360cc1c0e513d4cc39f649bcb33b61c47c4b498b992ea8e9a41a48cd
SHA512:	1d9c8a2c6b29a73aca4ec5df29fd3300e9952ce51dfee405e7b2968a0ca50c7c0c6453cf44c4c32fcefac44145accd66f442572ca9cb01fc2ebd468dfc6a42b4
SSDEEP:	12288:UgI23M132q8bSfGiWum/YBiXqDXRXITzftEFe67O+NAwcFSMPQipP5q:JI23Mz51BrMUh4/ftEFe+ipQ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	f0debeffdffeec70

Static PE Info

General
Entrypoint:	0x47f0ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x60F8B1B2 [Wed Jul 21 23:45:54 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7f060	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x5e320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7d0b4	0x7d200	False	0.852360530095	data	7.71928782893	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x80000	0x5e320	0x5e400	False	0.167336704244	data	5.64062676642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe0000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x80220	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x80688	0x1128	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x817b0	0x2668	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x83e18	0x4428	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x88240	0x11028	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x99268	0x44028	data
RT_GROUP_ICON	0xdd290	0x5a	data
RT_VERSION	0xdd2ec	0x30c	data
RT_MANIFEST	0xdd5f8	0xd25	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2016
Assembly Version	1.0.0.0
InternalName	CVhq8.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	uNotepad
ProductVersion	1.0.0.0
FileDescription	uNotepad
OriginalFilename	CVhq8.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/22/21-15:06:46.822458	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49695	34.102.136.180	192.168.2.5
07/22/21-15:06:52.270948	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49696	80	192.168.2.5	162.241.2.50
07/22/21-15:06:52.270948	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49696	80	192.168.2.5	162.241.2.50
07/22/21-15:06:52.270948	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49696	80	192.168.2.5	162.241.2.50
07/22/21-15:06:58.046372	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49697	34.102.136.180	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2021 15:06:35.610822916 CEST	49694	80	192.168.2.5	103.120.82.56
Jul 22, 2021 15:06:35.941490889 CEST	80	49694	103.120.82.56	192.168.2.5
Jul 22, 2021 15:06:35.941876888 CEST	49694	80	192.168.2.5	103.120.82.56
Jul 22, 2021 15:06:35.950139046 CEST	49694	80	192.168.2.5	103.120.82.56
Jul 22, 2021 15:06:36.258795023 CEST	80	49694	103.120.82.56	192.168.2.5
Jul 22, 2021 15:06:36.462307930 CEST	49694	80	192.168.2.5	103.120.82.56
Jul 22, 2021 15:06:36.838871956 CEST	80	49694	103.120.82.56	192.168.2.5
Jul 22, 2021 15:06:46.631675959 CEST	49695	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:46.674765110 CEST	80	49695	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:46.674875021 CEST	49695	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:46.675175905 CEST	49695	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:46.719858885 CEST	80	49695	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:46.822458029 CEST	80	49695	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:46.822484016 CEST	80	49695	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:46.822657108 CEST	49695	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:46.822701931 CEST	49695	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:46.868870974 CEST	80	49695	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:51.325894117 CEST	80	49694	103.120.82.56	192.168.2.5
Jul 22, 2021 15:06:51.325931072 CEST	80	49694	103.120.82.56	192.168.2.5
Jul 22, 2021 15:06:51.326193094 CEST	49694	80	192.168.2.5	103.120.82.56
Jul 22, 2021 15:06:51.326224089 CEST	49694	80	192.168.2.5	103.120.82.56
Jul 22, 2021 15:06:52.110941887 CEST	49696	80	192.168.2.5	162.241.2.50
Jul 22, 2021 15:06:52.270570040 CEST	80	49696	162.241.2.50	192.168.2.5
Jul 22, 2021 15:06:52.270736933 CEST	49696	80	192.168.2.5	162.241.2.50
Jul 22, 2021 15:06:52.270947933 CEST	49696	80	192.168.2.5	162.241.2.50
Jul 22, 2021 15:06:52.429577112 CEST	80	49696	162.241.2.50	192.168.2.5
Jul 22, 2021 15:06:52.760633945 CEST	49696	80	192.168.2.5	162.241.2.50
Jul 22, 2021 15:06:52.965934992 CEST	80	49696	162.241.2.50	192.168.2.5
Jul 22, 2021 15:06:52.987106085 CEST	80	49696	162.241.2.50	192.168.2.5
Jul 22, 2021 15:06:52.987149954 CEST	80	49696	162.241.2.50	192.168.2.5
Jul 22, 2021 15:06:52.987190962 CEST	49696	80	192.168.2.5	162.241.2.50
Jul 22, 2021 15:06:52.987237930 CEST	49696	80	192.168.2.5	162.241.2.50
Jul 22, 2021 15:06:57.863164902 CEST	49697	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:57.906570911 CEST	80	49697	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:57.906814098 CEST	49697	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:57.906836987 CEST	49697	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:57.950033903 CEST	80	49697	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:58.046371937 CEST	80	49697	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:58.046399117 CEST	80	49697	34.102.136.180	192.168.2.5
Jul 22, 2021 15:06:58.047620058 CEST	49697	80	192.168.2.5	34.102.136.180
Jul 22, 2021 15:06:58.089344025 CEST	80	49697	34.102.136.180	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2021 15:04:42.206533909 CEST	53183	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:42.264703989 CEST	53	53183	8.8.8.8	192.168.2.5
Jul 22, 2021 15:04:43.291533947 CEST	57587	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:43.356321096 CEST	53	57587	8.8.8.8	192.168.2.5
Jul 22, 2021 15:04:43.487514019 CEST	55432	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:43.537471056 CEST	53	55432	8.8.8.8	192.168.2.5
Jul 22, 2021 15:04:44.542877913 CEST	64936	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:44.592391014 CEST	53	64936	8.8.8.8	192.168.2.5
Jul 22, 2021 15:04:46.784816980 CEST	52704	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:46.843404055 CEST	53	52704	8.8.8.8	192.168.2.5
Jul 22, 2021 15:04:47.809149981 CEST	52212	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:47.862783909 CEST	53	52212	8.8.8.8	192.168.2.5
Jul 22, 2021 15:04:48.816885948 CEST	54302	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:48.871464968 CEST	53	54302	8.8.8.8	192.168.2.5
Jul 22, 2021 15:04:49.842372894 CEST	53784	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:49.894670010 CEST	53	53784	8.8.8.8	192.168.2.5
Jul 22, 2021 15:04:53.956130981 CEST	65307	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:04:54.014674902 CEST	53	65307	8.8.8.8	192.168.2.5
Jul 22, 2021 15:05:06.875142097 CEST	64344	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:05:06.933842897 CEST	53	64344	8.8.8.8	192.168.2.5
Jul 22, 2021 15:05:09.447016001 CEST	62060	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:05:09.507302046 CEST	53	62060	8.8.8.8	192.168.2.5
Jul 22, 2021 15:06:35.140733957 CEST	61805	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:06:35.602511883 CEST	53	61805	8.8.8.8	192.168.2.5
Jul 22, 2021 15:06:41.487222910 CEST	54795	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:06:41.550591946 CEST	53	54795	8.8.8.8	192.168.2.5
Jul 22, 2021 15:06:46.566061020 CEST	49557	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:06:46.629306078 CEST	53	49557	8.8.8.8	192.168.2.5
Jul 22, 2021 15:06:51.908016920 CEST	61733	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:06:52.109452009 CEST	53	61733	8.8.8.8	192.168.2.5
Jul 22, 2021 15:06:57.778142929 CEST	65447	53	192.168.2.5	8.8.8.8
Jul 22, 2021 15:06:57.859669924 CEST	53	65447	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 22, 2021 15:06:35.140733957 CEST	192.168.2.5	8.8.8.8	0x9d59	Standard query (0)	www.romahony.com	A (IP address)	IN (0x0001)
Jul 22, 2021 15:06:41.487222910 CEST	192.168.2.5	8.8.8.8	0xf92a	Standard query (0)	www.bodymoisturizer.online	A (IP address)	IN (0x0001)
Jul 22, 2021 15:06:46.566061020 CEST	192.168.2.5	8.8.8.8	0xd1e8	Standard query (0)	www.idookap.com	A (IP address)	IN (0x0001)
Jul 22, 2021 15:06:51.908016920 CEST	192.168.2.5	8.8.8.8	0xdc94	Standard query (0)	www.siteoficial-liquida.com	A (IP address)	IN (0x0001)
Jul 22, 2021 15:06:57.778142929 CEST	192.168.2.5	8.8.8.8	0x7ce	Standard query (0)	www.hispanicassoclv.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 22, 2021 15:06:35.602511883 CEST	8.8.8.8	192.168.2.5	0x9d59	No error (0)	www.romahony.com		103.120.82.56	A (IP address)	IN (0x0001)
Jul 22, 2021 15:06:41.550591946 CEST	8.8.8.8	192.168.2.5	0xf92a	Name error (3)	www.bodymoisturizer.online	none	none	A (IP address)	IN (0x0001)
Jul 22, 2021 15:06:46.629306078 CEST	8.8.8.8	192.168.2.5	0xd1e8	No error (0)	www.idookap.com	idookap.com		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 15:06:46.629306078 CEST	8.8.8.8	192.168.2.5	0xd1e8	No error (0)	idookap.com		34.102.136.180	A (IP address)	IN (0x0001)
Jul 22, 2021 15:06:52.109452009 CEST	8.8.8.8	192.168.2.5	0xdc94	No error (0)	www.siteoficial-liquida.com	siteoficial-liquida.com		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 15:06:52.109452009 CEST	8.8.8.8	192.168.2.5	0xdc94	No error (0)	siteoficial-liquida.com		162.241.2.50	A (IP address)	IN (0x0001)
Jul 22, 2021 15:06:57.859669924 CEST	8.8.8.8	192.168.2.5	0x7ce	No error (0)	www.hispanicassoclv.com	hispanicassoclv.com		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2021 15:06:57.859669924 CEST	8.8.8.8	192.168.2.5	0x7ce	No error (0)	hispanicassoclv.com		34.102.136.180	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.romahony.com

www.idookap.com

www.siteoficial-liquida.com

www.hispanicassoclv.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49694	103.120.82.56	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 15:06:35.950139046 CEST	306	OUT	GET /q4kr/?m4z=hZWT6D&KdPxHVdh=stDcKtJiFThdGrRpndYyQbsbrCSX1QkCWnDTnTci+riMDIV/FP53rWURHHZjowo3ayyv HTTP/1.1 Host: www.romahony.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 22, 2021 15:06:51.325894117 CEST	308	IN	HTTP/1.1 404 Not Found Date: Thu, 22 Jul 2021 13:06:49 GMT Server: Apache/2.4.41 (Ubuntu) Status: 404 Not Found Vary: Accept-Encoding referer: http://image.baidu.com Content-Length: 0 Connection: close Content-Type: text/html;charset=utf-8;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49695	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 15:06:46.675175905 CEST	307	OUT	GET /q4kr/?m4z=hZWT6D&KdPxHVdh=8Twh4s36gZRno0YiIaK1Aog0Jq5SRxj1tGC/kNtcN6cj6UbdIOqmSeR7M7wA7kAlsS0+ HTTP/1.1 Host: www.idookap.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 22, 2021 15:06:46.822458029 CEST	307	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 22 Jul 2021 13:06:46 GMT Content-Type: text/html Content-Length: 275 ETag: "60ef677e-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49696	162.241.2.50	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 15:06:52.270947933 CEST	308	OUT	GET /q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D HTTP/1.1 Host: www.siteoficial-liquida.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 22, 2021 15:06:52.987106085 CEST	309	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 22 Jul 2021 13:06:52 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://siteoficial-liquida.com/q4kr/?KdPxHVdh=UTB9cmVppYOj/UC3W28IAi1vRKY7uisBtiUczDixbM3KLxocs5bu1DNZcq72D06e9ENr&m4z=hZWT6D Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49697	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 22, 2021 15:06:57.906836987 CEST	310	OUT	GET /q4kr/?m4z=hZWT6D&KdPxHVdh=+adpk/1z85ABQgFM8KoV7nh2RN9wNRyN3NacL4PKZthW2WB1UYKLVSKaUBe2HmITnYf8 HTTP/1.1 Host: www.hispanicassoclv.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 22, 2021 15:06:58.046371937 CEST	311	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 22 Jul 2021 13:06:57 GMT Content-Type: text/html Content-Length: 275 ETag: "60ef677e-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PI-0387991.exe PID: 5736 Parent PID: 5600

General

Start time:	15:04:49
Start date:	22/07/2021
Path:	C:\Users\user\Desktop\PI-0387991.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PI-0387991.exe'
Imagebase:	0xf90000
File size:	899584 bytes
MD5 hash:	655318BEC9B30D5A2F2DEDF399D87438
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.322811703.0000000004381000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.321727196.0000000003381000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: RegSvcs.exe PID: 3328 Parent PID: 5736

General

Start time:	15:05:32
Start date:	22/07/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x7ff797770000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.377469940.0000000000E30000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.377521591.0000000000E60000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 3328

General

Start time:	15:05:34
Start date:	22/07/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 5076 Parent PID: 3472

General

Start time:	15:05:55
Start date:	22/07/2021
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xf20000
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.498996789.00000000039D0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.499283578.0000000003A00000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4860 Parent PID: 5076

General

Start time:	15:06:00
Start date:	22/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1064 Parent PID: 4860

General

Start time:	15:06:00
Start date:	22/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PI-0387991.exe PID: 5736 Parent PID: 5600 PI-0387991.exeCOMMON

Executed Functions

Function 019D1016, Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

vgT#, xrefs: 019D1237

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: vgT#
API String ID: 0-1580733659
Opcode ID: 8b1a6d05ce8c4a3436d4c188ceaeff4f8e1335f2cc9b1bd385c3c14da805e5ed
Instruction ID: 57b1ac8b5e5b0ebd4465f890798485b5878847ca9abe21a45fdc648f4128f85f
Opcode Fuzzy Hash: 8b1a6d05ce8c4a3436d4c188ceaeff4f8e1335f2cc9b1bd385c3c14da805e5ed
Instruction Fuzzy Hash: 8CB11470E052099FDB44CFA6C981AAEFBB2FF89310F24C42AD419AB314D7349946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 019D10C8, Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

vgT#, xrefs: 019D1237

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: vgT#
API String ID: 0-1580733659
Opcode ID: c175abd4944eedc31afd67d123f4e431a624d0424b20dc791d8b0a1ef86d943b
Instruction ID: 020be4a0206e1addb043263439eee65bd6b87bbe9d0dc0dcc15269489a5d4989
Opcode Fuzzy Hash: c175abd4944eedc31afd67d123f4e431a624d0424b20dc791d8b0a1ef86d943b
Instruction Fuzzy Hash: 8D91E174E052098FDB08CFA9D985AAEFBB2FF88300F14942AD519BB364D7349945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 019D5A50, Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

4Ucm, xrefs: 019D5AD6

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: 4Ucm
API String ID: 0-1235843376
Opcode ID: 0213c68da523502731fe1328732166297bff6cd44329dbd065e5094f65e40a44
Instruction ID: bdedcfa72e732d9cb5073430e7ca3b871c4d7b5d5131d28b7cd89537921be63b
Opcode Fuzzy Hash: 0213c68da523502731fe1328732166297bff6cd44329dbd065e5094f65e40a44
Instruction Fuzzy Hash: A621B971E056198BEB58CF6BDC4069EFBF7BFC8200F04C5BAC508AA228DB345A458F51

Uniqueness

Uniqueness Score: -1.00%

Function 019D30B1, Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1059a8e813bb3945a13156fab3499550bc365a6aaf4039bcc5f912e3726558b0
Instruction ID: e6e009d6eb23b1ce6639440eaecbfe2ab92f90d92287e1b492bbb7d5c4de1da5
Opcode Fuzzy Hash: 1059a8e813bb3945a13156fab3499550bc365a6aaf4039bcc5f912e3726558b0
Instruction Fuzzy Hash: A4F1A1B0D0530ADFCB04CFA5C5828AEFBB2FF99311B24C569D51AAB214D7349A42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 019D31A8, Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d4db6b95e6b6831e580658673fe5f56537c02e0c3d17512b9150818dd7f7f5
Instruction ID: 0446994ca7acce7c09c03b94cb16843126747dc8544441dbd5ee968a4e8c32f5
Opcode Fuzzy Hash: d3d4db6b95e6b6831e580658673fe5f56537c02e0c3d17512b9150818dd7f7f5
Instruction Fuzzy Hash: 0AD15EB1E0520ADFCB04CF95C5818AEFBB2FF89301B14D559D62AAB214D734EA42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05900980, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c32a1bfe239e65356b7f804bfe7f29d40f613fbe273cff29c340a08a1f7226
Instruction ID: 38c8ed7c5c8c3a13fcc9dd8603a0d8c800613e82d3799b925a31b5fda3444ed0
Opcode Fuzzy Hash: 74c32a1bfe239e65356b7f804bfe7f29d40f613fbe273cff29c340a08a1f7226
Instruction Fuzzy Hash: 54B14474E042598FCB04CFA9C549AAEFBF2BF88314F64D86AC415AB354DB349941CB64

Uniqueness

Uniqueness Score: -1.00%

Function 05900970, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e3456530b749d048b5110f32f532a2f93e43792d5cab95325a4c96191ba5e1d
Instruction ID: c1ec11c4c5cb5fe99127fbf818018873b25d1881af247d5913e92e7863d237a7
Opcode Fuzzy Hash: 9e3456530b749d048b5110f32f532a2f93e43792d5cab95325a4c96191ba5e1d
Instruction Fuzzy Hash: CBA15574E052598FCF04CFA9C549A9EFBF2BF89304F24D86AC405AB354DB349A42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0590602D, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97016a7c5d4a875303e8b0faddd0e5f6cdb15bee3ce13e8b73eb949a1997335
Instruction ID: 3d99c70fb24275c05b76c4ccd4af6b7cc98ed610eb4203ea1fea5509987577d3
Opcode Fuzzy Hash: e97016a7c5d4a875303e8b0faddd0e5f6cdb15bee3ce13e8b73eb949a1997335
Instruction Fuzzy Hash: 39714774E19219DFCF44CFA5D5846AEFBB2FB89350F20A829E00AF7295D734A951CB04

Uniqueness

Uniqueness Score: -1.00%

Function 019D1D60, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8c2454afa59ed593c9fdf3e9ca4f22db2ad8ece2d0a46c01dd5d0574e17d1e
Instruction ID: c3b0cbbec9ba1d8fad50ca02e19ce29f018f7ab50bc0f19172a12913cec6a0eb
Opcode Fuzzy Hash: aa8c2454afa59ed593c9fdf3e9ca4f22db2ad8ece2d0a46c01dd5d0574e17d1e
Instruction Fuzzy Hash: 0B61F3B5E0520ADFCB04CF99D5809AEFBB2FB88350F14C569D919BB214D3309942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 019D1880, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c8a398b0eec380332d3bb5dabcfb9b73256cc6a86ec91b4723debf6b82ea02
Instruction ID: 77ddc46757148ddc6f1ecff5a5df0caf0626e99a3214b18900da7d4c16760f4e
Opcode Fuzzy Hash: 05c8a398b0eec380332d3bb5dabcfb9b73256cc6a86ec91b4723debf6b82ea02
Instruction Fuzzy Hash: 6C5117B5E0520ACFCB08CFAAD5415AEFBF2EF89200F24D46AC519B7254D7348A428F95

Uniqueness

Uniqueness Score: -1.00%

Function 019D1870, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8730df11de55cd304fc4c47ffc16a5c085a2719471947d57562d59100d7b32
Instruction ID: 9171d779e706c53fe0496425ea684421e59c378f5e0a0407206416ef84b70b38
Opcode Fuzzy Hash: ae8730df11de55cd304fc4c47ffc16a5c085a2719471947d57562d59100d7b32
Instruction Fuzzy Hash: F65119B1E0520ADFCB08CFAAD5515AEFBF2EF89300F24D46AD419A7254D7348A42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 019D1D51, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c2b714137e2dd3214d6623bab2349e253d9aa8257ced97c632184d2f06d05a
Instruction ID: f3aba05374d5844974f6ef073a36325ff74ec2dc22771ed6af7e862c36779748
Opcode Fuzzy Hash: f7c2b714137e2dd3214d6623bab2349e253d9aa8257ced97c632184d2f06d05a
Instruction Fuzzy Hash: B6610575E0520ADFDB44CF99D4809AEFBB2FF88310F14C56AD919AB254D7309A42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05903FD0, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b9dc96d40e46c9102105dd06f409eb0debc9c4998d0edbbc4ee7bb866ee1c5
Instruction ID: fd8c020718121a3374c428748d628ac84900392ff867837254d292f1230c8854
Opcode Fuzzy Hash: 27b9dc96d40e46c9102105dd06f409eb0debc9c4998d0edbbc4ee7bb866ee1c5
Instruction Fuzzy Hash: 64413771E1562A8BDB24CF65CC44BDDBBB6FF88300F1096AAE109A7250EB705AC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05903FC0, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f68ef31723e1adc606f9ac18c490ff2dc467277f061433f6ee278672645ebaf
Instruction ID: 7894456de2ee92be9b3e3c71616cc6f9c97671967e7346da60514ec85dd334c6
Opcode Fuzzy Hash: 3f68ef31723e1adc606f9ac18c490ff2dc467277f061433f6ee278672645ebaf
Instruction Fuzzy Hash: 14411875E1161A8FDB68CF65CD85BD9BBB2FF88300F1082AAD509A7650EB705AC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 019D22A8, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e89414c0e02b32cb6f581ff1bafd2b45a598175fd33e8b4b2b78745271ac468
Instruction ID: 5a768f28ffdd7361a4d9378c1645c97af559505ed2a77eb340e16f42ba01b182
Opcode Fuzzy Hash: 0e89414c0e02b32cb6f581ff1bafd2b45a598175fd33e8b4b2b78745271ac468
Instruction Fuzzy Hash: 6E31F471E016188BDB18CFAAD84478EFBB2AFC8311F14C16AD509AA258DB341A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 019D229A, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb6dc083c43980031de2ef6a6f3e832cf0a423599e7865cb4d7e2f28a44ca44
Instruction ID: 56ce96914a1d4fd6c015d5a33f83e3abbecb7bc0417e92925ded1ff0ee7cd15c
Opcode Fuzzy Hash: bfb6dc083c43980031de2ef6a6f3e832cf0a423599e7865cb4d7e2f28a44ca44
Instruction Fuzzy Hash: 3F21B670E016588BDB59CFAAD8447DEBBF2AFC9310F14C16AD408AB258DB74094ACF51

Uniqueness

Uniqueness Score: -1.00%

Function 05981C30, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 05981C90
GetCurrentThread.KERNEL32 ref: 05981CCD
GetCurrentProcess.KERNEL32 ref: 05981D0A
GetCurrentThreadId.KERNEL32 ref: 05981D63

Memory Dump Source

Source File: 00000000.00000002.325784358.0000000005980000.00000040.00000001.sdmp, Offset: 05980000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 57614a2cbc28888f6dc222c69f9322547fae1e767ac860712084cf2bd49670ff
Instruction ID: 80da189cba960af25b2b469282083ac2e7b4d2daa350f0541e629d27b99695dd
Opcode Fuzzy Hash: 57614a2cbc28888f6dc222c69f9322547fae1e767ac860712084cf2bd49670ff
Instruction Fuzzy Hash: 4E5130B4D007498FDB24CFA9C549BEEBBF5BB48314F208459E409AB790CB746985CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0590560C, Relevance: 1.6, APIs: 1, Instructions: 150processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0590576B

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fd20c1e79382cd82371ad4a3f8a7d8f6f9f610e392bd21d75cfce9b07ac001fd
Instruction ID: 82bff597816f7af5657b2586d7ce651a9eefdce6c338d4b9a1875764b20a2b3a
Opcode Fuzzy Hash: fd20c1e79382cd82371ad4a3f8a7d8f6f9f610e392bd21d75cfce9b07ac001fd
Instruction Fuzzy Hash: 34512471901328DFDB20CF95C880BDDBBB6BF49314F15849AE908A7250DB319A88CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05986238, Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 059863AA

Memory Dump Source

Source File: 00000000.00000002.325784358.0000000005980000.00000040.00000001.sdmp, Offset: 05980000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7515d82533b1fb10e1ea7e80d75effbd17dc06f66d9752c1ff81e6eb04a71a5a
Instruction ID: 16a7a29d699427038662feb9191e831daaa28ede1a5d7f36d5894d506e37d1d3
Opcode Fuzzy Hash: 7515d82533b1fb10e1ea7e80d75effbd17dc06f66d9752c1ff81e6eb04a71a5a
Instruction Fuzzy Hash: A651F2B2C00249AFDF11CF99C984ADDBFB6FF48310F15816AE818AB220D7759995CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05905618, Relevance: 1.6, APIs: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0590576B

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2d93b586d0caacc5e9dcd55c6cf851c2002905644ab4be5ba87f6e1e24e63c71
Instruction ID: a91c4e6706b1f84e1c90345000281da1f6837478947f335bf8a07cdf3a9f33cc
Opcode Fuzzy Hash: 2d93b586d0caacc5e9dcd55c6cf851c2002905644ab4be5ba87f6e1e24e63c71
Instruction Fuzzy Hash: 39511571D01318DFDB20CF95C880BDDBBB5BF49304F1584AAE908A7250DB759A88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05986298, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 059863AA

Memory Dump Source

Source File: 00000000.00000002.325784358.0000000005980000.00000040.00000001.sdmp, Offset: 05980000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f8d4630ad1199e88154d51dbc1f088fe3d773f875322f906bbfed1c96a473387
Instruction ID: 529a947f21c3390d747e2fca664ea212bc5f6a762e7df422ca55b16b0919f811
Opcode Fuzzy Hash: f8d4630ad1199e88154d51dbc1f088fe3d773f875322f906bbfed1c96a473387
Instruction Fuzzy Hash: 7941CEB1D003089FDF14CF99C984ADEBBB5FF88310F24812AE819AB210D7759885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05984054, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05988911

Memory Dump Source

Source File: 00000000.00000002.325784358.0000000005980000.00000040.00000001.sdmp, Offset: 05980000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c293c857993108ddd6d6f17d4dc5a3a9c34d5c21ab6b0cc5ca45f5a935d86151
Instruction ID: 728cc2daa391b1a9ad08bb70909dfb65e470fba8f2a51ac69c38e8e0fc2641e8
Opcode Fuzzy Hash: c293c857993108ddd6d6f17d4dc5a3a9c34d5c21ab6b0cc5ca45f5a935d86151
Instruction Fuzzy Hash: EE413AB4A00305CFCB14DF99C488AAABBF6FF88314F14C859E519AB351D775A841CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 019DA214, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 019DB829

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5dfe7cfeb0573b9175f89af737f5a76b1ddefe64d6ba36f2e20230b68b789295
Instruction ID: 5804d356c31a34fc226ff90a13d11cd21f9b160cf8ade3f9c33b91eab2df0ed9
Opcode Fuzzy Hash: 5dfe7cfeb0573b9175f89af737f5a76b1ddefe64d6ba36f2e20230b68b789295
Instruction Fuzzy Hash: 85411F71C0465CCFDB24CFA9C885B9EBBF5BF89304F118029D509AB250DBB16945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05905BB8, Relevance: 1.6, APIs: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05905C4D

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 428e43de86b1d3f7c22646da68412f7fd5b9de8ea386301082351233a29d2106
Instruction ID: c01c24c2000e2bdf9c61e23392a508ee80893a00aec519272407fca08d47d062
Opcode Fuzzy Hash: 428e43de86b1d3f7c22646da68412f7fd5b9de8ea386301082351233a29d2106
Instruction Fuzzy Hash: AD2114B59012599FCB10CFA9D885BDEBBF4FF48320F04842AE919A7740D774AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05905BC0, Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05905C4D

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 85dd95f675724f6d2ee55d990a12dbdd98ce3baa8e362d2b20932af617dbeaa1
Instruction ID: 2970a5571828b395f44f2c8bd958b853d6e02cb339294811a24b8fa8ed330a17
Opcode Fuzzy Hash: 85dd95f675724f6d2ee55d990a12dbdd98ce3baa8e362d2b20932af617dbeaa1
Instruction Fuzzy Hash: 2521E4B19013599FCB10CF9AD885BDEBBF4FB48320F14842AE919A7740D774AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05982260, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 059822E7

Memory Dump Source

Source File: 00000000.00000002.325784358.0000000005980000.00000040.00000001.sdmp, Offset: 05980000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cb749ea9f2791d7c84294eda954d957999227a28c6f524a14c3e70ee436dc3cf
Instruction ID: b778d70a5f7b4cbb826a62609e12ccb69d79d6aee7eb927b0d29e79edb42930a
Opcode Fuzzy Hash: cb749ea9f2791d7c84294eda954d957999227a28c6f524a14c3e70ee436dc3cf
Instruction Fuzzy Hash: 0621E2B5D002489FDB10CFAAD884AEEBBF8FB48320F14801AE914A7310D374A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05905A40, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05905AC7

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c31c6fa0d8d10500d0fd041b7facded12f2c902d3ed7ed6cff0e0abaccf0ce57
Instruction ID: e541082c73cbd1e33e1d594eef1e2c34f05455474bbb51f59d2d8f8304f1399a
Opcode Fuzzy Hash: c31c6fa0d8d10500d0fd041b7facded12f2c902d3ed7ed6cff0e0abaccf0ce57
Instruction Fuzzy Hash: 2321E2B6900259DFCB10CF9AD985BDEFBF4BB48320F14842AE918A7640D378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05905980, Relevance: 1.6, APIs: 1, Instructions: 60threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 059059FF

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 601d5153296727a55b96f8732e81a64fb4304efdb46f686adbe65d8e5ac981b8
Instruction ID: 6a7e73b4e2cc0516cda62d15e486ef6aa37d0c76d990c4836e1defa54c41d4ac
Opcode Fuzzy Hash: 601d5153296727a55b96f8732e81a64fb4304efdb46f686adbe65d8e5ac981b8
Instruction Fuzzy Hash: 872136B2D002598FDB10CF9AC9857EEFBF4BB48324F55812AD818B3640D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05905A48, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05905AC7

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2d0fcebcd3ef323b806df613680db01a49fa4bebe08f801646b99d87090d072a
Instruction ID: 7f1cf43e7c950e8a683650f738c1bfeb1605a4ea109b8857974e582242744020
Opcode Fuzzy Hash: 2d0fcebcd3ef323b806df613680db01a49fa4bebe08f801646b99d87090d072a
Instruction Fuzzy Hash: 6621E2B59003599FCB10CF9AD884BDEFBF4FB48320F10842AE918A7650D774A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05905988, Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 059059FF

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5fcced7d2e96e9ea69072c2940298f95c3e3cf05d4f97ec74f85ed51a78ff863
Instruction ID: 8701021aeca6c4632c15e4af8b195890afdce09edc388267423c9bd3d607586b
Opcode Fuzzy Hash: 5fcced7d2e96e9ea69072c2940298f95c3e3cf05d4f97ec74f85ed51a78ff863
Instruction Fuzzy Hash: 4B2106B1D106599FCB10CF9AC8857DEFBF8BB48324F55812AD418B3640D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 019DEC28, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,019DFB69,00000800,00000000,00000000), ref: 019DFD7A

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 10212bf07834f39f8f5caeed8d192ed6bcc1022f8b337cc3e370aee1d8e06b1a
Instruction ID: ef574300c7d72fd9ea9eb1eb5cb5b4a4f684566782f3bebe09c46bfb8f3a030b
Opcode Fuzzy Hash: 10212bf07834f39f8f5caeed8d192ed6bcc1022f8b337cc3e370aee1d8e06b1a
Instruction Fuzzy Hash: C31103B6D003499FDB10CF9AD448ADEFBF4EB48324F14842AE52AA7600C3B5A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05905B11, Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05905B83

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 460bd6d7f09082736c30962c00ca4a4408535e25337eb5a73eb7acd67c75a7f2
Instruction ID: aa3245e2211db15ddc44de6bdb050ccde9147b33c8d4b0a777443df93e5e3a38
Opcode Fuzzy Hash: 460bd6d7f09082736c30962c00ca4a4408535e25337eb5a73eb7acd67c75a7f2
Instruction Fuzzy Hash: 221113B6D002489FCB10CF99C985BEEBBF8FB49320F14841AE528A7650C775A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05905B18, Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05905B83

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 343b4b4a69d7816871722507168f93a049a6fe4c75866bbc8d07e61db806807c
Instruction ID: 5ee6ffb3677ca02e9be6a4553e89b42a5146b46e97e80e49a221b71a258c9b00
Opcode Fuzzy Hash: 343b4b4a69d7816871722507168f93a049a6fe4c75866bbc8d07e61db806807c
Instruction Fuzzy Hash: 2711F2B69003499FCB20DF9AC884BDEBBF8FB49324F108419E529A7650D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 019DFA88, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 019DFAEE

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d812db70f827b4ecab4a786b121540dc189d53d4089f64ab30a7d1242a631781
Instruction ID: cc63ba200da54b5e521ca5d6663fde231e8ab7d7f2a0e612c9fe0603da510c0c
Opcode Fuzzy Hash: d812db70f827b4ecab4a786b121540dc189d53d4089f64ab30a7d1242a631781
Instruction Fuzzy Hash: 9D11D2B6C006498FDB10CF9AC445ADEFBF4AB88324F14C41AD919A7600D3B4A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 059065C0, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 05906625

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3626f7e5b2e743f71828cd110501b7c4a398dad1842d7216ccb8606b343a4519
Instruction ID: 200288826c61a1d0c85b613515cb1c54e874d47a2271732cb47ea8fbf0bb3751
Opcode Fuzzy Hash: 3626f7e5b2e743f71828cd110501b7c4a398dad1842d7216ccb8606b343a4519
Instruction Fuzzy Hash: 601103B68003498FDB10CF99D989BDEBBF8FB48324F10881AD554A7640C374A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05905D70, Relevance: 1.5, APIs: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05905DD7

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0ea57e767eefeef9df6e52b936edf80d05bf1a83d806798af658d06b91a86a0d
Instruction ID: bc034aa0b402bd9ca3573debf94ab6065afdeef10001f325f6a07636afe1e099
Opcode Fuzzy Hash: 0ea57e767eefeef9df6e52b936edf80d05bf1a83d806798af658d06b91a86a0d
Instruction Fuzzy Hash: 841130B5D00248CFCB20CF99D989BEEBBF4FB48324F21881AD519A7640D774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 059864E0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0598653D

Memory Dump Source

Source File: 00000000.00000002.325784358.0000000005980000.00000040.00000001.sdmp, Offset: 05980000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: d4e384af33a50081563a6bd0e5893234c41dc0e2d03c6e6bd7547f8487eb13be
Instruction ID: 42895311d1c6b5ba0b35785999b81c348f32c9d9022c15e5af62113094cc0f07
Opcode Fuzzy Hash: d4e384af33a50081563a6bd0e5893234c41dc0e2d03c6e6bd7547f8487eb13be
Instruction Fuzzy Hash: 7D11D0B58002499FDB10DF99D589BDEBBF8EB48324F10841AE959A7700D3B4AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 059065C8, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 05906625

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e88fb1348233e26b684e79551c76efbea27f69ced287aad5ae06a97a4a59ad08
Instruction ID: 27419b83dd60f135a707d8a3314f8a3280482b1a6b1338a13158f326f5d7cda7
Opcode Fuzzy Hash: e88fb1348233e26b684e79551c76efbea27f69ced287aad5ae06a97a4a59ad08
Instruction Fuzzy Hash: C91103B58003499FDB10CF99C885BDEBBF8FB48324F108419E514A7600C3B4A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05905D78, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 05905DD7

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 70d0b3f167fac73c15c19d7da035226692323590bea01ca2052cff16aba65c50
Instruction ID: 82791a5b2476c84435c4409b831da430499d5395337b26fea8fea2132e24c365
Opcode Fuzzy Hash: 70d0b3f167fac73c15c19d7da035226692323590bea01ca2052cff16aba65c50
Instruction Fuzzy Hash: 1411E2B58002498FCB20DF9AD489BDEFBF8EB48324F21841AD519A7640D7B5A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 019D41B8, Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

{YOC, xrefs: 019D4314
{YOC, xrefs: 019D4322

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: {YOC${YOC
API String ID: 0-2520720543
Opcode ID: 0fd976c983baa5ec40b161d51ada01e86da589c9de2d68793555b0128973c9db
Instruction ID: 051e8cf2e7075565a55663ef428f9c5bc59ad9c445e9e7e84f5ac2c76666d707
Opcode Fuzzy Hash: 0fd976c983baa5ec40b161d51ada01e86da589c9de2d68793555b0128973c9db
Instruction Fuzzy Hash: B881F074E11219CFCB44CFA9D68489EFBF1FF88250F24856AE419AB724D730AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 019D5628, Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

%-4, xrefs: 019D5774
%-4, xrefs: 019D576D

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: %-4$%-4
API String ID: 0-824457046
Opcode ID: c7cb1fbc6031ebb2f0f2aa72ca33751981500b4665835a8c3ed85b75dd047549
Instruction ID: 277ca63bff92125fe0504289938ddb12559dfdde4fefb5b8ded8cfb361ce311d
Opcode Fuzzy Hash: c7cb1fbc6031ebb2f0f2aa72ca33751981500b4665835a8c3ed85b75dd047549
Instruction Fuzzy Hash: 1D61E074E0520ACFDB04CFA9D5819DEFBF2FB88214F65952AD409BB254D730AA41CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05900E50, Relevance: 1.6, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

|Ge, xrefs: 059010F4

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID: |Ge
API String ID: 0-4099202135
Opcode ID: 28ebe884a0d195b0ff34b34ce7f5c58a3d1d09302d7669dfa62f70b8c6e529a8
Instruction ID: 907a33c554b068b6f577ac7380aafdc27f52fc50ad24b9d7a082c796c5c3f68e
Opcode Fuzzy Hash: 28ebe884a0d195b0ff34b34ce7f5c58a3d1d09302d7669dfa62f70b8c6e529a8
Instruction Fuzzy Hash: 74D1A071E0820A8FCB04CFA9C9456AEBBF2AF89304F209869D515F7395DB349A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 019D41A8, Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

{YOC, xrefs: 019D4322

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: {YOC
API String ID: 0-1713614430
Opcode ID: c4b287c532e9be144fe3da70c914ed6211dfd7968b1a8ceb64db9e6f8a3aa42a
Instruction ID: c986f8fe0f910ebfe8e2657ea54b366db4901a6555d7cb5acacd0ba5d6a86ee3
Opcode Fuzzy Hash: c4b287c532e9be144fe3da70c914ed6211dfd7968b1a8ceb64db9e6f8a3aa42a
Instruction Fuzzy Hash: DF81E274E1121ACFCB44CFA9C68499EFBF1FF89254F14856AD419AB724D334AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 019D5048, Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

0o#, xrefs: 019D50D3

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: 0o#
API String ID: 0-3618227093
Opcode ID: 8bf32998e40af61f2cd42c7cb4dce41133343a81dce6e0997f0adc78c9266d5e
Instruction ID: e399df8113b0eaa3f76a350b5971ce34589019425a1e643fcecc7443e98ba1d2
Opcode Fuzzy Hash: 8bf32998e40af61f2cd42c7cb4dce41133343a81dce6e0997f0adc78c9266d5e
Instruction Fuzzy Hash: 856129B0D0420ADBDB04CFAAC5819AEFBF1BF89340F15C819D529A7248D7749A41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 019D5038, Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

0o#, xrefs: 019D50D3

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: 0o#
API String ID: 0-3618227093
Opcode ID: ac4d342d7f21b5e6f7c0efe83619775994c23a1112261857f10dfc1f588ef160
Instruction ID: 0cc1a3ed08a5fda4f427041263fdb6bdb4820f0f44934de8be29c169b0b52b90
Opcode Fuzzy Hash: ac4d342d7f21b5e6f7c0efe83619775994c23a1112261857f10dfc1f588ef160
Instruction Fuzzy Hash: 1C6149B1E0420ADFDB04CFA9C5819AEFBF1BF85340F19C86AD529A7258D3349A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 019D5878, Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

ih$, xrefs: 019D59C6

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: ih$
API String ID: 0-437067738
Opcode ID: 126cd38288e0816d2006b1fe9e90384851c013ccd7640ff6d18b43b846d47c11
Instruction ID: 957f2064570190b3cfc4aa31fb96ce520b239540c1293eb410ffd66e8037cfa9
Opcode Fuzzy Hash: 126cd38288e0816d2006b1fe9e90384851c013ccd7640ff6d18b43b846d47c11
Instruction Fuzzy Hash: D241D4B0E0520ADFDB44CFA9C5815AEFBF2BF89310F25C56AC519A7214D7309A428B91

Uniqueness

Uniqueness Score: -1.00%

Function 019D5888, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

ih$, xrefs: 019D59C6

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: ih$
API String ID: 0-437067738
Opcode ID: ab823a6b902ccb9b480960ec4b777ccd08cb7fb5b3bb7a7429078a7c8688495e
Instruction ID: 29e5bcebeeeb181ae9889cd863e821c25ab41c703363e4f74eef89d93590789d
Opcode Fuzzy Hash: ab823a6b902ccb9b480960ec4b777ccd08cb7fb5b3bb7a7429078a7c8688495e
Instruction Fuzzy Hash: D041C5B0E0520ADFDB04CFAAC5815AEFBF2BF89310F65C56AC519B7204D7309A418F95

Uniqueness

Uniqueness Score: -1.00%

Function 05901980, Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

e~@G, xrefs: 05901CE9

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID: e~@G
API String ID: 0-1796343361
Opcode ID: 49b1c4b3f4dd5f8c5d637eb085a118cb41323403f3204b64ca97c032c78c12e0
Instruction ID: c1270010e0703c0cb4fb09ef255f163d6fbb527b3b5450029af4ef36805c56b2
Opcode Fuzzy Hash: 49b1c4b3f4dd5f8c5d637eb085a118cb41323403f3204b64ca97c032c78c12e0
Instruction Fuzzy Hash: 2531B0B5E162199FDB08CF6ACD81AAEBBF7AF89300F14D87AD404E7291D7304A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 059019B0, Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

e~@G, xrefs: 05901CE9

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID: e~@G
API String ID: 0-1796343361
Opcode ID: 44b17173d9f03b054b0f774bedd287ad9148fbba488e26a862514e74e6a080ea
Instruction ID: ac95d68ebba3a654ee0dde80ab2f5c95e083a93c9ef4ce2ad6de717f7b90511f
Opcode Fuzzy Hash: 44b17173d9f03b054b0f774bedd287ad9148fbba488e26a862514e74e6a080ea
Instruction Fuzzy Hash: 98316D70E152198FDB18CFAAD9406AEFBF7FF88310F10D46AE409A7244DB304A41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 019D5A40, Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

4Ucm, xrefs: 019D5AD6

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID: 4Ucm
API String ID: 0-1235843376
Opcode ID: 805942b69402b88e0a2eda388f299c6bad593ec7645b81fc66b80e8965c8a431
Instruction ID: 0d5429c7ef0e52553f8c91164858627e945c1edfa483608a58dc5002a4824abc
Opcode Fuzzy Hash: 805942b69402b88e0a2eda388f299c6bad593ec7645b81fc66b80e8965c8a431
Instruction Fuzzy Hash: 65110D71E056189BEB18CF6BD84469EFBF3AFC8200F08C17AC818A6218DB3045558F51

Uniqueness

Uniqueness Score: -1.00%

Function 05901390, Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e12ea3f627a53250a8d194c33a0bf4c449e8ad2393955db38d411d0e1711f7
Instruction ID: 0f7747a596764f91bc4eb3f07c24fc000bc4d2ed928233d33199285acb77b798
Opcode Fuzzy Hash: e3e12ea3f627a53250a8d194c33a0bf4c449e8ad2393955db38d411d0e1711f7
Instruction Fuzzy Hash: 68B13974E042199FCB14CFAAC9809ADFBB3FB89305F2499A9D408AB355D734AD41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05901446, Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d9f47931f49f4952b1ccd5275c032048ff40cd9a676917a2dd0b1453cf8ebc
Instruction ID: c6637ae3f4b01ce7ce2d4d4fe8b1e5bdf4d3d9891e05bf2677e4dd2045ab1a5e
Opcode Fuzzy Hash: 46d9f47931f49f4952b1ccd5275c032048ff40cd9a676917a2dd0b1453cf8ebc
Instruction Fuzzy Hash: B3B14874E042199FCB14CFA9C980AADFBB2FF49305F249999D409AB365D734AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0590138A, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622b43a218f2535e4af337d7414b121156a6ad4afe7ed0103e42c8e6546334da
Instruction ID: c4703d5a215c556e04ab3e48511c92904a56ad64492f797a123ccdaed3eb5a22
Opcode Fuzzy Hash: 622b43a218f2535e4af337d7414b121156a6ad4afe7ed0103e42c8e6546334da
Instruction Fuzzy Hash: 64A12874E052199FCB04CFA9C9809AEFBF3FB89305F2499AAD408A7355D734A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 05901629, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cbf457cc54071f82cb559b2a675a647142a8208712c8a0b95893ad6e43f01ec
Instruction ID: 20404869899807e0b3c9c16a85fe282a91c35518653a45246a8f3584b99e51e7
Opcode Fuzzy Hash: 4cbf457cc54071f82cb559b2a675a647142a8208712c8a0b95893ad6e43f01ec
Instruction Fuzzy Hash: 65914874E041199FCB04CFA9CA809ADFBB3FB89305F249AA9D408A7355D734AD41DF60

Uniqueness

Uniqueness Score: -1.00%

Function 019D4D30, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46335b60c1cde474ee57bed1514aad3a178503bcd96912e3558c251123a5b06f
Instruction ID: c2e73c7dea3e1dafcfc31c937821e70a5c71d4f8a80baefe99bd31d91e7f7055
Opcode Fuzzy Hash: 46335b60c1cde474ee57bed1514aad3a178503bcd96912e3558c251123a5b06f
Instruction Fuzzy Hash: EE71D2B4E0420ADFCB04CF99D5809AEFBB2FF58250F14C959D519AB624D334A982CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 019D4D20, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ec4a8480e07dac285659a1248d11488f7bf239c949243d9e65791047655e176
Instruction ID: 35d01c0f9d1c5a23100df5963654135b61a82898608b12262c73897f04a08ded
Opcode Fuzzy Hash: 4ec4a8480e07dac285659a1248d11488f7bf239c949243d9e65791047655e176
Instruction Fuzzy Hash: 3161E374E0420ADFCB04CF99D4809AEFBB2FF59350F14C95AD419A7615D334A982CF95

Uniqueness

Uniqueness Score: -1.00%

Function 019D5619, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e335c75472658b2c7661bd52900d909cb20b1bed2b45261f67b150a2a169992
Instruction ID: 5db9f5cacdf9fb5a49eeac3919e038562afc147bdedbb9b91f53563dea1b1f24
Opcode Fuzzy Hash: 2e335c75472658b2c7661bd52900d909cb20b1bed2b45261f67b150a2a169992
Instruction Fuzzy Hash: EE61F074E05209CFDB04CFA9D5819EEFBF2BF88214F29942AD409BB264D7349A418F64

Uniqueness

Uniqueness Score: -1.00%

Function 05900007, Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfd80d5d1e8dc638aaafccdca94d6c2ae2d3d2c8f4d0ce0a7f2aa25f234cde6
Instruction ID: f1e68440f0cec56c82dc3a4ba09279f541a8577656670b2b7061a020b99c8c3c
Opcode Fuzzy Hash: dcfd80d5d1e8dc638aaafccdca94d6c2ae2d3d2c8f4d0ce0a7f2aa25f234cde6
Instruction Fuzzy Hash: B961AF70E15219CFDB58CFA9D985B9EBBF3BF89200F54D8AAD408EB295E7304941CB10

Uniqueness

Uniqueness Score: -1.00%

Function 05900040, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d432d3c3ee979895bb2050bd9072e688531e801adaab22a261d2b0bba64c0ed
Instruction ID: 7e293bf793843afe89c7b42d8e7fa07ebda6cb7dafdfc0fa84f0ea4505cf7788
Opcode Fuzzy Hash: 9d432d3c3ee979895bb2050bd9072e688531e801adaab22a261d2b0bba64c0ed
Instruction Fuzzy Hash: 89514B70E15219CFDB58CFAAD984B9EFBB7BB88200F54986AD508A7254EB305A41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 059000FF, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325717551.0000000005900000.00000040.00000001.sdmp, Offset: 05900000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b83216180d253b6add352ca37fbfc71dcba53be08e1e56787f414f71efa256
Instruction ID: 0e333fccc279cb7d9d320c3d5e4b12e6158359f7af039aabe5764a111d806d62
Opcode Fuzzy Hash: 71b83216180d253b6add352ca37fbfc71dcba53be08e1e56787f414f71efa256
Instruction Fuzzy Hash: 08512D74E05219DFCB54CFA4D984B9EB7B2FF49304F54A8A9E509A7394DB309980CF10

Uniqueness

Uniqueness Score: -1.00%

Function 019D3691, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4970d94db57f604610ec1e495cb50c32b961fda91797712a4ea6b9c7d8cee416
Instruction ID: a3cbf52acafd4849b421bddb8bfb2aabbbf6642bad8a612592df5de852680d74
Opcode Fuzzy Hash: 4970d94db57f604610ec1e495cb50c32b961fda91797712a4ea6b9c7d8cee416
Instruction Fuzzy Hash: 914136B0E1520A9FCB44CFA9C9408EEFBF1FF89211B15D52AD019BB364D7349A41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 019D36A0, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c6896d19f96f5301aad68ffa0b4e488cca79b38037dcef3eaa01496621c9c4
Instruction ID: 161048ff354ede3c38e2975b0fa6732739230afa4852223eddb1cb93785e051d
Opcode Fuzzy Hash: b1c6896d19f96f5301aad68ffa0b4e488cca79b38037dcef3eaa01496621c9c4
Instruction Fuzzy Hash: F34126B0E1520A9FCB44CFAAC5408AEFBF1FF89211B14D92AD419BB364D7349A458B61

Uniqueness

Uniqueness Score: -1.00%

Function 019D53F8, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a349d0756cf164cd84c1f58705fc726da564dbc75b421f2a9430129842874c7
Instruction ID: 2549db44eeec1100ca4b02423762962ff3362257d97460b36a1a397ea9219241
Opcode Fuzzy Hash: 6a349d0756cf164cd84c1f58705fc726da564dbc75b421f2a9430129842874c7
Instruction Fuzzy Hash: 4741F7B0E0460ADFDB44CFAAC4815AEBBF2FF98310F25D46AC419A7254D7349A42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 019D5408, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60cac86928065914cb6b27a8b6b1d5bdbabf8c35d94981299c3ef11f980ef2e4
Instruction ID: 57d1520860bac1b14e40b0cac59204310eb7dd22c6238cad7292da1e635d2360
Opcode Fuzzy Hash: 60cac86928065914cb6b27a8b6b1d5bdbabf8c35d94981299c3ef11f980ef2e4
Instruction Fuzzy Hash: 0B41F6B0E0420A9BDB44CFAAC4815AEFBF2FF98300F25D46AC519A7654D7349A41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 019D0480, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a0c8b1cc7cae5360233ffe53797726e774b8a3dd7577c41be99ef5bc050473
Instruction ID: 0a244e654a3c37fc9bcafc138a46db7d22b815c86e62fe229a7f48388683f1cf
Opcode Fuzzy Hash: 87a0c8b1cc7cae5360233ffe53797726e774b8a3dd7577c41be99ef5bc050473
Instruction Fuzzy Hash: 7611B971E046189BEB5CCFABD8406DEFBF7AFC9200F18C17AD918A6268EB3405458F55

Uniqueness

Uniqueness Score: -1.00%

Function 019D0472, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321565692.00000000019D0000.00000040.00000001.sdmp, Offset: 019D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9491fd06d6b717534e00ce93f1161a81023ba839df72ffbe646b137048b2beba
Instruction ID: 00b931f10b4e03443956c7e65eda338e1f0cb0ce21697f97a8929b078b41951b
Opcode Fuzzy Hash: 9491fd06d6b717534e00ce93f1161a81023ba839df72ffbe646b137048b2beba
Instruction Fuzzy Hash: 5821CE71E046589BEB5CCFABD84069EFBF3AFC9300F08C07AD918A6268EB3405458F11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 3328 Parent PID: 5736 RegSvcs.exeCOMMON

Executed Functions

Function 00418280, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418280(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E00418DD0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t4 =  &_a40; // 0x413a21
				_t6 =  &_a32; // 0x413d62
				_t12 =  &_a8; // 0x413d62
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36,  *_t4); // executed
				return _t18;
			}

0x00418283
0x0041828f
0x00418297
0x0041829c
0x004182a2
0x004182bd
0x004182c5
0x004182c9

APIs

NtReadFile.NTDLL(b=A,5E972F59,FFFFFFFF,?,?,?,b=A,?,!:A,FFFFFFFF,5E972F59,00413D62,?,00000000), ref: 004182C5

Strings

!:A, xrefs: 0041829C, 004182A8
b=A, xrefs: 004182BD, 004182C4
b=A, xrefs: 004182A2, 004182B0

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: !:A$b=A$b=A
API String ID: 2738559852-704622139
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 51f5fae1d88b5840d166f8ea9f31b1482cd02544441b85bb92b9de754d914906
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: F0F0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241DA30E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00409B30(void* __eflags, void* _a4, signed char _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_t24 = _a8;
				_v8 =  &_v536;
				_t15 = E0041AB60( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_push(_v8);
					_t17 = E0041AF80(_t24, __eflags);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041B200( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E00419310(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x00409b39
0x00409b4c
0x00409b4f
0x00409b54
0x00409b59
0x00409b62
0x00409b63
0x00409b68
0x00409b6b
0x00409b6d
0x00409b75
0x00409b7a
0x00409b7a
0x00409b81
0x00409b89
0x00409b8c
0x00409b8e
0x00409ba2
0x00000000
0x00409ba4
0x00409baa
0x00409b5e
0x00409b5e
0x00409b5e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409BA2

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction ID: 4e6e3ee69d5942d72351b9e79d7f2bfe549f68bd28f2ef5b77caac8f1f18b979
Opcode Fuzzy Hash: 54eed7fb54c4bb33c5ecf3c62be074d2fec7e96364ab3bba8fcd8ce07f2b6dc1
Instruction Fuzzy Hash: BB0152B5E0010DA7DB10DAA1DC42FDEB378AB54308F0041A5E918A7281F635EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004182FA, Relevance: 1.5, APIs: 1, Instructions: 42
nativeCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E004182FA(void* __eax, void* __eflags, long _a4, void* _a8, intOrPtr _a12) {
				intOrPtr* __esi;
				void* _t18;
				void* _t19;
				intOrPtr* _t20;

				asm("movsb");
				asm("in eax, 0x42");
				if(__eflags != 0) {
					_t12 = _a8;
					_t3 = _t12 + 0x10; // 0x300
					_t4 = _t12 + 0xc4c; // 0x40974f
					_t20 = _t4;
					E00418DD0(_t18, _a8, _t20,  *_t3, 0, 0x2b);
					return  *((intOrPtr*)( *_t20))(_a12, _t19);
				} else {
					__ebp = __esp;
					__eax = _a4;
					_t7 = __eax + 0x10; // 0x300
					_t8 = __eax + 0xc50; // 0x409753
					__esi = _t8;
					E00418DD0(__edi, _a4, __esi,  *_t7, 0, 0x2c) =  *__esi;
					__eax = NtClose(_a8); // executed
					__esi = __esi;
					__ebp = __ebp;
					return __eax;
				}
			}

0x004182fb
0x004182fc
0x004182fe
0x004182d3
0x004182d6
0x004182df
0x004182df
0x004182e7
0x004182f9
0x00418300
0x00418301
0x00418303
0x00418306
0x0041830f
0x0041830f
0x0041831f
0x00418325
0x00418327
0x00418328
0x00418329
0x00418329

APIs

NtClose.NTDLL(00413D40,?,?,00413D40,00408B03,FFFFFFFF), ref: 00418325

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 9233fd014574d1bddf3cf9c9a37e1b473cb7ef0979aaff03fe5ea87f5b586f70
Instruction ID: b562db91769746300adae9c6a0567f4bfd3973544bbc01aa6afe5664de1abf83
Opcode Fuzzy Hash: 9233fd014574d1bddf3cf9c9a37e1b473cb7ef0979aaff03fe5ea87f5b586f70
Instruction Fuzzy Hash: A0F06271200314BBD710EF99DC85ED77B68EF44760F114599FA1C9B282CA30FA0086E4

Uniqueness

Uniqueness Score: -1.00%

Function 004181CD, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004181CD(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_push(0x8b55b39d);
				_t15 = _a4;
				_t3 = _t15 + 0xc40; // 0xc40
				E00418DD0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181d0
0x004181d3
0x004181df
0x004181e7
0x0041821d
0x00418221

APIs

NtCreateFile.NTDLL(00000060,00408B03,?,00413BA7,00408B03,FFFFFFFF,?,?,FFFFFFFF,00408B03,00413BA7,?,00408B03,00000060,00000000,00000000), ref: 0041821D

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9e372318b9c57491b52c630b03e87ab3af8433ecda2d7a2604a3496f43532880
Instruction ID: a9b8fe2b8f447fc1484727031513cc6ace4f924ae8470e167a86acf12633c86a
Opcode Fuzzy Hash: 9e372318b9c57491b52c630b03e87ab3af8433ecda2d7a2604a3496f43532880
Instruction Fuzzy Hash: 72F0B2B2204108AFCB08CF88DC95EEB37A9AF8C754F158248BA0DD7281D630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004181D0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004181D0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E00418DD0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004181df
0x004181e7
0x0041821d
0x00418221

APIs

NtCreateFile.NTDLL(00000060,00408B03,?,00413BA7,00408B03,FFFFFFFF,?,?,FFFFFFFF,00408B03,00413BA7,?,00408B03,00000060,00000000,00000000), ref: 0041821D

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 4ba06d0811943408d915368c3acdb1aee86cb039c5ce671b45e9a6de03e682c0
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: EAF0B2B2200208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004183AA, Relevance: 1.5, APIs: 1, Instructions: 31
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004183AA(intOrPtr _a8, void* _a12, PVOID* _a16, long _a20, long* _a24, long _a28, long _a32) {
				long _t14;
				void* _t22;

				asm("o16 int3");
				asm("fimul dword [esi-0x1374aa37]");
				_t10 = _a8;
				_t3 = _t10 + 0xc60; // 0xca0
				E00418DD0(_t22, _a8, _t3,  *((intOrPtr*)(_a8 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a12, _a16, _a20, _a24, _a28, _a32); // executed
				return _t14;
			}

0x004183aa
0x004183ad
0x004183b3
0x004183bf
0x004183c7
0x004183e9
0x004183ed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418FA4,?,00000000,?,00003000,00000040,00000000,00000000,00408B03), ref: 004183E9

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e6086b8e9d580debff9d580f58451ff91bbceb72b29ef0b1222e984e30a9e9f0
Instruction ID: 5d2c55022ad9ff6ae40776d0f64e3dcf9b779e89a6098d7a5794d9f45783a1df
Opcode Fuzzy Hash: e6086b8e9d580debff9d580f58451ff91bbceb72b29ef0b1222e984e30a9e9f0
Instruction Fuzzy Hash: 87F012B5201108AFDB18DF45DC85EE777ADEF88354F118549FD1997641C630E911CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004183B0, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004183B0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E00418DD0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x004183bf
0x004183c7
0x004183e9
0x004183ed

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00418FA4,?,00000000,?,00003000,00000040,00000000,00000000,00408B03), ref: 004183E9

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 5f1ba135279249ad747bfdca3347611d303f78695a7cb9da664d5d0d2719559c
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 4EF015B2200208ABCB14DF89DC81EEB77ADAF88754F118249BE0897281C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418300, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418300(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409753
				E00418DD0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x00418303
0x00418306
0x0041830f
0x00418317
0x00418325
0x00418329

APIs

NtClose.NTDLL(00413D40,?,?,00413D40,00408B03,FFFFFFFF), ref: 00418325

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e0948211a995ee673693cff6b37ba25287d5fac55aefcf59dfc2265e20a22c74
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: EAD012752003146BD710EF99DC45ED7775CEF44750F154559BA185B282C570F90086E0

Uniqueness

Uniqueness Score: -1.00%

Function 01329910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0132991A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 43a7ef2ce36bc2a15d164013d2216527106613abfed4cf26bc68f4db556f9dc4
Instruction ID: 402676610ac8568d7abcee48d8c72ad35a5a4df04d43e9b32c4c6e5b9fb782b9
Opcode Fuzzy Hash: 43a7ef2ce36bc2a15d164013d2216527106613abfed4cf26bc68f4db556f9dc4
Instruction Fuzzy Hash: ED9002B521100402D540719944047460005A7D0346F91C021A5054555EC6998DE976A9

Uniqueness

Uniqueness Score: -1.00%

Function 01329540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0132954A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5994986cc3f056467d5a0df929565a0dbcff9baf07ddd9630e4731660e25f4c2
Instruction ID: eb8e2da4fa7ecfba83547d7f1d1785d66f51d8ed1e3d5f158f542d7917f81c3c
Opcode Fuzzy Hash: 5994986cc3f056467d5a0df929565a0dbcff9baf07ddd9630e4731660e25f4c2
Instruction Fuzzy Hash: AE900269221000034505A59907045070046A7D5396391C031F1005551CD66188756165

Uniqueness

Uniqueness Score: -1.00%

Function 013299A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013299AA

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ca763453eab14b61a1bd17db91a4c9275ef3502d21ee8e6aa084265d9e4fe80c
Instruction ID: 09bb0bfce5f4f2760e4ea8d6a25462cbf2505c059c3d245e019ea871196c93e2
Opcode Fuzzy Hash: ca763453eab14b61a1bd17db91a4c9275ef3502d21ee8e6aa084265d9e4fe80c
Instruction Fuzzy Hash: 1D9002A535100442D50061994414B060005E7E1346F91C025E1054555DC659CC66716A

Uniqueness

Uniqueness Score: -1.00%

Function 013295D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013295DA

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f1dfc20d2d33cf645172bdb49c0840d27359488e55ad5e222e69e0df0caccfb4
Instruction ID: 965085982d841574162a034dcd188474c68d46588c426f6adf73ec596f0d45c5
Opcode Fuzzy Hash: f1dfc20d2d33cf645172bdb49c0840d27359488e55ad5e222e69e0df0caccfb4
Instruction Fuzzy Hash: DB9002A521200003850571994414616400AA7E0246B91C031E1004591DC56588A57169

Uniqueness

Uniqueness Score: -1.00%

Function 01329860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0132986A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 63cb74d7948319eccbbb31fd44db33eb97cfc1fb8b064ad401928d431c7716b2
Instruction ID: 434c3af4813a356043cbf5f7a0518a9b42749c077c6a748d4f4a2b1c0c1754ad
Opcode Fuzzy Hash: 63cb74d7948319eccbbb31fd44db33eb97cfc1fb8b064ad401928d431c7716b2
Instruction Fuzzy Hash: 8C90027521100413D511619945047070009A7D0286FD1C422A0414559DD6968966B165

Uniqueness

Uniqueness Score: -1.00%

Function 01329840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0132984A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 97bd168ffe0d7985c1aa05dd301cb9b2f33dcd1d1f2b16f0d5d3ab555077d194
Instruction ID: abf6581e24496456358ebf3703333d23f8b44ee451108180e93014b2cc832a11
Opcode Fuzzy Hash: 97bd168ffe0d7985c1aa05dd301cb9b2f33dcd1d1f2b16f0d5d3ab555077d194
Instruction Fuzzy Hash: E8900265252041529945B19944045074006B7E02867D1C022A1404951CC566986AE665

Uniqueness

Uniqueness Score: -1.00%

Function 013298F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013298FA

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60217de4fb1ad2d482f52adb0405c1b9efc1e928a35c878100277d9c4fec2b65
Instruction ID: 4f0be1cddf4fc4f4ade7834e2fa767e36e5cfde2c0b9a5b2a2b59497fa4d0790
Opcode Fuzzy Hash: 60217de4fb1ad2d482f52adb0405c1b9efc1e928a35c878100277d9c4fec2b65
Instruction Fuzzy Hash: 4290026561100502D50171994404616000AA7D0286FD1C032A1014556ECA6589A6B175

Uniqueness

Uniqueness Score: -1.00%

Function 01329710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0132971A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e030ad2f649ba53e6064771cec29ed19b883f77930f0eb4ca46a941a349986e3
Instruction ID: 7daf28afb2538106d02f00def1c5b86cb7bcff63d251060ddc306df214d06b20
Opcode Fuzzy Hash: e030ad2f649ba53e6064771cec29ed19b883f77930f0eb4ca46a941a349986e3
Instruction Fuzzy Hash: DA90027521100402D50065D954086460005A7E0346F91D021A5014556EC6A588A57175

Uniqueness

Uniqueness Score: -1.00%

Function 013297A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013297AA

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0e8e5c998c87c5f2e9a40e49dad67031032529452b964240b556ec4cd4fabdb6
Instruction ID: 119af4e03bff4f070ac25d927cf7778f63c4730d94f4dd88572bab5d3be940ff
Opcode Fuzzy Hash: 0e8e5c998c87c5f2e9a40e49dad67031032529452b964240b556ec4cd4fabdb6
Instruction Fuzzy Hash: 5090026531100003D540719954186064005F7E1346F91D021E0404555CD955886A6266

Uniqueness

Uniqueness Score: -1.00%

Function 01329780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0132978A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c1218af96d345031e485f3538688fac2b9f4286b5812fde9298c2d57a7d0bf13
Instruction ID: 4b3a013bb2b87b55a6de918646816c0e9b8332ea6f5ed00d8c825bd9a675b5cb
Opcode Fuzzy Hash: c1218af96d345031e485f3538688fac2b9f4286b5812fde9298c2d57a7d0bf13
Instruction Fuzzy Hash: 6990026D22300002D5807199540860A0005A7D1247FD1D425A0005559CC955887D6365

Uniqueness

Uniqueness Score: -1.00%

Function 01329FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01329FEA

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b3c42e656462f0c0c1ecb6861566305a8eba8de46e6f630a852ea9fac61fba61
Instruction ID: ee0b792d728e6b675fdcf1f9f2661fb82848786619d019350fb35e1ef77130e4
Opcode Fuzzy Hash: b3c42e656462f0c0c1ecb6861566305a8eba8de46e6f630a852ea9fac61fba61
Instruction Fuzzy Hash: 4590027532114402D510619984047060005A7D1246F91C421A0814559DC6D588A57166

Uniqueness

Uniqueness Score: -1.00%

Function 01329A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01329A2A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4e57c81ba86d788a9edf35ec6e07bfebded6297209a8a9fb4b960b3217e865fc
Instruction ID: 27132ddf41ff727e806d2f1cebcb0bdd2f579c4c5b9585c468d1d3d2c526b470
Opcode Fuzzy Hash: 4e57c81ba86d788a9edf35ec6e07bfebded6297209a8a9fb4b960b3217e865fc
Instruction Fuzzy Hash: EF90026561100042854071A988449064005BBE1256791C131A0988551DC599887966A9

Uniqueness

Uniqueness Score: -1.00%

Function 01329A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01329A0A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dcbc0e786545b85bcbc3cbaba95c5e5905c4b6b32f77d9c2b032b61ea154321d
Instruction ID: 514209fc1c9e75eb3e970fe2bab7d7e989529670d7c490c35b320f70024259cc
Opcode Fuzzy Hash: dcbc0e786545b85bcbc3cbaba95c5e5905c4b6b32f77d9c2b032b61ea154321d
Instruction Fuzzy Hash: B390027521140402D5006199481470B0005A7D0347F91C021A1154556DC665886575B5

Uniqueness

Uniqueness Score: -1.00%

Function 01329660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0132966A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: db35164f1c0bd75f4e79f4dc41b9d388b77b12a5314bf57e069a52c889c39a37
Instruction ID: c79bd2d211825c5ff8017f9bbfbc1cb828f55274d0210b50cb3624783f1afd84
Opcode Fuzzy Hash: db35164f1c0bd75f4e79f4dc41b9d388b77b12a5314bf57e069a52c889c39a37
Instruction Fuzzy Hash: E790027521100802D5807199440464A0005A7D1346FD1C025A0015655DCA558A6D77E5

Uniqueness

Uniqueness Score: -1.00%

Function 01329A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01329A5A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8ce0442f85e3c25d2c7f9b3d4ab699df900fe9f54df085eb931796e84b446e2d
Instruction ID: 4b22c7365ae1b96f25b3667043ea482c8b5b12bb16e987e6514c764df1e50c2a
Opcode Fuzzy Hash: 8ce0442f85e3c25d2c7f9b3d4ab699df900fe9f54df085eb931796e84b446e2d
Instruction Fuzzy Hash: 5390026522180042D60065A94C14B070005A7D0347F91C125A0144555CC95588756565

Uniqueness

Uniqueness Score: -1.00%

Function 013296E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013296EA

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3877e556111588e9469fa2d102dbdfdcd8ca97ece960bf6c982cc865be9e9a93
Instruction ID: 937c65f5e0f1f22d85969d5e43ec9acf2c5a98bec9fdd19854bbadfff2e028de
Opcode Fuzzy Hash: 3877e556111588e9469fa2d102dbdfdcd8ca97ece960bf6c982cc865be9e9a93
Instruction Fuzzy Hash: D990027521108802D5106199840474A0005A7D0346F95C421A4414659DC6D588A57165

Uniqueness

Uniqueness Score: -1.00%

Function 004088C0, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004088C0(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00406E10(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00407020( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E00419CE0( &_v284, 0x104);
						E0041A350( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00413DE0(E00413D80(_t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe1a5
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E00407050( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E004070D0(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x004088cb
0x004088d3
0x004088d5
0x004088da
0x004088df
0x004088f2
0x004088f7
0x00408900
0x0040890c
0x0040891f
0x00408924
0x00408927
0x00408930
0x00408942
0x00408947
0x0040894c
0x00000000
0x00000000
0x0040894e
0x00408952
0x00000000
0x00000000
0x00408954
0x00000000
0x00408952
0x00408956
0x00408959
0x0040895f
0x00408961
0x0040896c
0x00408971
0x00408974
0x00408981
0x0040898c
0x0040898e
0x00408994
0x00408998
0x0040899b
0x0040899b
0x004089a2
0x004089a5
0x004089aa
0x004089b7
0x004088e6
0x004088e6
0x004088e6

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction ID: 4c2b1df36aa7b29bb0fae7ecfb93cd688d28708cc461f9fe29ca3c1f3973371e
Opcode Fuzzy Hash: 67bb4e2207c22d687f6acc024d55c7e0c161e5d4599185de851a30ee67947c6b
Instruction Fuzzy Hash: EC213CB2D442085BCB10E6649D42BFF73AC9B50304F04057FF989A3181FA38BB498BA7

Uniqueness

Uniqueness Score: -1.00%

Function 004184A0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184A0(intOrPtr _a4, char _a8, long _a12, long _a16) {
				void* _t10;
				void* _t15;

				E00418DD0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t6 =  &_a8; // 0x413526
				_t10 = RtlAllocateHeap( *_t6, _a12, _a16); // executed
				return _t10;
			}

0x004184b7
0x004184c2
0x004184cd
0x004184d1

APIs

RtlAllocateHeap.NTDLL(&5A,?,00413C9F,00413C9F,?,00413526,?,?,?,?,?,00000000,00408B03,?), ref: 004184CD

Strings

&5A, xrefs: 004184C2, 004184CC

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: &5A
API String ID: 1279760036-1617645808
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 6eed1dfa6fdd4b996c8079955bb5808ea645f65af4e2973490dba1d49a230398
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 94E012B1200208ABDB14EF99DC41EA777ACAF88654F118559BA085B282CA30F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00407270, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407270(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E00419D30( &_v67, 0, 0x3f);
				E0041A910( &_v68, 3);
				_t12 = E00409B30(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00413E40(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409290(1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407270
0x0040727f
0x00407283
0x0040728e
0x0040729e
0x004072ae
0x004072b3
0x004072ba
0x004072bd
0x004072ca
0x004072ce
0x004072eb
0x004072eb
0x00000000
0x004072ed
0x004072f2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072CA

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction ID: 34c16447600cfe3bfc53875ba7b31b7f06d917fb68e10caa6e1b72df1d8a1719
Opcode Fuzzy Hash: 2611248cf2981be21f72ca7afad4f10f88413beaa9ea5ad5021ab45b4f53d4d7
Instruction Fuzzy Hash: 9901D431A8022877E720A6959C03FFE776C5B00B55F05046EFF04BA1C2E6A87A0542EA

Uniqueness

Uniqueness Score: -1.00%

Function 00418631, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418631(void* __eflags, void* _a4, void* _a8, void* _a12, void* _a16) {
				void* _t9;
				void* _t10;

				asm("int 0x77");
				_t10 = _t9;
				asm("enter 0xfab1, 0xc1");
				if (__eflags <= 0) goto L3;
			}

0x00418638
0x0041863a
0x0041863b
0x0041863f

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFB2,0040CFB2,00000041,00000000,?,00408B75), ref: 00418670

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 31600f3263ccf7fe33b1b94cb9b01b034ed0990754af6be3256cf4bc3fb14d2c
Instruction ID: 7cb6d1bd5d493033dbd724c3e2496c2f6e24446214b2338ab83e1e379962a8e9
Opcode Fuzzy Hash: 31600f3263ccf7fe33b1b94cb9b01b034ed0990754af6be3256cf4bc3fb14d2c
Instruction Fuzzy Hash: B5F0A9B16003086FCA14EF55DC85EEB3BA9EF89254F11845AF9489B382C935ED10C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00418512, Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00418512(char __eax, void* __edi, void* __eflags, intOrPtr _a4, void* _a8, long _a12, int _a16) {
				void* _v117;
				intOrPtr* __esi;
				char _t17;

				asm("popad");
				 *0x42312ec2 = __eax;
				asm("cmc");
				asm("cdq");
				_pop(ds);
				if(__eflags < 0) {
					asm("in eax, dx");
					__ebp = __esp;
					__eax = _a12;
					_push(__esi);
					__esi = _a12 + 0xc7c;
					__eax =  *__esi;
					ExitProcess(_a16);
				}
				asm("o16 int1");
				_push(__edi);
				_t14 = _a4;
				_t4 = _t14 + 0xc74; // 0xc74
				E00418DD0(__edi, _a4, _t4,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t17 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t17;
			}

0x00418512
0x00418513
0x00418518
0x00418519
0x0041851a
0x0041851b
0x0041851e
0x00418521
0x00418523
0x0041852c
0x00418532
0x00418542
0x00418548
0x00418548
0x004184da
0x004184dc
0x004184e3
0x004184ef
0x004184f7
0x0041850d
0x00418511

APIs

RtlFreeHeap.NTDLL(00000060,00408B03,?,?,00408B03,00000060,00000000,00000000,?,?,00408B03,?,00000000), ref: 0041850D

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d6c71cb0d0df99245c82586233d02060fff6e4aff7a7890bde24431113eb1743
Instruction ID: f57dcdd91167443a4951242d678ff9d67f6b556f7505a5f1088ac877d32378f9
Opcode Fuzzy Hash: d6c71cb0d0df99245c82586233d02060fff6e4aff7a7890bde24431113eb1743
Instruction Fuzzy Hash: 18F08CB2200215ABCB14DFA4DC85EE77B79AFA5350F114599F84997642CA31E804CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 004184D2, Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E004184D2(void* __eax, void* __edi, void* _a4, long _a8, void* _a12) {
				intOrPtr _v0;
				void* _v117;
				char _t14;

				asm("das");
				asm("adc eax, 0xf1661069");
				asm("o16 int1");
				_push(__edi);
				_t11 = _v0;
				_t4 = _t11 + 0xc74; // 0xc74
				E00418DD0(__edi, _v0, _t4,  *((intOrPtr*)(_v0 + 0x10)), 0, 0x35);
				_t14 = RtlFreeHeap(_a4, _a8, _a12); // executed
				return _t14;
			}

0x004184d4
0x004184d7
0x004184da
0x004184dc
0x004184e3
0x004184ef
0x004184f7
0x0041850d
0x00418511

APIs

RtlFreeHeap.NTDLL(00000060,00408B03,?,?,00408B03,00000060,00000000,00000000,?,?,00408B03,?,00000000), ref: 0041850D

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: eef7e3fb806d3e7a8766b131294d386d34da590fc595e1a9fa6e4c20ae8e44bd
Instruction ID: a6986c429095c505b2475a5aa06fc04157aa48ef17f969c55b2b431dd4a12ce5
Opcode Fuzzy Hash: eef7e3fb806d3e7a8766b131294d386d34da590fc595e1a9fa6e4c20ae8e44bd
Instruction Fuzzy Hash: 50E0ED71200204AFCB24CF69CC84EEB3B6CAF84344F004158F9089B342C630E801CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 004184E0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004184E0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E00418DD0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004184ef
0x004184f7
0x0041850d
0x00418511

APIs

RtlFreeHeap.NTDLL(00000060,00408B03,?,?,00408B03,00000060,00000000,00000000,?,?,00408B03,?,00000000), ref: 0041850D

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 3ff41463f96ddcb9b979ffb1c010e7f29050f08b507ceaebb1b5cb1da4dac703
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: A0E01AB12002086BD714DF59DC45EA777ACAF88750F014559B90857281C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418640, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFB2,0040CFB2,00000041,00000000,?,00408B75), ref: 00418670

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: efef6450e86da2b54d6b49fe3c32415886d6c73e427b64be19593e81b86a73e4
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 1CE01AB12002086BDB10DF49DC85EE737ADAF88650F018159BA0857281C934E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418520, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418520(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E00418DD0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418523
0x0041853a
0x00418548

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418548

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 0124507ddd2f9c2d15af78755faa13525d8eeaf852c7518965348cd9efebe569
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: A8D012716003187BD620DF99DC85FD7779CDF48790F018169BA1C5B281C571BA0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 0132967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01329694

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e9caba1c1ca8359cebbd0f499fed4e8e31a9dac1947b2e8012fd708e75ab4af
Instruction ID: c26b236d43ef1a1b13dfdeb6e9bb710c0781eb4059f635686fb2d157b05fb800
Opcode Fuzzy Hash: 7e9caba1c1ca8359cebbd0f499fed4e8e31a9dac1947b2e8012fd708e75ab4af
Instruction Fuzzy Hash: F6B09B719014D5C9DA11E7A45608717794077D0759F56C071D1020641B4778C095F6B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0139B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

The critical section is owned by thread %p., xrefs: 0139B3B9
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0139B314
*** enter .exr %p for the exception record, xrefs: 0139B4F1
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0139B39B
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0139B47D
*** Resource timeout (%p) in %ws:%s, xrefs: 0139B352
The resource is owned exclusively by thread %p, xrefs: 0139B374
*** An Access Violation occurred in %ws:%s, xrefs: 0139B48F
write to, xrefs: 0139B4A6
The instruction at %p referenced memory at %p., xrefs: 0139B432
an invalid address, %p, xrefs: 0139B4CF
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0139B484
The instruction at %p tried to %s , xrefs: 0139B4B6
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0139B2F3
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0139B323
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0139B476
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0139B305
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0139B38F
The resource is owned shared by %d threads, xrefs: 0139B37E
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0139B53F
Go determine why that thread has not released the critical section., xrefs: 0139B3C5
This failed because of error %Ix., xrefs: 0139B446
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0139B2DC
read from, xrefs: 0139B4AD, 0139B4B2
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0139B3D6
*** Inpage error in %ws:%s, xrefs: 0139B418
*** then kb to get the faulting stack, xrefs: 0139B51C
*** enter .cxr %p for the context, xrefs: 0139B50D
a NULL pointer, xrefs: 0139B4E0
<unknown>, xrefs: 0139B27E, 0139B2D1, 0139B350, 0139B399, 0139B417, 0139B48E

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: dc95d1ad61f4faf13d5dea10e470b5a23c7f554ab5a213f05d20c642a1f7921c
Instruction ID: b56444901093e60b177c3244a145c7bf1bf1cc1d5c92c26d7e8375f5150147bb
Opcode Fuzzy Hash: dc95d1ad61f4faf13d5dea10e470b5a23c7f554ab5a213f05d20c642a1f7921c
Instruction Fuzzy Hash: AA814335A40204FFDF35AA4EEC85E7BBF3AEF56A5AF014088F5042B156D2658801DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 013A1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E013A1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x12c48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012EB150();
				} else {
					E012EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x13d589c);
				E012EB150("Heap error detected at %p (heap handle %p)\n",  *0x13d58a0);
				_t27 =  *0x13d5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M013A1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012EB150();
				} else {
					E012EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E012EB150("Error code: %d - %s\n",  *0x13d5898);
				_t113 =  *0x13d58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012EB150();
					} else {
						E012EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012EB150("Parameter1: %p\n",  *0x13d58a4);
				}
				_t115 =  *0x13d58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012EB150();
					} else {
						E012EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012EB150("Parameter2: %p\n",  *0x13d58a8);
				}
				_t117 =  *0x13d58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012EB150();
					} else {
						E012EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012EB150("Parameter3: %p\n",  *0x13d58ac);
				}
				_t119 =  *0x13d58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012EB150();
					} else {
						E012EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x13d58b4);
					E012EB150("Last known valid blocks: before - %p, after - %p\n",  *0x13d58b0);
				} else {
					_t120 =  *0x13d58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012EB150();
				} else {
					E012EB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E012EB150("Stack trace available at %p\n", 0x13d58c0);
			}

0x013a1c10
0x013a1c16
0x013a1c1e
0x013a1c3d
0x013a1c3e
0x013a1c20
0x013a1c35
0x013a1c3a
0x013a1c44
0x013a1c55
0x013a1c5a
0x013a1c65
0x013a1c67
0x00000000
0x013a1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x013a1c67
0x013a1cdc
0x013a1ce5
0x013a1d04
0x013a1d05
0x013a1ce7
0x013a1cfc
0x013a1d01
0x013a1d0b
0x013a1d17
0x013a1d1f
0x013a1d25
0x013a1d30
0x013a1d4f
0x013a1d50
0x013a1d32
0x013a1d47
0x013a1d4c
0x013a1d61
0x013a1d67
0x013a1d68
0x013a1d6e
0x013a1d79
0x013a1d98
0x013a1d99
0x013a1d7b
0x013a1d90
0x013a1d95
0x013a1daa
0x013a1db0
0x013a1db1
0x013a1db7
0x013a1dc2
0x013a1de1
0x013a1de2
0x013a1dc4
0x013a1dd9
0x013a1dde
0x013a1df3
0x013a1df9
0x013a1dfa
0x013a1e00
0x013a1e0a
0x013a1e13
0x013a1e32
0x013a1e33
0x013a1e15
0x013a1e2a
0x013a1e2f
0x013a1e39
0x013a1e4a
0x013a1e02
0x013a1e02
0x013a1e08
0x00000000
0x00000000
0x013a1e08
0x013a1e5b
0x013a1e7a
0x013a1e7b
0x013a1e5d
0x013a1e72
0x013a1e77
0x013a1e95

Strings

Parameter3: %p, xrefs: 013A1DEE
heap_failure_generic, xrefs: 013A1C7C
heap_failure_multiple_entries_corruption, xrefs: 013A1C8A
heap_failure_buffer_underrun, xrefs: 013A1C9F
heap_failure_listentry_corruption, xrefs: 013A1CD0
HEAP[%wZ]: , xrefs: 013A1C30, 013A1CF7, 013A1D42, 013A1D8B, 013A1DD4, 013A1E25, 013A1E6D
Parameter2: %p, xrefs: 013A1DA5
Stack trace available at %p, xrefs: 013A1E86
heap_failure_usage_after_free, xrefs: 013A1CBB
heap_failure_buffer_overrun, xrefs: 013A1C98
heap_failure_cross_heap_operation, xrefs: 013A1CC2
heap_failure_freelists_corruption, xrefs: 013A1CC9
Last known valid blocks: before - %p, after - %p, xrefs: 013A1E45
Parameter1: %p, xrefs: 013A1D5C
heap_failure_internal, xrefs: 013A1C6E
Error code: %d - %s, xrefs: 013A1D12
HEAP: , xrefs: 013A1C16, 013A1C3D, 013A1D04, 013A1D4F, 013A1D98, 013A1DE1, 013A1E32, 013A1E7A
heap_failure_invalid_argument, xrefs: 013A1CAD
heap_failure_entry_corruption, xrefs: 013A1C83
heap_failure_invalid_allocation_type, xrefs: 013A1CB4
Heap error detected at %p (heap handle %p), xrefs: 013A1C50
heap_failure_block_not_busy, xrefs: 013A1CA6
heap_failure_unknown, xrefs: 013A1C75
heap_failure_lfh_bitmap_mismatch, xrefs: 013A1CD7
heap_failure_virtual_block_corruption, xrefs: 013A1C91

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 7636a0db9a0d1a8b1d3585cf140ef18956ca38a13176aa211d9934ff99c34470
Instruction ID: 6aa05fe94b246dbc7bf29d893c6ba0468a70bdae5361477f34ed36cc8a6ec3af
Opcode Fuzzy Hash: 7636a0db9a0d1a8b1d3585cf140ef18956ca38a13176aa211d9934ff99c34470
Instruction Fuzzy Hash: E461C33363214ADFD721AB89E489E3477F8EB04A74F8A806EF50E5F701D624D8408B5A

Uniqueness

Uniqueness Score: -1.00%

Function 012EB171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E012EB171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x13bf7a8);
				E0133D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E0133D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E0132D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E0132F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L0133DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E0132B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E0132B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E0132E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E0132A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x012eb171
0x012eb171
0x012eb171
0x012eb171
0x012eb171
0x012eb176
0x012eb17b
0x012eb180
0x012eb186
0x012eb18f
0x012eb198
0x012eb1a4
0x012eb1aa
0x01344802
0x01344802
0x01344805
0x0134480c
0x0134480e
0x012eb1d1
0x012eb1d3
0x012eb1de
0x012eb1de
0x01344817
0x0134481e
0x01344820
0x01344822
0x01344822
0x01344824
0x01344824
0x0134482a
0x00000000
0x00000000
0x01344835
0x0134483a
0x0134483d
0x0134483f
0x01344842
0x01344842
0x01344842
0x01344846
0x0134484c
0x0134484e
0x01344851
0x01344851
0x01344853
0x01344854
0x01344854
0x01344858
0x0134485a
0x0134485a
0x0134485d
0x0134485f
0x01344861
0x01344861
0x01344866
0x0134486b
0x0134486e
0x01344871
0x01344876
0x01344876
0x01344878
0x0134487b
0x01344884
0x01344884
0x00000000
0x0134487d
0x0134487d
0x01344882
0x01344889
0x01344889
0x0134488f
0x01344891
0x013448e0
0x013448e2
0x013448e4
0x013448e4
0x013448e7
0x013448e7
0x013448ed
0x013448f4
0x013448f6
0x01344951
0x01344951
0x01344953
0x01344953
0x01344956
0x01344956
0x01344958
0x01344959
0x01344959
0x0134495d
0x0134495d
0x0134495f
0x0134495f
0x01344965
0x01344969
0x013449ba
0x013449ba
0x013449c1
0x013449c5
0x013449cc
0x013449d4
0x013449d7
0x013449da
0x013449e4
0x013449e5
0x013449f3
0x01344a02
0x00000000
0x01344a02
0x01344972
0x01344974
0x00000000
0x00000000
0x01344976
0x01344979
0x01344982
0x01344983
0x01344984
0x0134498b
0x0134498d
0x01344991
0x01344993
0x01344999
0x0134499d
0x013449a2
0x013449a2
0x013449a2
0x01344999
0x013449ac
0x00000000
0x013449b3
0x013448f8
0x013448fe
0x00000000
0x00000000
0x00000000
0x013448fe
0x01344895
0x0134489c
0x013448ad
0x013448b2
0x013448b5
0x013448b7
0x013448ba
0x013448bc
0x013448c6
0x013448c6
0x013448cb
0x013448d1
0x013448d4
0x013448d8
0x013448d8
0x00000000
0x013448d8
0x013448be
0x013448c0
0x00000000
0x00000000
0x013448c2
0x00000000
0x00000000
0x00000000
0x013448c4
0x00000000
0x01344882
0x0134487b
0x01344904
0x01344906
0x00000000
0x00000000
0x01344908
0x0134490e
0x00000000
0x00000000
0x01344910
0x01344917
0x01344917
0x00000000
0x01344917
0x012eb1ba
0x013447f9
0x013447fc
0x00000000
0x00000000
0x00000000
0x013447fc
0x012eb1c0
0x012eb1c0
0x012eb1c3
0x012eb1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 013448AD

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 2d8d2d28c0a0e5c664ef36d13198c1373114e57195b7c8f5a7ee3de147aad735
Instruction ID: dbee48c04ec744d61646572c1d48aa9f4e4550489777b826f1dc9adf826b8a52
Opcode Fuzzy Hash: 2d8d2d28c0a0e5c664ef36d13198c1373114e57195b7c8f5a7ee3de147aad735
Instruction Fuzzy Hash: 8151E075D0026A8BEB31CF68C845BAEBFF0BF00718F2041B9D859AB282D7716941DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0130B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0130B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x13dd360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E01307D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E013B8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E01329E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E0132B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E0132CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E01307D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E013B8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E0132AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x13d8628; // 0x0
								_v68 = _t77;
								_t78 =  *0x13d862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x13d8628; // 0x0
							_t116 =  *0x13d862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0130b94c
0x0130b956
0x0130b95c
0x0130b95e
0x0130b964
0x0130b969
0x0130b96d
0x0130b96d
0x0130b970
0x0130b974
0x0130b97a
0x0130badf
0x0130badf
0x0130bae2
0x0130bae4
0x0130bae6
0x0130baf0
0x01352cb8
0x0130baf6
0x0130baf6
0x0130baf6
0x0130bafd
0x0130bb1f
0x0130bb1f
0x0130baff
0x0130bb00
0x0130bb00
0x0130bb03
0x0130bb03
0x0130bacb
0x0130bacf
0x0130bad0
0x0130bad1
0x0130badc
0x0130badc
0x0130b980
0x0130b980
0x0130b988
0x0130b98b
0x0130b98d
0x0130b990
0x0130b993
0x0130b999
0x0130b99b
0x0130b9a1
0x0130b9a5
0x0130b9aa
0x0130b9b0
0x0130b9bb
0x0130b9c0
0x0130b9c3
0x0130b9ca
0x0130b9cc
0x0130b9cf
0x0130b9d3
0x0130b9d7
0x0130ba94
0x0130ba94
0x0130ba98
0x0130baa3
0x01352ccb
0x0130baa9
0x0130baa9
0x0130baa9
0x0130bab1
0x01352cd5
0x01352cdd
0x01352cdd
0x0130babb
0x0130babc
0x0130bac2
0x0130bac3
0x0130bac3
0x0130bac6
0x00000000
0x0130b9dd
0x0130b9dd
0x0130b9e7
0x0130b9e7
0x0130b9ec
0x0130b9ec
0x0130b9f1
0x0130b9f5
0x0130b9fa
0x0130ba00
0x0130ba0c
0x0130ba10
0x0130ba10
0x0130ba12
0x0130ba18
0x00000000
0x00000000
0x0130bb26
0x0130bb26
0x0130ba1e
0x0130ba1e
0x0130ba23
0x0130ba25
0x0130ba2c
0x0130ba30
0x0130ba35
0x0130ba35
0x0130ba41
0x0130ba46
0x0130ba4c
0x0130ba50
0x0130ba54
0x0130ba6a
0x0130ba6e
0x0130ba70
0x0130ba74
0x0130ba78
0x0130ba7a
0x0130ba7c
0x0130ba8e
0x0130ba90
0x0130ba92
0x0130bb14
0x0130bb14
0x0130bb16
0x0130bb16
0x00000000
0x0130ba7c
0x0130bb0a
0x0130bb0d
0x00000000
0x00000000
0x00000000
0x0130bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0130B9A5

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: ae4e49f2bd1ea4ade9b1ff1f714096d79ff775076e5de16ac8bf4da8bc86afb4
Instruction ID: 3871854608767c04f2a660750fc53df72db5e0c6a12cb77f1eda825b1ce007cd
Opcode Fuzzy Hash: ae4e49f2bd1ea4ade9b1ff1f714096d79ff775076e5de16ac8bf4da8bc86afb4
Instruction Fuzzy Hash: E2516B75608341CFD722DF6DC090A2AFBE9FB88718F14496EE69587789D730E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 012E2D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E012E2D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x13d5350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x13d7bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E013297C0();
				}
				if( *0x13d79c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x13d79c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E01311624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E01307D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E0137FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E01329520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0131E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L0133DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x13d6901;
								_push(_t109);
								_v52 = _t98;
								if( *0x13d6901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E01329980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E013295D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E01307D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E01307D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E01367016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E0137FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x13d5350;
							if(_t109 != 0x13d5350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E0137FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E01375720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x012e2d8a
0x012e2d8a
0x012e2d92
0x012e2d96
0x012e2d9e
0x012e2da0
0x012e2da3
0x012e2da5
0x012e2da8
0x012e2dab
0x012e2db2
0x0133f9aa
0x0133f9ab
0x0133f9ae
0x0133f9ae
0x012e2db8
0x012e2dc2
0x0133f9b9
0x0133f9be
0x0133f9bf
0x0133f9bf
0x012e2dcf
0x0133f9c9
0x012e2dd5
0x012e2dd5
0x012e2dd5
0x012e2dde
0x012e2de1
0x012e2e70
0x012e2e72
0x012e2e72
0x012e2de7
0x012e2deb
0x012e2e7c
0x012e2e83
0x012e2e85
0x012e2e8b
0x012e2e8d
0x012e2e92
0x012e2e92
0x012e2e85
0x012e2df1
0x012e2df7
0x012e2df9
0x012e2df9
0x012e2dfc
0x012e2dff
0x012e2e02
0x00000000
0x012e2e05
0x012e2e0c
0x0133f9d9
0x012e2e12
0x012e2e12
0x012e2e12
0x012e2e1a
0x0133f9e3
0x0133f9e9
0x0133f9f0
0x0133f9f6
0x0133f9f8
0x0133f9f8
0x0133f9f0
0x012e2e23
0x0133fa02
0x0133fa03
0x0133fa05
0x0133fa06
0x00000000
0x012e2e29
0x012e2e29
0x012e2e2e
0x012e2e34
0x012e2e3e
0x00000000
0x00000000
0x012e2e44
0x012e2e47
0x012e2e4d
0x00000000
0x00000000
0x012e2e4f
0x012e2e54
0x00000000
0x00000000
0x012e2e5a
0x012e2e5f
0x012e2e9a
0x012e2ea4
0x012e2ea5
0x012e2ea8
0x012e2eaf
0x012e2eb2
0x012e2eb5
0x0133fae9
0x0133faeb
0x0133faed
0x0133faef
0x0133faf7
0x0133faf8
0x0133fafd
0x0133faff
0x0133fb04
0x0133fb04
0x0133faff
0x012e2ec0
0x012e2ec4
0x012e2ec6
0x012e2ec8
0x0133fb14
0x0133fb18
0x0133fb1e
0x0133fb21
0x0133fb21
0x012e2ece
0x012e2ece
0x012e2ece
0x012e2ed7
0x012e2e61
0x012e2e63
0x0133fa6b
0x0133fa71
0x0133fa76
0x0133fa78
0x0133fa8a
0x0133fa7a
0x0133fa83
0x0133fa83
0x0133fa8f
0x0133fa91
0x0133fa97
0x0133fa9d
0x0133faa4
0x0133faaa
0x0133faaf
0x0133fab1
0x0133fac3
0x0133fab3
0x0133fabc
0x0133fabc
0x0133fac8
0x0133facb
0x0133fadf
0x0133fadf
0x0133facb
0x0133faa4
0x0133fa91
0x012e2e6f
0x012e2e6f
0x012e2e5f
0x0133fa13
0x0133fa15
0x0133fa17
0x0133fa1f
0x0133fa21
0x0133fa22
0x0133fa25
0x0133fa28
0x0133fa2f
0x0133fa2f
0x0133fa2a
0x0133fa2a
0x0133fa2a
0x0133fa31
0x0133fa34
0x0133fa36
0x0133fa3c
0x0133fa3e
0x0133fa41
0x0133fa43
0x0133fa45
0x0133fa45
0x0133fa41
0x0133fa3c
0x0133fa4a
0x0133fa4f
0x0133fa51
0x0133fa53
0x0133fa56
0x0133fa5b
0x0133fa5e
0x00000000
0x0133fa5e
0x012e2e23

Strings

RTL: Re-Waiting, xrefs: 0133FA4A

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 56931849cdb62767dd992a88e6ab9d225f1866a774d517f99b8c486d716d23f7
Instruction ID: af44a32e347f640424244b70e7caf81914025c9679fb1c07946c5e54e0f35627
Opcode Fuzzy Hash: 56931849cdb62767dd992a88e6ab9d225f1866a774d517f99b8c486d716d23f7
Instruction Fuzzy Hash: 45615A31E10615DFEB32DF6CC844B7E7BECEB84318F580265D612972C1C774A9018B82

Uniqueness

Uniqueness Score: -1.00%

Function 013B0EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E013B0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E013AFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E013B1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E01329730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E013AA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E013AA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x13d8b04 >> 0x14) + (_v44 -  *0x13d8b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E01307D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E013A138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E01307D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0139FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x13d8724 & 0x00000008) != 0) {
						E013A52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E013B15B5(0x13d8ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x013b0eb7
0x013b0eb9
0x013b0ec0
0x013b0ec2
0x013b0ecd
0x013b105b
0x013b105b
0x013b1061
0x013b1066
0x013b1066
0x013b106b
0x013b1073
0x013b1073
0x013b0ed3
0x013b0ed6
0x013b0edc
0x013b0ee0
0x013b0ee7
0x013b0ef0
0x013b0ef5
0x013b0efa
0x013b0efc
0x013b0efd
0x013b0f03
0x013b0f04
0x013b0f06
0x013b0f07
0x013b0f09
0x013b0f0e
0x013b0f14
0x013b0f23
0x013b0f2d
0x013b0f34
0x013b0f34
0x013b0f14
0x013b0f52
0x00000000
0x00000000
0x013b0f58
0x013b0f73
0x013b0f74
0x013b0f79
0x013b0f7d
0x013b0f80
0x013b0f86
0x013b0fab
0x013b0fb5
0x013b0fc6
0x013b0fd1
0x013b0fe3
0x013b0fd3
0x013b0fdc
0x013b0fdc
0x013b0feb
0x013b1009
0x013b1009
0x013b1015
0x013b1027
0x013b1017
0x013b1020
0x013b1020
0x013b102f
0x013b103c
0x013b103c
0x013b1048
0x013b1050
0x013b1050
0x013b1055
0x00000000
0x013b1055
0x013b0f88
0x013b0f9e
0x013b0fa2
0x013b0fa9
0x00000000
0x00000000
0x00000000
0x013b0fa9
0x00000000

Strings

`, xrefs: 013B0F16

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 389c5e856891dda974184c53ff601885cd90c953c5413af9d30917dfe4b6190b
Instruction ID: b278a67f21557bcc2e85200718d10c5c908dac81bb0f5d92319c78a7710583d7
Opcode Fuzzy Hash: 389c5e856891dda974184c53ff601885cd90c953c5413af9d30917dfe4b6190b
Instruction Fuzzy Hash: 4A519F713043429FD325DF28E8D4B5BBBE9EBC4708F04092DF69697A90E670E909C762

Uniqueness

Uniqueness Score: -1.00%

Function 0131F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0131F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E01304120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E01329830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E01329990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E013295D0();
							goto L11;
						} else {
							_t109 = L01304620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E0132F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E013295D0();
										L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x0131f0d3
0x0131f0d9
0x0131f0e0
0x0131f0e7
0x0131f0f2
0x0131f0f4
0x0131f0f8
0x0131f100
0x0131f108
0x0131f10d
0x0131f115
0x0131f116
0x0131f11f
0x0131f123
0x0131f124
0x0131f12c
0x0131f130
0x0131f134
0x0131f13d
0x0131f144
0x0131f14b
0x0131f152
0x0135bab0
0x0135bab0
0x0131f158
0x0131f158
0x0131f15a
0x0131f160
0x0131f165
0x0131f166
0x0131f16f
0x0131f173
0x0135baa7
0x0135baa7
0x0135baab
0x00000000
0x0131f179
0x0131f18d
0x0131f191
0x0135baa2
0x00000000
0x0131f197
0x0131f19b
0x0131f1a2
0x0131f1a9
0x0131f1af
0x0131f1b2
0x0131f1b6
0x0131f1b9
0x0131f1c4
0x0131f1d8
0x0131f1df
0x0131f1e3
0x0131f1eb
0x0131f1ee
0x0131f1f4
0x0131f20f
0x0135bab7
0x0135babb
0x0135bacc
0x0135bad1
0x0131f215
0x0131f218
0x0131f226
0x0131f22b
0x00000000
0x0131f22b
0x0131f1f6
0x0131f1f6
0x0131f1f9
0x0131f1fb
0x0131f1fb
0x0131f1f4
0x0131f191
0x0131f173
0x0131f152
0x0131f203

Strings

@, xrefs: 0131F124

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 8c4eb0fb1093d8e2ed115f69f11b060ac10037978ece70c568ef431a827783c6
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: DC518D716047119FD321DF29C840A6BBBF9FF48B18F10892DFAA587690E7B4E914CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0131D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0131D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x13dd360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E01304120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E0132B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E013298D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E013295D0();
					L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x0131d29c
0x0131d2a6
0x0131d2b1
0x0131d2b5
0x0131d2b6
0x0131d2bc
0x0131d2bd
0x0131d2be
0x0131d2bf
0x0131d2c2
0x0131d2c4
0x0131d2cc
0x0131d384
0x0131d34b
0x0131d34f
0x0131d350
0x0131d351
0x0131d35c
0x0131d35c
0x0131d2d6
0x0131d2da
0x0131d2e1
0x0131d361
0x0131d369
0x0131d36d
0x0131d2e3
0x0131d2e3
0x0131d2e3
0x0131d2e5
0x0131d2ed
0x0131d2f5
0x0131d2fa
0x0131d302
0x0131d303
0x0131d30b
0x0131d30f
0x0131d313
0x0131d318
0x0131d31c
0x0131d320
0x0131d379
0x0131d37d
0x00000000
0x00000000
0x0135affe
0x0135b001
0x0135b011
0x00000000
0x0131d322
0x0131d322
0x0131d330
0x0131d337
0x0131d35d
0x0131d339
0x0131d33f
0x0131d38c
0x0131d38c
0x0131d33f
0x0131d349
0x00000000
0x0131d349

Strings

@, xrefs: 0131D303

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7d668f609af5f201680f209e34a999fdd81131bbd274c9789ee997f1481cb991
Instruction ID: cefd9f6ed68a968d738352526a29ae6ba362325da7af43a7b568d4774ee681f3
Opcode Fuzzy Hash: 7d668f609af5f201680f209e34a999fdd81131bbd274c9789ee997f1481cb991
Instruction Fuzzy Hash: C431A2B15083059FC325DF6CC984A6BBBE8EB9A758F000A2EF99483650D734DD05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01398DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01398DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x13c0d50);
				E0133D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E01375720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L0133DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L0133DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E0133D130(_t34, _t39, _t40);
			}

0x01398df1
0x01398df1
0x01398df1
0x01398df1
0x01398df1
0x01398df1
0x01398df3
0x01398df8
0x01398dfd
0x01398e00
0x01398e0e
0x01398e2a
0x01398e36
0x01398e38
0x01398e3c
0x01398e46
0x01398e46
0x01398e36
0x01398e50
0x01398e56
0x01398e59
0x01398e5c
0x01398e60
0x01398e67
0x01398e6d
0x01398e73
0x01398e74
0x01398eb1
0x01398ebd

Strings

Critical error detected %lx, xrefs: 01398E21

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 74c6397e24db219ee792cb0cea6e3533c7fb6d22215c90c81d42b80769e1be76
Instruction ID: 7a4bea6a3d6234ed28ba4643e5e8c1057e733d7ca4e18db3e310f2d7e021eaa1
Opcode Fuzzy Hash: 74c6397e24db219ee792cb0cea6e3533c7fb6d22215c90c81d42b80769e1be76
Instruction Fuzzy Hash: 3F1187B5D1034CDBDF28CFB8850579CBBB4BB45319F20429EE129AB282C3340602CF18

Uniqueness

Uniqueness Score: -1.00%

Function 0137FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0137FF60

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: af8d0364adc1ea03c388e43001054c94f60ec14c00edd7ae72ed8ca160d9f429
Instruction ID: 045575578350c66082b2094665dbdfcc989534212a31bb73bdbdd57b589244bd
Opcode Fuzzy Hash: af8d0364adc1ea03c388e43001054c94f60ec14c00edd7ae72ed8ca160d9f429
Instruction Fuzzy Hash: 6C110471910544EFDB26DF58C948F98BBB1FF0471CF548058E10457261CB3D9954CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013B5BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E013B5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x13c1178);
				E0133D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E013B4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E0132D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E013B5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x13d60e8;
								if( *0x13d60e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x13d60e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E01329710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E01326DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E0132F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E0132F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E0132F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E0132FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E0132FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E0132F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E0132F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E013B4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E0133D130(_t427, _t494, _t511);
				}
			}

0x013b5ba5
0x013b5baa
0x013b5baf
0x013b5bb4
0x013b5bb6
0x013b5bbc
0x013b5bbe
0x013b5bc4
0x013b5bcd
0x013b5bd3
0x013b5bd6
0x013b5bdc
0x013b5be0
0x013b5be3
0x013b5beb
0x013b5bf2
0x013b5bf8
0x013b5bfe
0x013b5c04
0x013b5c0e
0x013b5c18
0x013b5c1f
0x013b5c25
0x013b5c2a
0x013b5c2c
0x013b5c32
0x013b5c3a
0x013b5c3f
0x013b5c42
0x013b5c48
0x013b5c5b
0x013b5c5b
0x013b5c2c
0x013b5cb7
0x013b5cb9
0x013b5cbf
0x013b5cc2
0x013b5cca
0x013b5ccb
0x013b5ccb
0x013b5cd1
0x013b5cd7
0x013b5cda
0x013b5ce1
0x013b5ce4
0x013b5ce7
0x013b5ced
0x013b5cf3
0x013b5cf9
0x013b5cff
0x013b5d08
0x013b5d0a
0x013b5d0e
0x013b5d10
0x00000000
0x00000000
0x013b5d16
0x013b5d1a
0x00000000
0x00000000
0x013b5d20
0x013b5d22
0x013b5d25
0x013b5d2f
0x013b5d2f
0x013b5d33
0x013b5d3d
0x013b5d49
0x013b5d4b
0x00000000
0x00000000
0x013b5d5a
0x013b5d5d
0x013b5d60
0x00000000
0x00000000
0x013b5d66
0x013b5d69
0x00000000
0x00000000
0x013b5d6f
0x013b5d6f
0x013b5d73
0x013b5d79
0x013b5d7f
0x013b5d86
0x013b5d95
0x013b5d98
0x013b5dba
0x013b5dcb
0x013b5dce
0x013b5dd3
0x013b5dd6
0x013b5dd8
0x013b5de6
0x013b5dec
0x013b5dee
0x013b5df1
0x013b5df3
0x013b635a
0x013b635a
0x00000000
0x013b635a
0x013b5dfe
0x013b5e02
0x013b5e05
0x013b5e07
0x013b5e10
0x013b5e13
0x013b5e1b
0x013b5e1c
0x013b5e21
0x013b5e22
0x013b5e23
0x013b5e25
0x013b5e2a
0x013b5e2c
0x013b5e2e
0x013b5e36
0x013b5e39
0x013b5e42
0x013b5e47
0x013b5e4d
0x013b5e54
0x013b5e54
0x013b5e54
0x013b5e2e
0x013b5e5c
0x013b5e5f
0x013b5e62
0x013b5e64
0x013b5e6b
0x013b5e70
0x013b5e7a
0x013b5e7a
0x013b5e7a
0x013b5e6b
0x013b5e7e
0x013b5e7f
0x013b5e7f
0x013b5e81
0x013b5e87
0x013b5e8b
0x013b5e8c
0x013b5e8c
0x013b5e8c
0x013b5e9a
0x013b5e9c
0x013b5ea2
0x013b5ea6
0x013b5f50
0x013b5f50
0x013b5f57
0x013b5f66
0x013b5f66
0x013b5f66
0x013b5f68
0x013b5f6a
0x013b63d0
0x00000000
0x013b5f70
0x013b5f70
0x013b5f91
0x013b5f9c
0x013b5f9e
0x013b5fa4
0x013b5fa6
0x013b638c
0x013b6392
0x013b63a1
0x013b63a7
0x013b63af
0x013b63af
0x013b63bd
0x013b63d8
0x00000000
0x013b63d8
0x013b5fac
0x013b5fb2
0x013b5fb4
0x013b5fbd
0x013b5fc6
0x013b5fce
0x013b5fd4
0x013b5fdc
0x013b5fec
0x013b5fed
0x013b5fee
0x013b5fef
0x013b5ff9
0x013b5ffa
0x013b5ffb
0x013b5ffc
0x013b6000
0x013b6004
0x013b6012
0x013b6012
0x013b6018
0x013b6019
0x013b601a
0x013b601b
0x013b601c
0x013b6020
0x013b6059
0x013b605c
0x013b6061
0x013b6061
0x013b6022
0x013b6022
0x013b6022
0x013b6025
0x013b602a
0x013b602b
0x013b6031
0x013b6037
0x013b6038
0x013b603e
0x013b6048
0x013b6049
0x013b604a
0x013b604b
0x013b604c
0x013b604d
0x013b6053
0x013b6054
0x013b6054
0x013b6062
0x013b6065
0x013b6067
0x013b606a
0x013b6070
0x013b6075
0x013b6076
0x013b6081
0x013b6087
0x013b6095
0x013b6099
0x013b609e
0x013b60a4
0x013b60ae
0x013b60b0
0x013b60b3
0x013b60b6
0x013b60b8
0x013b60ba
0x013b60ba
0x013b60ba
0x013b60ba
0x013b60be
0x013b60c0
0x013b60c5
0x013b60c5
0x013b60c5
0x013b60c6
0x013b60cd
0x013b6114
0x013b60cf
0x013b60cf
0x013b60d4
0x013b60d5
0x013b60da
0x013b60db
0x013b60e1
0x013b60e2
0x013b60e8
0x013b60f8
0x013b60fd
0x013b60fe
0x013b6102
0x013b6104
0x013b6107
0x013b6109
0x013b610b
0x013b610b
0x013b610b
0x013b610b
0x013b610f
0x013b610f
0x013b6117
0x013b611a
0x013b611f
0x013b6125
0x013b6134
0x013b6139
0x013b613f
0x013b6146
0x013b6148
0x013b614b
0x013b614d
0x013b614f
0x013b614f
0x013b614f
0x013b614f
0x013b6153
0x013b6159
0x013b6159
0x013b615c
0x013b6163
0x013b6169
0x013b616c
0x013b6172
0x013b6181
0x013b6186
0x013b6187
0x013b618b
0x013b6191
0x013b6195
0x013b61a3
0x013b61bb
0x013b61c0
0x013b61c3
0x013b61cc
0x013b61d0
0x013b61dc
0x013b61de
0x013b61e1
0x013b61e4
0x013b61e6
0x013b61e8
0x013b61e8
0x013b61e8
0x013b61e8
0x013b61e6
0x013b61ec
0x013b61f3
0x013b6203
0x013b6209
0x013b620a
0x013b6216
0x013b621d
0x013b6227
0x013b6241
0x013b6246
0x013b624c
0x013b6257
0x013b6259
0x013b625c
0x013b625e
0x013b6260
0x013b6260
0x013b6260
0x013b6260
0x013b625e
0x013b6264
0x013b6267
0x013b6269
0x013b6315
0x013b6315
0x013b631b
0x013b631e
0x013b6324
0x013b6327
0x013b632f
0x013b6330
0x013b6333
0x013b633a
0x013b633c
0x013b6335
0x013b6335
0x013b6335
0x013b633f
0x013b6342
0x013b634c
0x013b6352
0x013b6355
0x013b6355
0x013b6359
0x00000000
0x013b626f
0x013b6275
0x013b6275
0x013b6278
0x013b627e
0x013b627e
0x013b6281
0x013b6287
0x013b628d
0x013b6298
0x013b629c
0x013b62a2
0x013b629e
0x013b629e
0x013b629e
0x013b62a7
0x013b62a7
0x013b62aa
0x013b62b0
0x013b62f0
0x013b62f0
0x013b62f2
0x013b62f8
0x013b62fd
0x013b62b2
0x013b62b2
0x013b62b2
0x013b62b5
0x013b62dd
0x013b62e2
0x013b62e5
0x013b62b7
0x013b62b8
0x013b62bb
0x013b62bd
0x013b62c0
0x013b62c4
0x013b62cd
0x013b62cd
0x013b62c0
0x013b62bb
0x013b62b5
0x013b6302
0x013b6303
0x013b6305
0x013b6305
0x013b6305
0x013b630c
0x013b630c
0x00000000
0x013b627e
0x013b6269
0x013b5eac
0x013b5ebb
0x013b5ebe
0x013b5ecb
0x013b5ecb
0x013b5ece
0x013b5ece
0x013b5ed4
0x013b5ed7
0x013b5ed9
0x013b5edb
0x013b5edb
0x013b5ee1
0x013b5ee1
0x013b5ee3
0x013b5f20
0x013b5f20
0x013b5ee5
0x013b5ee5
0x013b5ee5
0x013b5ee8
0x013b5f11
0x013b5f18
0x013b5eea
0x013b5eea
0x013b5eed
0x013b5ef2
0x013b5ef8
0x013b5efb
0x013b5f0a
0x013b5f0a
0x013b5eed
0x013b5ee8
0x013b5f22
0x013b5f28
0x00000000
0x00000000
0x013b5f30
0x013b5f31
0x013b5f37
0x013b5f3a
0x013b5f3d
0x013b5f44
0x00000000
0x00000000
0x00000000
0x013b5f46
0x013b5f48
0x013b5f4d
0x00000000
0x013b5f4d
0x013b5dda
0x013b5ddf
0x00000000
0x013b5ddf
0x013b5dd8
0x013b5da7
0x013b5da9
0x013b5dac
0x013b5dae
0x00000000
0x013b5db4
0x013b5db4
0x00000000
0x013b5db4
0x013b5dae
0x013b5d88
0x013b5d8d
0x013b6363
0x013b6369
0x013b636a
0x013b6370
0x013b6372
0x013b637a
0x013b637b
0x013b637d
0x00000000
0x00000000
0x013b637f
0x013b6385
0x00000000
0x013b6385
0x013b5d38
0x013b5d3b
0x00000000
0x00000000
0x00000000
0x013b5d3b
0x013b5d27
0x013b5d29
0x00000000
0x00000000
0x00000000
0x013b6360
0x00000000
0x013b6360
0x013b5c10
0x013b5c10
0x013b63da
0x013b63e5
0x013b63e5

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559feb349b7566b55810f5882034ce60b8f1b24611ea9cf84b2bb92a18a3b6ce
Instruction ID: 4bd3b9b340bade24691d6c37f6b25495a5867998af47751e3af47644746420db
Opcode Fuzzy Hash: 559feb349b7566b55810f5882034ce60b8f1b24611ea9cf84b2bb92a18a3b6ce
Instruction Fuzzy Hash: 7E425071901219CFDB24CF68C881BE9BBB5FF45308F1481AADA4DEB652E7349985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01304120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E01304120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x13dd360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0131F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E01306E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L01304620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E01306E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M013045F8))) {
												case 0:
													_v568 = 0x12c1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x12c11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L01304620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E0132F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E0132F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E012E52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E012FEB70(1, 0x13d79a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E012FAA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E013295D0();
																			L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E0132B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E01323D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E0132B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x01304128
0x01304135
0x0130413c
0x01304141
0x01304145
0x01304147
0x0130414e
0x01304151
0x01304159
0x0130415c
0x01304160
0x01304164
0x01304168
0x0130416c
0x0130417f
0x01304181
0x0130446a
0x0130446a
0x0130418c
0x01304195
0x01304199
0x01304432
0x01304439
0x0130443d
0x01304442
0x01304447
0x00000000
0x0130419f
0x013041a3
0x013041b1
0x013041b9
0x013041bd
0x013045db
0x013045db
0x00000000
0x013041c3
0x013041c3
0x013041ce
0x013041d4
0x0134e138
0x0134e13e
0x0134e169
0x0134e16d
0x0134e19e
0x0134e16f
0x0134e16f
0x0134e175
0x0134e179
0x0134e18f
0x0134e193
0x00000000
0x0134e199
0x00000000
0x0134e199
0x0134e193
0x00000000
0x00000000
0x00000000
0x013041da
0x013041da
0x013041df
0x013041e4
0x013041ec
0x01304203
0x01304207
0x0134e1fd
0x01304222
0x01304226
0x0134e1f3
0x0134e1f3
0x0130422c
0x0130422c
0x01304233
0x0134e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01304239
0x01304239
0x01304239
0x01304239
0x01304233
0x01304226
0x013041ee
0x013041ee
0x013041f4
0x01304575
0x0134e1b1
0x0134e1b1
0x00000000
0x0130457b
0x0130457b
0x01304582
0x0134e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x01304588
0x01304588
0x0130458c
0x0134e1c4
0x0134e1c4
0x00000000
0x01304592
0x01304592
0x01304599
0x0134e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0130459f
0x0130459f
0x013045a3
0x0134e1d7
0x0134e1e4
0x00000000
0x013045a9
0x013045a9
0x013045b0
0x0134e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x013045b6
0x013045b6
0x013045b6
0x00000000
0x013045b6
0x013045b0
0x013045a3
0x01304599
0x0130458c
0x01304582
0x00000000
0x00000000
0x00000000
0x00000000
0x013041f4
0x0130423e
0x01304241
0x013045c0
0x013045c4
0x00000000
0x013045ca
0x013045ca
0x00000000
0x0134e207
0x0134e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x013045d1
0x00000000
0x00000000
0x013045ca
0x00000000
0x01304247
0x01304247
0x01304247
0x01304249
0x01304249
0x01304249
0x01304251
0x01304251
0x01304257
0x0130425f
0x0130426e
0x01304270
0x0130427a
0x0134e219
0x0134e219
0x01304280
0x01304282
0x01304456
0x013045ea
0x00000000
0x013045f0
0x0134e223
0x00000000
0x0134e223
0x0130445c
0x0130445c
0x00000000
0x0130445c
0x00000000
0x01304288
0x0130428c
0x0134e298
0x01304292
0x01304292
0x0130429e
0x013042a3
0x013042a7
0x013042ac
0x0134e22d
0x013042b2
0x013042b2
0x013042b9
0x013042bc
0x013042c2
0x013042ca
0x013042cd
0x013042cd
0x013042d4
0x0130433f
0x0130433f
0x013042d6
0x013042d6
0x013042d9
0x013042dd
0x013042eb
0x0134e23a
0x013042f1
0x01304305
0x0130430d
0x01304315
0x01304318
0x0130431f
0x01304322
0x0130432e
0x0130433b
0x0130433b
0x00000000
0x0130432e
0x013042eb
0x0130434c
0x0130434e
0x01304352
0x01304359
0x0130435e
0x01304361
0x0130436e
0x0130438a
0x0130438e
0x01304396
0x0130439e
0x013043a1
0x013043ad
0x013043bb
0x013043bb
0x013043ad
0x0130436e
0x013043bf
0x013043c5
0x01304463
0x01304463
0x013043ce
0x013043d5
0x013043d9
0x013043df
0x01304475
0x01304479
0x01304491
0x01304491
0x01304479
0x013043e5
0x013043eb
0x013043f4
0x013043f6
0x013043f9
0x013043fc
0x013043ff
0x013044e8
0x013044ed
0x013044f3
0x0134e247
0x00000000
0x013044f9
0x01304504
0x01304508
0x0130450f
0x0134e269
0x00000000
0x01304515
0x01304519
0x01304531
0x01304534
0x01304537
0x0130453e
0x01304541
0x0130454a
0x0134e255
0x0134e255
0x0134e25b
0x0134e25e
0x0134e261
0x0134e261
0x01304555
0x01304559
0x0130455d
0x0134e26d
0x0134e270
0x0134e274
0x0134e27a
0x0134e27d
0x0134e28e
0x0134e28e
0x01304563
0x01304563
0x01304569
0x01304569
0x00000000
0x0130455d
0x0130450f
0x00000000
0x013044f3
0x013043ff
0x01304405
0x01304405
0x01304405
0x013042ac
0x0130428c
0x01304282
0x01304407
0x0130440d
0x0134e2af
0x0134e2af
0x01304413
0x01304413
0x00000000
0x013041d4
0x00000000
0x013041c3
0x013041bd
0x01304415
0x01304415
0x01304416
0x01304417
0x01304429
0x0130416e
0x0130416e
0x01304175
0x01304498
0x0130449f
0x0134e12d
0x00000000
0x0134e133
0x00000000
0x0134e133
0x013044a5
0x013044a5
0x013044aa
0x00000000
0x013044bb
0x013044ca
0x013044d6
0x013044d7
0x013044d8
0x013044e3
0x013044e3
0x013044aa
0x0130417b
0x0130417b
0x0130417b
0x00000000
0x0130417b
0x01304175
0x00000000

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52b98e153a3450486c8c5b9c19dd2f52fa43a0695a2e12e2b945cb84b468a90
Instruction ID: 914506dbd60f731848da9a4845d9aec8517d86594a31e0a2d05d417643df89b2
Opcode Fuzzy Hash: e52b98e153a3450486c8c5b9c19dd2f52fa43a0695a2e12e2b945cb84b468a90
Instruction Fuzzy Hash: 6CF18F70608211CFC726DF19C490A7AB7E5FF88718F05492EF686CB691E734EA91CB52

Uniqueness

Uniqueness Score: -1.00%

Function 012E52A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E012E52A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E012FEEF0(0x13d79a0);
					_t104 =  *0x13d8210; // 0xd32c38
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E012FEB70(_t93, 0x13d79a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E01329890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E012FEEF0(0x13d79a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E012FEB70(0, 0x13d79a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0xd32c45
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0131F0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E012FEEF0(0x13d79a0);
									__eflags =  *0x13d8210 - _t104; // 0xd32c38
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x13d8210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E01364888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E012FEB70(_t95, 0x13d79a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E013295D0();
											L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E013295D0();
											L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E012FEB70(_t93, 0x13d79a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E013295D0();
										L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E013295D0();
										L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0131F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x012e52a5
0x012e52ad
0x012e52b0
0x012e52b3
0x012e52b7
0x012e52ba
0x012e52bf
0x012e52c4
0x012e52cc
0x00000000
0x00000000
0x012e52ce
0x012e52d9
0x012e52dd
0x012e52e7
0x012e52f7
0x012e52f9
0x012e52fd
0x01340dcf
0x01340dd5
0x01340dd6
0x01340dd7
0x01340dd8
0x01340dd9
0x01340dde
0x01340ddf
0x01340de0
0x01340de1
0x01340de2
0x01340de5
0x01340dea
0x01340dec
0x01340f60
0x01340f64
0x01340f70
0x01340f76
0x01340f79
0x01340f79
0x00000000
0x01340f64
0x01340df2
0x01340df7
0x01340e04
0x01340e0d
0x01340e0d
0x01340e10
0x01340e1a
0x01340e1c
0x01340e4c
0x01340e52
0x01340e61
0x01340e67
0x01340e6b
0x01340e70
0x01340e76
0x01340ed7
0x01340edc
0x01340ee0
0x01340ee6
0x01340eea
0x01340eed
0x01340ef0
0x01340ef3
0x01340ef6
0x01340ef9
0x01340efe
0x01340f01
0x01340f01
0x01340f0b
0x01340f12
0x01340f16
0x01340f18
0x01340f1b
0x01340f2c
0x01340f31
0x01340f31
0x01340f35
0x01340f39
0x01340f3a
0x01340f3c
0x01340f3f
0x01340f50
0x01340f55
0x01340f55
0x01340f59
0x012e52eb
0x012e52f1
0x012e52f1
0x01340e7d
0x01340e84
0x01340e88
0x01340e8a
0x01340e8d
0x01340e9e
0x01340ea3
0x01340ea3
0x01340ea7
0x01340eaf
0x01340eb3
0x01340eb9
0x01340eb9
0x01340ebc
0x01340ecd
0x01340ecd
0x00000000
0x01340eb3
0x01340e21
0x01340e2b
0x01340e2f
0x01340e30
0x01340e3a
0x01340e3f
0x01340e41
0x00000000
0x00000000
0x01340e47
0x00000000
0x01340e47
0x01340df9
0x01340dfe
0x00000000
0x00000000
0x00000000
0x01340dfe
0x012e5303
0x012e5307
0x00000000
0x012e5309
0x00000000
0x012e5309
0x012e5307
0x012e52e9
0x012e52e9
0x00000000
0x012e52e9
0x012e530e
0x00000000

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1af06d0348872e922e0b83e43cdcb11349b7e6ad3179d5504ca6512094e17b
Instruction ID: 1552426ad6833692612968701b38d111221d590e21ca327859714effd5dd886e
Opcode Fuzzy Hash: cd1af06d0348872e922e0b83e43cdcb11349b7e6ad3179d5504ca6512094e17b
Instruction Fuzzy Hash: 0951DE71225742ABD322EF68C845B27BBE4FF50718F14092EF69587651E770F844CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012FEF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E012FEF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E012E9080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x779cc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E012E2D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x012fef4b
0x012fef4d
0x012fef57
0x012ff0bd
0x012ff0c2
0x012ff0d2
0x012ff0d2
0x012ff0c2
0x012fef5d
0x012fef5f
0x012fef67
0x012fef6a
0x012fef6d
0x012fef74
0x012fef7f
0x012fef82
0x012fef82
0x012fef86
0x012fef88
0x012fef8c
0x012fef8f
0x012fef8f
0x012fef8f
0x00000000
0x012fef91
0x012fef93
0x012fefc4
0x012fefc4
0x012fefc4
0x012fefca
0x012fefd0
0x012ff0a6
0x00000000
0x00000000
0x012ff0af
0x0134bb06
0x0134bb0a
0x012ff0b5
0x012ff0b5
0x012ff0b5
0x012ff0b5
0x00000000
0x012fefd6
0x012fefd9
0x012ff0de
0x012ff0e2
0x012fefdf
0x012fefdf
0x012fefdf
0x012fefe5
0x0134bafc
0x0134bafc
0x012fefe5
0x012fefeb
0x012fefed
0x012ff00f
0x012ff011
0x012ff01a
0x012ff01d
0x012ff021
0x012ff028
0x012ff029
0x012ff029
0x012ff02c
0x00000000
0x012ff02c
0x012feff3
0x012feff9
0x012ff0ea
0x012ff0ed
0x012ff0ef
0x00000000
0x012ff0ef
0x012ff003
0x0134bb12
0x012ff045
0x012ff049
0x012ff051
0x012ff09e
0x012ff0a0
0x012ff0a0
0x012ff09e
0x012ff053
0x012ff064
0x012ff064
0x012ff06b
0x0134bb1a
0x0134bb1a
0x012ff071
0x012ff071
0x012ff07d
0x012ff082
0x012ff08f
0x012ff08f
0x012ff009
0x012ff00d
0x00000000
0x012ff00d
0x012fefd0
0x012fef97
0x012fefa5
0x012fefaa
0x00000000
0x012fefac
0x012fefac
0x012fefac
0x00000000
0x012fefb2
0x012ff036
0x012ff03a
0x012ff040
0x012ff090
0x00000000
0x012ff092
0x012ff042
0x00000000
0x012ff042
0x012fefb7
0x012fefb9
0x012fefbc
0x012fefb0
0x012fefb0
0x00000000
0x012fefbe
0x012fefbe
0x012fefc1
0x00000000
0x012fefc1
0x012fefbc
0x012fefaa
0x012fef91

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 039302160dd2da7e8e69ae1ec4a3934684f2fa183e6e0cb3aaa0476e21c327c5
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 9951E331A2424A9FEB26CB6CC1917AEFBF1AF05314F1982BCC74593386C375A989C741

Uniqueness

Uniqueness Score: -1.00%

Function 013B740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E013B740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E0133D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E0132F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L01304620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L01304620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E0132F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L01304620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x013b740d
0x013b740d
0x013b7412
0x013b7413
0x013b7416
0x013b7418
0x013b741c
0x013b741f
0x013b7422
0x013b7422
0x013b7428
0x013b742a
0x013b742a
0x013b7451
0x013b7432
0x013b744f
0x013b744f
0x00000000
0x013b7434
0x013b7438
0x013b7443
0x013b7517
0x013b7517
0x013b751a
0x013b7535
0x013b7520
0x013b7527
0x013b752c
0x013b7531
0x013b7533
0x00000000
0x013b7533
0x00000000
0x013b7531
0x013b754b
0x013b754f
0x013b755c
0x013b755c
0x013b755f
0x013b7560
0x013b7561
0x013b7562
0x013b7563
0x013b7568
0x013b756a
0x013b756c
0x013b756d
0x013b756d
0x013b756f
0x013b7572
0x013b7574
0x013b7577
0x013b757c
0x013b757f
0x00000000
0x013b7551
0x013b7551
0x013b7551
0x013b7553
0x013b7553
0x013b7449
0x013b7449
0x013b744c
0x013b744c
0x00000000
0x013b744c
0x013b7443
0x013b750e
0x013b7514
0x013b7514
0x013b7455
0x013b7469
0x013b746d
0x00000000
0x013b7473
0x013b7473
0x013b7476
0x013b7480
0x013b7484
0x013b748e
0x013b7493
0x013b7493
0x013b7496
0x013b7499
0x013b74a1
0x013b74b1
0x013b74b5
0x00000000
0x013b74bb
0x013b74c1
0x013b74c1
0x013b74c4
0x013b74c5
0x013b74c6
0x013b74c7
0x013b74c8
0x013b74cd
0x00000000
0x013b74d3
0x013b74d3
0x013b74d6
0x013b74d8
0x013b74db
0x013b74dd
0x013b74e0
0x013b74e7
0x013b74ee
0x013b74ee
0x013b74f4
0x013b74f9
0x00000000
0x013b74fb
0x013b74fb
0x013b74fd
0x013b7500
0x013b7503
0x013b7505
0x013b7505
0x013b74f9
0x00000000
0x013b74cd
0x013b74b5
0x00000000

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 920a7e5b03ff32ce8ca858d3a972657929fa732799acca53264d587df9e8a621
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 8A51A171600646DFDB16CF18C980A95BBF9FF85308F14C1AAEA089F692E771E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01323D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01323D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E012F7B60(0, _t61, 0x12c11c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E012F7B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L01304620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x01323d4c
0x01323d50
0x01323d55
0x01323d5e
0x0135e79a
0x00000000
0x0135e79a
0x01323d68
0x0135e789
0x01323d9d
0x01323da3
0x01323daf
0x01323db5
0x01323dbc
0x01323dc4
0x01323dc9
0x01323dce
0x0135e7ae
0x0135e7ae
0x01323dde
0x01323de2
0x01323de7
0x01323e0d
0x01323e13
0x01323e16
0x01323e1e
0x01323e25
0x01323e28
0x00000000
0x00000000
0x01323e2a
0x01323e2f
0x01323e37
0x01323e37
0x00000000
0x01323e37
0x01323e31
0x00000000
0x01323e31
0x01323e20
0x01323e20
0x01323e35
0x00000000
0x01323de9
0x01323de9
0x01323de9
0x01323dee
0x01323dfd
0x01323dff
0x01323e02
0x01323e05
0x01323e05
0x00000000
0x01323df0
0x01323de7
0x0135e78f
0x0135e794
0x01323d79
0x01323d84
0x01323d89
0x01323d8e
0x00000000
0x0135e7a4
0x01323d96
0x01323d9a
0x00000000
0x01323d9a
0x00000000
0x0135e794
0x01323d6e
0x01323d73
0x00000000
0x0135e7b5
0x00000000

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9929707c152f866a8091416880a9de11fc73ab7f8b051dee1f6e06fc546b5ebf
Instruction ID: 72301a7abcc2b3d94fcf7e7a220b5066aa6e36ec748d3a9dda9d5a0ce61b8c56
Opcode Fuzzy Hash: 9929707c152f866a8091416880a9de11fc73ab7f8b051dee1f6e06fc546b5ebf
Instruction Fuzzy Hash: DF31DE32A05629DBD7259F2DC851A7ABBF8FF49B08B05807EE949CB750E738D840C791

Uniqueness

Uniqueness Score: -1.00%

Function 0130C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0130C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E01307D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E013B8D34(_v8, _t80);
					}
					E01302280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E012FFFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E013B8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E012FFFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E0132B180();
						if(_a4 != 0) {
							E01302280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0130BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0130BB2D(_t16, _t15);
						E0130B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E012FFFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E012FFFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E012FFFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x0130c18d
0x0130c18f
0x0130c191
0x0130c19b
0x0130c1a0
0x0130c1d4
0x0130c1de
0x01352d6e
0x0130c1e4
0x0130c1e4
0x0130c1e4
0x0130c1ec
0x01352d7d
0x01352d7d
0x0130c1f3
0x0130c1ff
0x01352d88
0x01352d8d
0x01352d94
0x01352d94
0x01352d9f
0x01352da4
0x01352dab
0x01352db0
0x01352db2
0x01352db3
0x01352db4
0x01352dbc
0x01352dc3
0x01352dc3
0x0130c205
0x0130c205
0x0130c208
0x0130c20e
0x0130c211
0x0130c216
0x0130c219
0x0130c21f
0x0130c222
0x0130c22c
0x0130c234
0x0130c23a
0x0130c23f
0x0130c245
0x0130c24b
0x0130c251
0x0130c25a
0x0130c276
0x0130c27d
0x0130c27d
0x0130c25c
0x0130c25c
0x00000000
0x0130c25e
0x0130c1a4
0x0130c1aa
0x0130c1b3
0x0130c265
0x0130c26c
0x0130c26c
0x00000000

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: bc408a5f13bd833589066d5360531d5145b6e96c8183f1d9e7a7cba2e977ceac
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 9A310B7260154BBFD706EBB8C4A0BEAF7D8BF52208F0442AAD51C57381DB346A45C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 01367016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E01367016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x13dd360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E01366B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E01366B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E01307D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E01329AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E0132B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L01304620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x01367016
0x0136701e
0x0136702b
0x01367033
0x01367037
0x0136703c
0x0136703e
0x01367041
0x01367045
0x0136704a
0x01367050
0x01367055
0x0136705a
0x01367062
0x01367062
0x0136705a
0x01367064
0x01367064
0x01367067
0x01367071
0x01367096
0x0136709b
0x013670a2
0x013670a6
0x013670a7
0x013670ad
0x013670b3
0x013670b6
0x013670bb
0x013670c3
0x013670c3
0x013670c6
0x013670cd
0x013670dd
0x013670e0
0x013670e2
0x013670e2
0x013670ee
0x01367101
0x013670f0
0x013670f9
0x013670f9
0x0136710a
0x0136710e
0x01367112
0x01367117
0x01367118
0x01367118
0x013670bb
0x0136711d
0x01367123
0x01367131
0x01367131
0x01367136
0x0136713d
0x0136713e
0x0136713f
0x0136714a
0x0136714a
0x01367084
0x01367088
0x00000000
0x0136708e
0x0136708e
0x01367092
0x00000000
0x01367092

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4adb3f5b1afb271727bae333b9201b7e7cf21d14d395539b2043b1bcc97fd92
Instruction ID: 25f0fe287f4d69b83d81997b9b56a89929f024af4d7f7d77664cba2c315249e4
Opcode Fuzzy Hash: d4adb3f5b1afb271727bae333b9201b7e7cf21d14d395539b2043b1bcc97fd92
Instruction Fuzzy Hash: C031C272604751DFC321DF2CC951A6AB7E9BF88708F048A29F99587694E730E904C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0131E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0131E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E01329670() < 0) {
					L0133DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x13d7b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L01304620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0131E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x0131e730
0x0131e736
0x0131e738
0x0131e73d
0x0131e73e
0x0131e740
0x0131e749
0x0131e765
0x0131e76a
0x0131e76b
0x0131e76c
0x0131e76d
0x0131e76e
0x0131e76f
0x0131e775
0x0131e777
0x0131e77e
0x0135b675
0x0131e784
0x0131e784
0x0131e789
0x0131e7a8
0x0131e7ac
0x0131e807
0x0131e7ae
0x0131e7ae
0x0131e7b1
0x0131e7b4
0x0131e7b9
0x0131e7c0
0x0131e7c4
0x0131e7ca
0x0131e7cc
0x00000000
0x0131e7d3
0x0131e7d6
0x00000000
0x00000000
0x0131e7ff
0x0131e802
0x00000000
0x00000000
0x0131e7f9
0x0131e7fc
0x00000000
0x00000000
0x0131e7f3
0x0131e7f6
0x00000000
0x00000000
0x0131e7ed
0x0131e7f0
0x00000000
0x00000000
0x0131e7e7
0x0131e7ea
0x00000000
0x00000000
0x0135b685
0x0135b688
0x00000000
0x00000000
0x0135b682
0x00000000
0x00000000
0x0131e7cc
0x0131e7d9
0x0131e7dc
0x0131e7de
0x0131e7de
0x0131e7ac
0x0131e7e4
0x0131e74b
0x0131e751
0x0131e759
0x0131e761
0x0131e761

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3be57a66e1b5cbc11efcf7baae9ffed1c3e08c5bbe6790e8e8e8e3eeb975fc
Instruction ID: f48ee886762e19bedb6786a441be26af7c0bf44276c475a005f14366cfa59c93
Opcode Fuzzy Hash: 4f3be57a66e1b5cbc11efcf7baae9ffed1c3e08c5bbe6790e8e8e8e3eeb975fc
Instruction Fuzzy Hash: 36315E75A14249AFE745CF58D841B96BBE8FB09318F148266FD04CB741D631E990CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0131BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0131BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x13d6100; // 0x5
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E01302280(0xd, 0x632f1a0);
				_t41 =  *0x13d60f8; // 0x0
				if(_t41 != 0) {
					 *0x13d60f8 =  *_t41;
					 *0x13d60fc =  *0x13d60fc + 0xffff;
				}
				E012FFFB0(_t41, 0x800, 0x632f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x13d60f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L01304620(0x13d6100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x13d6100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x0131bc36
0x0131bc42
0x0131bc45
0x0131bc4a
0x0131bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x0131bc50
0x0131bc50
0x0131bc58
0x0131bc5a
0x0131bc60
0x00000000
0x00000000
0x0135a4f2
0x0135a4f6
0x00000000
0x00000000
0x00000000
0x0135a4fc
0x0131bc79
0x0131bc7e
0x0131bc86
0x0131bd16
0x0131bd20
0x0131bd20
0x0131bc8d
0x0131bc94
0x0131bcbd
0x0131bcca
0x0131bccb
0x0131bccc
0x0131bccd
0x0131bcce
0x0131bcd4
0x0131bcea
0x0131bcee
0x0131bcf2
0x0131bd00
0x0131bd04
0x00000000
0x0131bc96
0x0131bcab
0x0131bcaf
0x0131bd2c
0x0131bd2c
0x0131bd09
0x00000000
0x0131bd09
0x0131bcb1
0x0131bcb5
0x0131bcbb
0x00000000
0x00000000
0x00000000
0x0131bcbb

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf31717c0aa3327eb40bdaff78170391d1a558cde35f7b1547906c94aef845f0
Instruction ID: 03e4002e74a642b4a17621694917d8e1e5ffd0131b85fdd8c88d53b67109596c
Opcode Fuzzy Hash: cf31717c0aa3327eb40bdaff78170391d1a558cde35f7b1547906c94aef845f0
Instruction Fuzzy Hash: 7A3122B66016069BCB16DF98E4817A6B7BCFF18318F440078ED54DB20DE734D905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012E9100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E012E9100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x13bf6e8);
				E0133D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E013B88F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E0133D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x13d86c0; // 0xd307b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x13d86b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E01302280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E013B88F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E0132AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x13db1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x13d84c0;
										if(_t69 >=  *0x13d84c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E013B9063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E012E922A(_t82);
							_t53 = E01307D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E013B8B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x13d86c0; // 0xd307b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x13d86b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x13d86bc;
										_t72 = 0x13d86b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E012E9240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x13d86c4;
									_t72 = 0x13d86c0;
									L18:
									E01319B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x012e9100
0x012e9100
0x012e9100
0x012e9100
0x012e9102
0x012e9107
0x012e910c
0x012e9110
0x012e9115
0x012e9136
0x012e9143
0x013437e4
0x013437e4
0x012e9149
0x012e914e
0x012e914e
0x012e9117
0x012e911d
0x00000000
0x00000000
0x012e911f
0x012e9125
0x00000000
0x012e9151
0x012e9158
0x012e915d
0x012e9161
0x012e9168
0x01343715
0x00000000
0x012e916e
0x012e916e
0x012e9175
0x012e9177
0x012e917e
0x012e917f
0x012e9182
0x012e9182
0x012e9187
0x012e9187
0x012e918a
0x012e918d
0x012e918f
0x012e9192
0x012e9195
0x012e9198
0x012e9198
0x012e9198
0x012e919a
0x00000000
0x00000000
0x0134371f
0x01343721
0x01343727
0x0134372f
0x01343733
0x01343735
0x01343738
0x0134373b
0x0134373d
0x01343740
0x00000000
0x00000000
0x01343746
0x01343749
0x00000000
0x00000000
0x0134374f
0x01343751
0x00000000
0x00000000
0x01343757
0x01343759
0x0134375c
0x0134375c
0x0134375e
0x0134375e
0x01343761
0x01343764
0x00000000
0x00000000
0x01343766
0x01343768
0x013437a3
0x013437a3
0x013437a5
0x013437a7
0x013437ad
0x013437b0
0x013437b2
0x013437bc
0x013437c2
0x013437c2
0x013437b2
0x012e9187
0x012e9187
0x012e918a
0x012e918d
0x012e918f
0x012e9192
0x012e9195
0x00000000
0x012e9195
0x00000000
0x012e9187
0x0134376a
0x0134376a
0x0134376c
0x0134376c
0x0134376f
0x01343775
0x00000000
0x00000000
0x01343777
0x01343779
0x00000000
0x00000000
0x01343782
0x01343787
0x01343789
0x01343790
0x01343790
0x0134378b
0x0134378b
0x0134378b
0x01343792
0x01343795
0x01343795
0x01343798
0x01343798
0x0134379b
0x0134379b
0x012e91a3
0x012e91a9
0x012e91b0
0x012e91b4
0x012e91b4
0x012e91bb
0x012e91c0
0x012e91c5
0x012e91c7
0x013437da
0x012e91cd
0x012e91cd
0x012e91cd
0x012e91d2
0x012e91d5
0x012e9239
0x012e9239
0x012e91d7
0x012e91db
0x012e91e1
0x012e91e7
0x012e91fd
0x012e9203
0x012e921e
0x012e9223
0x00000000
0x012e9223
0x012e9205
0x012e9208
0x012e920c
0x012e9214
0x012e9214
0x012e91e9
0x012e91e9
0x012e91ee
0x012e91f3
0x012e91f3
0x012e91f3
0x012e91e7
0x00000000
0x012e91db
0x012e9187
0x012e9168

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80044536dce3adeafe918c40e9ba3fef94d9212b88ccf161772bbaa9b6acb63
Instruction ID: 38555e62bc4033c5b82ea2c003c643d20f40c07c44446ab5c6a14fda9fcd4589
Opcode Fuzzy Hash: b80044536dce3adeafe918c40e9ba3fef94d9212b88ccf161772bbaa9b6acb63
Instruction Fuzzy Hash: 1C318D75A21246DFDF26DB6CC48CBACBBF1BB4936CF58818AC6046B241D370E980CB51

Uniqueness

Uniqueness Score: -1.00%

Function 013290AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E013290AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E0133D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0131E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L01304620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E0132F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0131A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x013290af
0x013290b8
0x013290bb
0x013290bf
0x013290c2
0x013290c2
0x013290c8
0x013290cb
0x013290cd
0x013614d7
0x013614eb
0x013614eb
0x00000000
0x013614eb
0x013614db
0x013614e6
0x00000000
0x013614f2
0x013614e8
0x00000000
0x013614e8
0x013290d8
0x013290da
0x013290dd
0x013290e5
0x00000000
0x01329139
0x013290fa
0x013290fe
0x01329142
0x00000000
0x01329142
0x01329104
0x01329107
0x0132910b
0x01329110
0x01329118
0x01329147
0x01329148
0x0132914f
0x01329150
0x01329151
0x01329152
0x01329156
0x0132915d
0x01329160
0x01329168
0x0132916c
0x013291bc
0x013291be
0x00000000
0x013291be
0x0132916e
0x01329173
0x01329176
0x00000000
0x00000000
0x0132917c
0x01329180
0x013291b5
0x00000000
0x013291b5
0x01329182
0x01329185
0x01329189
0x00000000
0x00000000
0x0132918e
0x01329190
0x01329198
0x00000000
0x00000000
0x013291a0
0x00000000
0x013291ad
0x013291ad
0x013291b0
0x013291b1
0x00000000
0x01329185
0x0132911a
0x0132911c
0x0132911f
0x01329125
0x01329127
0x00000000

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 933f11b2a93daba1af5ae273a6706b9ff60a3fd98e338da956900da3fed4f750
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 32218371A00229EFDB21EF59C844A6AFBFCEF54358F14846AE945A7200D330ED00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013B070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E013B070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E013B07DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E013AAFDE( &_v8,  &_v12);
					E013B1293(_t38, _v28, _t60);
					if(E01307D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E013A14FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x013b071b
0x013b0724
0x013b0734
0x013b0738
0x013b074b
0x013b074b
0x013b0753
0x013b0753
0x013b0759
0x013b075d
0x013b0774
0x013b0779
0x013b077d
0x013b0789
0x013b0795
0x013b07a7
0x013b0797
0x013b07a0
0x013b07a0
0x013b07af
0x013b07c4
0x013b07cd
0x013b07cd
0x013b07af
0x013b07dc

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: df7f8e3f59313cd7ea54b01e8b138c49acb6ffa4d8b92e82f6f4cb17eaa48a1e
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 0A213476204200AFD709DF1CC880BABBBB5EFD0354F048629FA949B781E730D909CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012E9240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E012E9240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x13bf708);
				E0133D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E013295D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E013295D0();
				_t33 =  *0x13d84c4; // 0x0
				L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x13d84c4; // 0x0
				L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x13d84c4; // 0x0
				E01302280(L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x13d86b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E013295D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E013295D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E012E9325();
					_t50 =  *0x13d84c4; // 0x0
					return E0133D0D1(L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x012e9240
0x012e9242
0x012e9247
0x012e924c
0x012e924e
0x012e9255
0x012e9257
0x012e925a
0x012e925f
0x012e925f
0x012e9266
0x012e9271
0x012e9276
0x012e9279
0x012e927e
0x012e9295
0x012e929a
0x012e92b1
0x012e92b6
0x012e92d7
0x012e92dc
0x012e92e0
0x012e92e6
0x012e92e8
0x012e92ee
0x012e9332
0x012e9333
0x012e9337
0x012e9338
0x012e933a
0x012e933a
0x012e933d
0x012e9342
0x012e9342
0x012e9345
0x012e9349
0x012e934e
0x012e9352
0x012e9357
0x012e92f4
0x012e92f4
0x012e92f6
0x012e92f9
0x012e9300
0x012e9306
0x012e9324
0x012e9324

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5d1b54a48fb94d19c153375290c3499f84f4f6b501705ecb467972e093fd5f4d
Instruction ID: 25b26a224a6f18c29dc45625aa5a375ea2791c520c6d3977ff8e5782f5732888
Opcode Fuzzy Hash: 5d1b54a48fb94d19c153375290c3499f84f4f6b501705ecb467972e093fd5f4d
Instruction Fuzzy Hash: 19218931051602DFC722EF68CA00F2AB7F9FF18708F5045ADE149966A2CB34E981CB44

Uniqueness

Uniqueness Score: -1.00%

Function 013646A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E013646A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L01304620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E0132F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0131D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L013077F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x013646b7
0x013646ba
0x013646c5
0x013646c8
0x013646d0
0x013646d4
0x013646e6
0x013646e9
0x013646f4
0x013646ff
0x01364705
0x01364706
0x0136470c
0x01364713
0x0136471b
0x01364723
0x01364725
0x013646d6
0x013646d9
0x013646db
0x013646db
0x01364732

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 2695aac47edddabeeddf759bb010cc5a17cfebb0a1eabdb58bf83a5c8b7ff5a4
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: DD11E572904208BBC7069F5CD8808BEB7BDEF95718F10806AF984C7351DA359D55D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 012E9080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E012E9080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x13d85ec;
				E01302280(_t48, 0x13d85ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E012FFFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x13d538c; // 0x77ad6828
					if( *_t84 != 0x13d5388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x13bf6e8);
						E0133D0E8(0x13d85ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E013B88F5(_t80, _t85, 0x13d5388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x13d86c0; // 0xd307b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x13d86b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E01302280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E013B88F5(0x13d85ec, _t85, 0x13d5388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E0132AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x13db1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x13d84c0;
																			if(_t82 >=  *0x13d84c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E013B9063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E012E922A(_t99);
										_t64 = E01307D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E013B8B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x13d86c0; // 0xd307b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x13d86b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x13d86bc;
													_t87 = 0x13d86b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E012E9240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x13d86c4;
												_t87 = 0x13d86c0;
												L27:
												E01319B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E0133D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x13d5388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x13d538c = _t51;
						goto L6;
					}
				}
			}

0x012e9082
0x012e9083
0x012e9084
0x012e9085
0x012e9087
0x012e9096
0x012e9098
0x012e9098
0x012e909e
0x012e90a8
0x012e90e7
0x012e90e7
0x012e90aa
0x012e90b0
0x012e90b7
0x012e90bd
0x012e90dd
0x012e90e6
0x012e90bf
0x012e90bf
0x012e90c7
0x012e90cf
0x012e90f1
0x012e90f2
0x012e90f4
0x012e90f5
0x012e90f6
0x012e90f7
0x012e90f8
0x012e90f9
0x012e90fa
0x012e90fb
0x012e90fc
0x012e90fd
0x012e90fe
0x012e90ff
0x012e9100
0x012e9102
0x012e9107
0x012e910c
0x012e9110
0x012e9113
0x012e9115
0x012e9136
0x012e913f
0x012e9143
0x013437e4
0x013437e4
0x012e9117
0x012e9117
0x012e911d
0x00000000
0x012e911f
0x012e911f
0x012e9125
0x00000000
0x012e9127
0x012e912d
0x012e9130
0x012e9134
0x012e9158
0x012e915d
0x012e9161
0x012e9168
0x01343715
0x012e916e
0x012e916e
0x012e9175
0x012e9177
0x012e917e
0x012e917f
0x012e9182
0x012e9182
0x012e9187
0x012e9187
0x012e918a
0x012e918d
0x012e918f
0x012e9192
0x012e9195
0x012e9198
0x012e9198
0x012e9198
0x012e919a
0x00000000
0x00000000
0x0134371f
0x01343721
0x01343727
0x0134372f
0x01343733
0x01343735
0x01343738
0x0134373b
0x0134373d
0x01343740
0x00000000
0x01343746
0x01343746
0x01343749
0x00000000
0x0134374f
0x0134374f
0x01343751
0x01343757
0x01343759
0x0134375c
0x0134375c
0x0134375e
0x0134375e
0x01343761
0x01343764
0x00000000
0x00000000
0x01343766
0x01343768
0x013437a3
0x013437a3
0x013437a5
0x013437a7
0x013437ad
0x013437b0
0x013437b2
0x013437bc
0x013437c2
0x013437c2
0x013437b2
0x012e9187
0x012e9187
0x012e918a
0x012e918d
0x012e918f
0x012e9192
0x012e9195
0x00000000
0x012e9195
0x00000000
0x0134376a
0x0134376a
0x0134376a
0x0134376c
0x0134376c
0x0134376f
0x01343775
0x00000000
0x00000000
0x01343777
0x01343779
0x01343782
0x01343787
0x01343789
0x01343790
0x01343790
0x0134378b
0x0134378b
0x0134378b
0x01343792
0x01343795
0x00000000
0x01343795
0x00000000
0x01343779
0x01343798
0x00000000
0x01343798
0x00000000
0x01343768
0x0134379b
0x0134379b
0x01343751
0x01343749
0x00000000
0x01343740
0x012e91a0
0x012e91a3
0x012e91a9
0x012e91b0
0x00000000
0x012e91b0
0x012e9187
0x012e91b4
0x012e91b4
0x012e91bb
0x012e91c0
0x012e91c5
0x012e91c7
0x013437da
0x012e91cd
0x012e91cd
0x012e91cd
0x012e91d2
0x012e91d5
0x012e9239
0x012e9239
0x012e91d7
0x012e91db
0x012e91e1
0x012e91e7
0x012e91fd
0x012e9203
0x012e921e
0x012e9223
0x00000000
0x012e9205
0x012e9205
0x012e9208
0x012e920c
0x012e9214
0x012e9214
0x012e920c
0x012e91e9
0x012e91e9
0x012e91ee
0x012e91f3
0x012e91f3
0x012e91f3
0x012e91e7
0x00000000
0x00000000
0x00000000
0x012e9134
0x012e9125
0x012e911d
0x012e914e
0x012e90d1
0x012e90d1
0x012e90d3
0x012e90d6
0x012e90d8
0x00000000
0x012e90d8
0x012e90cf

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4a86f1344e9854625aa3844ac917ec35233ec207073200fc618ac31f206f77
Instruction ID: 33298245128ff531eb6d6ee59472a7efb8897a10bca8c5cba17464b447b9e0f2
Opcode Fuzzy Hash: fe4a86f1344e9854625aa3844ac917ec35233ec207073200fc618ac31f206f77
Instruction Fuzzy Hash: 3401F4725212019FCB268F0CE844B12BFF9EF81328FA14067E6018B791C770DC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013A14FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E013A14FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x13dd360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0132FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E01307D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0132B640(E01329AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x013a14fb
0x013a14fb
0x013a150a
0x013a1514
0x013a1519
0x013a151b
0x013a1526
0x013a152c
0x013a1534
0x013a1537
0x013a153a
0x013a1545
0x013a1557
0x013a1547
0x013a1550
0x013a1550
0x013a1562
0x013a1563
0x013a1565
0x013a156a
0x013a157f

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a627eb96a127902903e8df9c7d417c0351ec7f7fd845407acfda7767c05ef21f
Instruction ID: bb4e55b41f6269851778b6a552ebb87288a481376f3f66b2bf1fcbed85e9af72
Opcode Fuzzy Hash: a627eb96a127902903e8df9c7d417c0351ec7f7fd845407acfda7767c05ef21f
Instruction Fuzzy Hash: 27019E71A01258AFDB10EFACD842EAEBBB8EF45714F404066F944EB280DA70DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 013A138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E013A138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x13dd360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0132FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E01307D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0132B640(E01329AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x013a138a
0x013a138a
0x013a1399
0x013a13a3
0x013a13a8
0x013a13aa
0x013a13b5
0x013a13bb
0x013a13c3
0x013a13c6
0x013a13c9
0x013a13d4
0x013a13e6
0x013a13d6
0x013a13df
0x013a13df
0x013a13f1
0x013a13f2
0x013a13f4
0x013a13f9
0x013a140e

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02dd121493378ca4459285f48ecd5c29667ca27b48bcf370f5f81a19adc1ec9f
Instruction ID: 858c3e0c224430508636a917d9eb2bad51dae6da80c5aa475866a6370db0952c
Opcode Fuzzy Hash: 02dd121493378ca4459285f48ecd5c29667ca27b48bcf370f5f81a19adc1ec9f
Instruction Fuzzy Hash: 17015E71A01219AFDB14EFA9D842FAEBBB8EF44714F404066F904EB280DA749A01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012FB02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012FB02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E01307D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E01367016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x012fb037
0x012fb039
0x012fb03b
0x012fb040
0x0134a60e
0x00000000
0x00000000
0x0134a61d
0x012fb04b
0x012fb04e
0x0134a627
0x0134a634
0x00000000
0x00000000
0x0134a641
0x0134a653
0x0134a643
0x0134a64c
0x0134a64c
0x0134a65b
0x00000000
0x00000000
0x00000000
0x0134a66c
0x012fb057
0x012fb057
0x012fb057
0x012fb046
0x012fb046
0x00000000

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 012b674a2841f9b26b7d28b0063febf7b9ceafa437be627b32296eb251274e24
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: AD018472254584DFE322C75CC944F66BBDCEB85754F0940B9FB19CBA51D768EC40C620

Uniqueness

Uniqueness Score: -1.00%

Function 013B1074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E013B1074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E013B165E(__ebx, 0x13d8ae4, (__edx -  *0x13d8b04 >> 0x14) + (__edx -  *0x13d8b04 >> 0x14), __edi, __ecx, (__edx -  *0x13d8b04 >> 0x14) + (__edx -  *0x13d8b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E013AAFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E01307D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E0139FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x013b1074
0x013b1080
0x013b1082
0x013b108a
0x013b108f
0x013b1093
0x013b10ab
0x013b10ab
0x013b10c3
0x013b10cf
0x013b10e1
0x013b10d1
0x013b10da
0x013b10da
0x013b10e9
0x013b10f5
0x013b10f5
0x013b10fe

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185290bd39d2e11995012bfd6a9c82cade1be2924686be9d00e4ba0a3130946b
Instruction ID: 0a5a989424e2d7320582bbe016c313a83603344befd3b8d365e08a712e201852
Opcode Fuzzy Hash: 185290bd39d2e11995012bfd6a9c82cade1be2924686be9d00e4ba0a3130946b
Instruction Fuzzy Hash: 1F014C736047469FC711DF2CD880B5B7BD9BB84318F048629FA8583A90EE30E444CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0139FE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0139FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x13dd360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0132FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E01307D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0132B640(E01329AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0139fe3f
0x0139fe3f
0x0139fe4e
0x0139fe58
0x0139fe5d
0x0139fe5f
0x0139fe6a
0x0139fe72
0x0139fe75
0x0139fe78
0x0139fe83
0x0139fe95
0x0139fe85
0x0139fe8e
0x0139fe8e
0x0139fea0
0x0139fea1
0x0139fea3
0x0139fea8
0x0139febd

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb376b79287f28094d2814dfcc632ea1ad580fe8a3aa7243c4d5ffb6e44af2f0
Instruction ID: 5027e96f206d2a73378fc8576600be2f20b0c529c12389942212241c5aa8d7d4
Opcode Fuzzy Hash: bb376b79287f28094d2814dfcc632ea1ad580fe8a3aa7243c4d5ffb6e44af2f0
Instruction Fuzzy Hash: 36018471E01219AFDB14EFA9D846FAEBBBCEF44B14F004066F904EB281DA709941C794

Uniqueness

Uniqueness Score: -1.00%

Function 0139FEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0139FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x13dd360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0132FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E01307D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0132B640(E01329AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0139fec0
0x0139fec0
0x0139fecf
0x0139fed9
0x0139fede
0x0139fee0
0x0139feeb
0x0139fef3
0x0139fef6
0x0139fef9
0x0139ff04
0x0139ff16
0x0139ff06
0x0139ff0f
0x0139ff0f
0x0139ff21
0x0139ff22
0x0139ff24
0x0139ff29
0x0139ff3e

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc66372fd0dfaa5685089e507ca8ddebde08d537f77130f3574e5ba3df37ba5
Instruction ID: 9b4ab06a8d0773a31051be63e0385ea36953de953f7b1dacccdbb76960e0ddf1
Opcode Fuzzy Hash: dfc66372fd0dfaa5685089e507ca8ddebde08d537f77130f3574e5ba3df37ba5
Instruction Fuzzy Hash: 61018471E01219AFDB14EBA9D846FAFBBBCEF45714F004066F901EB280DA709A01C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 013B8ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E013B8ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x13dd360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E01307D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E0132B640(E01329AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x013b8ed6
0x013b8ee5
0x013b8eed
0x013b8ef0
0x013b8efa
0x013b8f03
0x013b8f0c
0x013b8f15
0x013b8f24
0x013b8f27
0x013b8f31
0x013b8f43
0x013b8f33
0x013b8f3c
0x013b8f3c
0x013b8f4e
0x013b8f4f
0x013b8f51
0x013b8f56
0x013b8f69

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd53b4ea9d2cd147a1c06c97e236c7f1bb0aaaac3c85e81035d7b0aabc49f3a0
Instruction ID: c4c794ac5c5c0443ac9f491df0ad267f77f921227cf0b8ef940009895a9533ff
Opcode Fuzzy Hash: dd53b4ea9d2cd147a1c06c97e236c7f1bb0aaaac3c85e81035d7b0aabc49f3a0
Instruction Fuzzy Hash: 8A111E70E042199FDB04DFA8D441BAEFBF4FF08304F0442AAE918EB781E6349940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012EB1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012EB1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E01307D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E01307D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E01367016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x012eb1e8
0x012eb1ea
0x012eb1f3
0x01344a17
0x012eb1f9
0x012eb1f9
0x012eb1f9
0x012eb201
0x01344a21
0x01344a2e
0x00000000
0x00000000
0x01344a3b
0x01344a4d
0x01344a3d
0x01344a46
0x01344a46
0x01344a55
0x00000000
0x00000000
0x00000000
0x012eb20a
0x012eb20a
0x012eb20a
0x012eb20a

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 6bb837e6b34eb50e4d70272f0bd69acb84eb478b3f7f9d4173776e1137422917
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 9301A432210684ABE723975DC808F69BFD9EF51758F0940B1FB148B6B2D679E800C325

Uniqueness

Uniqueness Score: -1.00%

Function 0137FE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0137FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x13dd360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E01307D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0132B640(E01329AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x0137fe96
0x0137fe9e
0x0137fea1
0x0137fead
0x0137feb3
0x0137feb9
0x0137fec3
0x0137fed5
0x0137fec5
0x0137fece
0x0137fece
0x0137fee0
0x0137fee1
0x0137fee3
0x0137fee8
0x0137fefb

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d4418f4de7826e36b7491f4dae460e3dc497ef850a126ccb4a47eed99ccebd
Instruction ID: 2bb216054d13e0e9e1d4f59a0cea68d382235d77e50b8160faef8b0715fae993
Opcode Fuzzy Hash: 09d4418f4de7826e36b7491f4dae460e3dc497ef850a126ccb4a47eed99ccebd
Instruction Fuzzy Hash: 81016270A0021DAFCB14DFA8D542A6EB7F4FF04704F104569E958EB382DA35E901CB80

Uniqueness

Uniqueness Score: -1.00%

Function 013A131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E013A131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x13dd360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E01307D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0132B640(E01329AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x013a131b
0x013a132a
0x013a1330
0x013a1336
0x013a133e
0x013a1341
0x013a1344
0x013a134f
0x013a1361
0x013a1351
0x013a135a
0x013a135a
0x013a136c
0x013a136d
0x013a136f
0x013a1374
0x013a1387

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa8cfd7e8c555477596b1622e517a74d51ca10c682afdb5fdb969f8d423a01e
Instruction ID: bdca104801f3deb0e47b460e45122c125a05c93724e9706363b4024f37eb499c
Opcode Fuzzy Hash: 0fa8cfd7e8c555477596b1622e517a74d51ca10c682afdb5fdb969f8d423a01e
Instruction Fuzzy Hash: 1D013C71A0121DAFCB54EFA9D545AAEB7F4FF18704F404069F955EB381EA34AA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 013B8F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E013B8F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x13dd360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E01307D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E0132B640(E01329AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x013b8f6a
0x013b8f79
0x013b8f81
0x013b8f84
0x013b8f8b
0x013b8f91
0x013b8f94
0x013b8f9e
0x013b8fb0
0x013b8fa0
0x013b8fa9
0x013b8fa9
0x013b8fbb
0x013b8fbc
0x013b8fbe
0x013b8fc3
0x013b8fd6

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fe51661b8b2943acaf9a4c64fb9cfca8aea30bc4c69d751393d48efe8efa90
Instruction ID: 622302e522795a3be512a424665d8e0138d50a22aae245d30fd19ec6267b678e
Opcode Fuzzy Hash: 54fe51661b8b2943acaf9a4c64fb9cfca8aea30bc4c69d751393d48efe8efa90
Instruction Fuzzy Hash: 88014474A0121DAFDB10EFACD545AAEB7F8EF18304F104059FA45EB380EA34DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0130C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0130C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0130C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x12c11cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E013B88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x0130c577
0x0130c57d
0x0130c581
0x0130c5b5
0x0130c5b9
0x0130c5ce
0x0130c5ce
0x0130c5ca
0x00000000
0x0130c5ca
0x0130c5c4
0x0130c5c8
0x00000000
0x00000000
0x00000000
0x0130c5ad
0x00000000
0x0130c5af

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bdead6bba4b21188d39eac551a44ddac4ad5cacde68244595ed6c2cb4eeff3
Instruction ID: b76a18e707cb093eb9aef27ced727e3a688357aa4270a5d296b99cabcc7595b0
Opcode Fuzzy Hash: 19bdead6bba4b21188d39eac551a44ddac4ad5cacde68244595ed6c2cb4eeff3
Instruction Fuzzy Hash: 17F024BA811694CFE733C31EC064B227FD89B0463CF4467E7D505835C2E2A6CC80C240

Uniqueness

Uniqueness Score: -1.00%

Function 013B8D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E013B8D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x13dd360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E01307D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E0132B640(E01329AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x013b8d34
0x013b8d43
0x013b8d4b
0x013b8d4e
0x013b8d52
0x013b8d5c
0x013b8d6e
0x013b8d5e
0x013b8d67
0x013b8d67
0x013b8d79
0x013b8d7a
0x013b8d7c
0x013b8d81
0x013b8d94

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8e9972d0931d30ac1be6b9eec55ccff676450952df9407482aa7126c10c710
Instruction ID: 6e4df2bb9863792bda955446fa1050ceba0f79c8969804517d17c0683859e5cd
Opcode Fuzzy Hash: 7e8e9972d0931d30ac1be6b9eec55ccff676450952df9407482aa7126c10c710
Instruction Fuzzy Hash: FEF05470E4461D9FDB14EFB8D545BAEB7B8EF14704F508099E905EB291EA34D900C754

Uniqueness

Uniqueness Score: -1.00%

Function 013A2073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E013A2073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E0139FD22(__ecx);
				_t19 =  *0x13d849c - _t3; // 0x531b895e
				if(_t19 == 0) {
					__eflags = _t17 -  *0x13d8748; // 0x0
					if(__eflags <= 0) {
						E013A1C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x13d8724 & 0x00000004;
							if(( *0x13d8724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x13d8724; // 0x0
					return E01398DF1(__ebx, 0xc0000374, 0x13d5890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x013a2076
0x013a2078
0x013a207d
0x013a2083
0x013a20a4
0x013a20aa
0x013a20ac
0x013a20b7
0x013a20ba
0x013a20bc
0x013a20c9
0x013a20c9
0x013a20d0
0x013a20d2
0x00000000
0x013a20d2
0x013a20be
0x013a20c3
0x013a20c5
0x013a20c7
0x00000000
0x00000000
0x013a20c7
0x013a20bc
0x013a20d4
0x013a2085
0x013a2085
0x013a20a3
0x013a20a3

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa42bc4e8c11d2119ce6e6f35d79d634cb8a0793af724cf0fd13d57f43727c9
Instruction ID: f36a0f8b6c423cbc435badb65a70bfc212aff3124f17e9e7fcbd1db63eb4f403
Opcode Fuzzy Hash: daa42bc4e8c11d2119ce6e6f35d79d634cb8a0793af724cf0fd13d57f43727c9
Instruction Fuzzy Hash: DBF0E56B5661C54ADF33EB3C75117E33F9AD79631CF8A04C5D89057209C5349993CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0130746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0130746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E012FEB70(__ecx, 0x13d79a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E013295D0();
							L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x0130746d
0x0130746d
0x0130746d
0x01307471
0x01307488
0x0134f92d
0x0130748e
0x01307491
0x01307495
0x0134f937
0x0134f93a
0x0134f94e
0x0134f953
0x0134f956
0x0134f956
0x01307495
0x00000000
0x01307488
0x01307473
0x01307478
0x0130747d
0x01307481
0x00000000
0x01307481
0x0130747d
0x0130747a
0x00000000

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef287d3a58edc4506d68404e4e9c074efcd5d8abc92582d846d99123521daca
Instruction ID: 394b297ccd4ac0132637869efa28f394686b353db8ff007eff03ae32f99bdc2e
Opcode Fuzzy Hash: cef287d3a58edc4506d68404e4e9c074efcd5d8abc92582d846d99123521daca
Instruction Fuzzy Hash: 1DF0BE35A00149ABDF039B6CC860BBABFE5AF0425CF0A4219D9D1BB5E1E724B801C795

Uniqueness

Uniqueness Score: -1.00%

Function 013B8CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E013B8CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x13dd360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E01307D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0132B640(E01329AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x013b8ce5
0x013b8ced
0x013b8cf0
0x013b8cfb
0x013b8d0d
0x013b8cfd
0x013b8d06
0x013b8d06
0x013b8d18
0x013b8d19
0x013b8d1b
0x013b8d20
0x013b8d33

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7480240dfc71487ae19c381eb718b71ee4550cbcf56ba84accd98ae82701bb
Instruction ID: 0f2acd1ede6271721d76dcaa0d7bcd10500c3463be089a76cdd8ee1947f0bb0e
Opcode Fuzzy Hash: bf7480240dfc71487ae19c381eb718b71ee4550cbcf56ba84accd98ae82701bb
Instruction Fuzzy Hash: 3DF08270A05219AFDB14EBACE956EAE77B8EF19308F10019AE915EB2C0EA34D900C754

Uniqueness

Uniqueness Score: -1.00%

Function 012E4F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012E4F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E013B88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0130C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x12c1030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x012e4f2e
0x012e4f34
0x012e4f38
0x01340b85
0x01340b85
0x01340b89
0x01340b9a
0x01340b9a
0x01340b9f
0x00000000
0x01340b9f
0x01340b94
0x01340b98
0x00000000
0x00000000
0x00000000
0x01340b98
0x012e4f3e
0x012e4f48
0x00000000
0x012e4f6e
0x00000000
0x012e4f70

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbccf6418fe4084f1c2f0e9df0bde444a59d422456fe8109d6b950338378888f
Instruction ID: 29ef52ffe9d763f1ddf4206d124fc9915fbc02ced911f54c71774a7993085231
Opcode Fuzzy Hash: fbccf6418fe4084f1c2f0e9df0bde444a59d422456fe8109d6b950338378888f
Instruction Fuzzy Hash: 0CF0E232625684CFD776EB1CC184BA2BBD8AB00B7CF4495A4E60587922C724FC40C648

Uniqueness

Uniqueness Score: -1.00%

Function 013B8B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E013B8B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x13dd360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E01307D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0132B640(E01329AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x013b8b67
0x013b8b6f
0x013b8b72
0x013b8b7d
0x013b8b8f
0x013b8b7f
0x013b8b88
0x013b8b88
0x013b8b9a
0x013b8b9b
0x013b8b9d
0x013b8ba2
0x013b8bb5

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c45686461a5238ac4a59b98095bd136883a3ffecddcc6aa482f0016e8efdbc
Instruction ID: f11e96ffeb403ca6e06b20ce7959c1fc23096731d788e1013d342cea3ec099ad
Opcode Fuzzy Hash: 44c45686461a5238ac4a59b98095bd136883a3ffecddcc6aa482f0016e8efdbc
Instruction Fuzzy Hash: 91F082B0A04259AFDB14EBB8D946E6EB7B8EF04308F040499FA05DB3C0FA34D900C794

Uniqueness

Uniqueness Score: -1.00%

Function 0131A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0131A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x13d67e4 >= 0xa) {
					if(_t5 < 0x13d6800 || _t5 >= 0x13d6900) {
						return L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E01300010(0x13d67e0, _t5);
				}
			}

0x0131a190
0x0131a1a6
0x0131a1c2
0x00000000
0x00000000
0x00000000
0x0131a192
0x0131a192
0x0131a19f
0x0131a19f

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7041728d7997f3dd0630381e4b49a25521c307fc61bb346368b21d2ca0be0e3
Instruction ID: 2a2b9e28c94c97d6c39bf616da5708513a26956b9d6d2c512f3dc0be66d83a00
Opcode Fuzzy Hash: a7041728d7997f3dd0630381e4b49a25521c307fc61bb346368b21d2ca0be0e3
Instruction Fuzzy Hash: 63D02BE213208016C72E5304A826B253652F7807ADF34041CF2134B5D9E96088E88108

Uniqueness

Uniqueness Score: -1.00%

Function 013116E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E013116E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E01311710(0x13d67e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L01304620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x013116e8
0x013116ef
0x013116f3
0x013116fe
0x00000000
0x01311700
0x0131170d
0x0131170d
0x013116f2
0x013116f2
0x013116f2
0x013116f2

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373bbeb899863200bfe69fe57c864ee9cd9f96805b71b29cf38cb2ec2b4997d0
Instruction ID: b84deb6860febcaf9dbddc4c6f17dffbd5563f98819d958575d6886becb2f12c
Opcode Fuzzy Hash: 373bbeb899863200bfe69fe57c864ee9cd9f96805b71b29cf38cb2ec2b4997d0
Instruction Fuzzy Hash: 68D0A77120010292EA2E5B289C24B542651EB907ADF38045CF707494C1DFA5CD92E048

Uniqueness

Uniqueness Score: -1.00%

Function 004162D8, Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E004162D8(void* __eax, void* __ebx, void* __edi) {

				asm("adc ch, 0xf2");
				asm("in al, dx");
				return __eax;
			}

0x004162d8
0x004162db
0x004162e9

Memory Dump Source

Source File: 00000008.00000002.377252491.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f7ee4129b219d780a7f29c02d1384c8785545306423045d1cd47dcaed5bdbf
Instruction ID: 28485b8db0a364d3884d05fbe65f2987727daf1d86d050aa4545ea1b2a90e561
Opcode Fuzzy Hash: 82f7ee4129b219d780a7f29c02d1384c8785545306423045d1cd47dcaed5bdbf
Instruction Fuzzy Hash: F3B09223B9842444041008DE38222F0E3A5D1970769A023B2DE28E3680004688190088

Uniqueness

Uniqueness Score: -1.00%

Function 013135A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E013135A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E012FEB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x013135a1
0x013135a1
0x013135a5
0x013135ab
0x013135ab
0x013135b5
0x00000000
0x013135c1
0x013135b7

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 6db9f24b751c28fff6117f53eb658a4d840ea4c7cc36b9b0ec8342e000b12a1e
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 51D02231411189DEEB0AEB18C21877C7BB3FF00A3CF5C2069C1020686EC33A4A0EC700

Uniqueness

Uniqueness Score: -1.00%

Function 012EAD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E012EAD30(intOrPtr _a4) {

				return L013077F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x012ead49

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: b471c99382d42564a95f4c874a5b086c28c12d1b6bc3608f3607cbfdd65e2463
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 35C08C32080248BBC7126A49CD00F117B69E7A0BA0F000020B6040A6A2C932E861D588

Uniqueness

Uniqueness Score: -1.00%

Function 013136CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E013136CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L01304620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x013136d2
0x013136e8
0x013136d4
0x013136e5
0x013136e5

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: ec6bf6e63a35b51222220ed943fa95231744408dc4fd97cb9ad0ce37e6289695
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 31C02B70151840FBD71A5F34CE50F147294F700A35F6407647320454F0E52C9C00D100

Uniqueness

Uniqueness Score: -1.00%

Function 01307D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01307D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x01307d56
0x01307d5b
0x01307d60
0x01307d5d
0x01307d5d
0x01307d5d

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: f296e9381450ea0216576000eeed2a695633abd4844f62fcf431b3ed29cf2bdf
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: A9B092353019408FCE17DF18C090B1533E4BB44A84B8400D0E400CBA21D229E9008900

Uniqueness

Uniqueness Score: -1.00%

Function 0132AD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9fc3148b9b98d1061ae1df177ff182412632dab943a8fb4cc1f856206c73f3
Instruction ID: a1e2b9bb5f4d38fb832b427a8b7724ef69a24f359ba52393d55d4cb9a8f852b3
Opcode Fuzzy Hash: cc9fc3148b9b98d1061ae1df177ff182412632dab943a8fb4cc1f856206c73f3
Instruction Fuzzy Hash: CE900275A1500012D540719948146464006B7E0786B95C021A0504555CC9948A6963E5

Uniqueness

Uniqueness Score: -1.00%

Function 01329520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db97765f7f9cc164524035c006af21ddae6c879ba59036c94d45b0f96fb627b
Instruction ID: 31fd23e4b2c0eb05e9a59d53eadc6109042f08486d43dbab74a8be3420cd2b1e
Opcode Fuzzy Hash: 6db97765f7f9cc164524035c006af21ddae6c879ba59036c94d45b0f96fb627b
Instruction Fuzzy Hash: 5B9002E5211140928900A2998404B0A4505A7E0246B91C026E1044561CC5658865A179

Uniqueness

Uniqueness Score: -1.00%

Function 01329560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c932086a7d4b0754acf74c35f8b36fbe8273a6271d0a64a74c4bbd024e8d3603
Instruction ID: 44d151736453577d11aa2a7638663ab01621cbfbec817908f9fc4a392f4bedb4
Opcode Fuzzy Hash: c932086a7d4b0754acf74c35f8b36fbe8273a6271d0a64a74c4bbd024e8d3603
Instruction Fuzzy Hash: 0F900269231000024545A599060450B0445B7D63963D1C025F1406591CC66188796365

Uniqueness

Uniqueness Score: -1.00%

Function 01329950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3535d546259a2dc770382ec4fc543671d8c21dc26e9fd7b4669a3a7dd6d14f0e
Instruction ID: d7401caef395305b89a5a1b2f99badd5a484cd9c23ea6e9ef5225f87d6cf400c
Opcode Fuzzy Hash: 3535d546259a2dc770382ec4fc543671d8c21dc26e9fd7b4669a3a7dd6d14f0e
Instruction Fuzzy Hash: D99002A521140403D540659948046070005A7D0347F91C021A2054556ECA698C657179

Uniqueness

Uniqueness Score: -1.00%

Function 013295F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9bbca9ecbeb03df385ff0a9a4501d51a61f8d5ae8f14a8ae99988cb407a4585
Instruction ID: 3ab2a28adab40edac3344a985a4b27c3e355883e26796e7e47f82d967c86667c
Opcode Fuzzy Hash: d9bbca9ecbeb03df385ff0a9a4501d51a61f8d5ae8f14a8ae99988cb407a4585
Instruction Fuzzy Hash: 9690027521100802D504619948046860005A7D0346F91C021A6014656ED6A588A57175

Uniqueness

Uniqueness Score: -1.00%

Function 013299D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e878e6d9b018e3ff0afb2a837546fed04d9d4e33423d29f133ed4c9f53908aa8
Instruction ID: 82854ea92685fc5329bfec17ecd1e00071de7a0a5db65394d44e8cfdc64a7f92
Opcode Fuzzy Hash: e878e6d9b018e3ff0afb2a837546fed04d9d4e33423d29f133ed4c9f53908aa8
Instruction Fuzzy Hash: 3C9002A522100042D504619944047060045A7E1246F91C022A2144555CC5698C756169

Uniqueness

Uniqueness Score: -1.00%

Function 01329820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e07925ed85acfcfb8c2f08bad538dacbb8ce58ec96aec330588dc91f9f5e0a8
Instruction ID: e7905942402744c824e1deaa893e296f63644a070eddeeabcbff6977cfd864ff
Opcode Fuzzy Hash: 1e07925ed85acfcfb8c2f08bad538dacbb8ce58ec96aec330588dc91f9f5e0a8
Instruction Fuzzy Hash: DB90027525100402D541719944046060009B7D0286FD1C022A0414555EC6958A6ABAA5

Uniqueness

Uniqueness Score: -1.00%

Function 0132B040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47be5d6008360c9cc3b0090559128df1b66777640a73f4eca225159ca931a329
Instruction ID: ae57d3d96746d16a5c3636fc22f29bad94182e1e76b0ab77bca212691dd7bd45
Opcode Fuzzy Hash: 47be5d6008360c9cc3b0090559128df1b66777640a73f4eca225159ca931a329
Instruction Fuzzy Hash: 4A9002A5611140438940B19948044065015B7E13463D1C131A0444561CC6A88869A2A9

Uniqueness

Uniqueness Score: -1.00%

Function 013298A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520194c0d3d6365d035694aeaa400e18c4db0ddb406506c3efc0e5836033c44f
Instruction ID: c9d494e2b46cec4d90913e4434fc3fb64e31eef630190611812e54ebd96eaf1a
Opcode Fuzzy Hash: 520194c0d3d6365d035694aeaa400e18c4db0ddb406506c3efc0e5836033c44f
Instruction Fuzzy Hash: 1990026531100402D502619944146060009E7D138AFD1C022E1414556DC6658967B176

Uniqueness

Uniqueness Score: -1.00%

Function 01329730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa25b6b15cf37c2fad291b7a1b0593966b430e10eb212cec0cb59f0bbfb7943
Instruction ID: c7c245b7a624ea9e154f169b028a5906fd682fd77307f216ac28fd6970f7315b
Opcode Fuzzy Hash: 6aa25b6b15cf37c2fad291b7a1b0593966b430e10eb212cec0cb59f0bbfb7943
Instruction Fuzzy Hash: 9690026561500402D540719954187060015A7D0246F91D021A0014555DC6998A6976E5

Uniqueness

Uniqueness Score: -1.00%

Function 0132A710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed47a45737c47da560f1b7134dcaf15a1ca38add6b9334e0b78bf7f870a5e0e8
Instruction ID: 1efce501b98c4c0efb3757c44b4c76b4a1b9e51bf6d497f732e09bb34aca9a72
Opcode Fuzzy Hash: ed47a45737c47da560f1b7134dcaf15a1ca38add6b9334e0b78bf7f870a5e0e8
Instruction Fuzzy Hash: DC90027531100052D900A6D95804A4A4105A7F0346B91D025A4004555CC59488756165

Uniqueness

Uniqueness Score: -1.00%

Function 01329B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70949cdc578eba2e71bef15c8b052eb7b06277bf9c9d540e64a6c0d3d3269f7b
Instruction ID: 03f23a30ac9681ea9519c1b0ae644b75ba7371eccff1f5bf2342856040946ca9
Opcode Fuzzy Hash: 70949cdc578eba2e71bef15c8b052eb7b06277bf9c9d540e64a6c0d3d3269f7b
Instruction Fuzzy Hash: 1C90026525100802D540719984147070006E7D0646F91C021A0014555DC656897976F5

Uniqueness

Uniqueness Score: -1.00%

Function 01329770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee4e948002f8f451b82e1238bf6dd24a0cba59e6670d4ba19497d03208d27ce
Instruction ID: 74de34940bc498336829ab5c4331dfed81bfde0c4e93beacd9be714e10c7231f
Opcode Fuzzy Hash: 1ee4e948002f8f451b82e1238bf6dd24a0cba59e6670d4ba19497d03208d27ce
Instruction Fuzzy Hash: 5790026521504442D50065995408A060005A7D024AF91D021A1054596DC6758865B175

Uniqueness

Uniqueness Score: -1.00%

Function 0132A770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0195c0527d1da9f7c5f5ec4d17b2597542e7cd7d097b8527745309217ff73530
Instruction ID: e68345c1ed10d5ae4c82ba8a38afcb5db0c95d31fe7323b760358746c5dcaa40
Opcode Fuzzy Hash: 0195c0527d1da9f7c5f5ec4d17b2597542e7cd7d097b8527745309217ff73530
Instruction Fuzzy Hash: 2290027921504442D90065995804A870005A7D034AF91D421A041459DDC6948875B165

Uniqueness

Uniqueness Score: -1.00%

Function 01329760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee09c932602b83caa5d5414624eaa21d22255c12241004c65b6140e7c2b61fdc
Instruction ID: 8ddd61ddc03fe26af7cec5ca02eee35ce25d8cf0c87b905e73de0c9bcd69e879
Opcode Fuzzy Hash: ee09c932602b83caa5d5414624eaa21d22255c12241004c65b6140e7c2b61fdc
Instruction Fuzzy Hash: 0290027521100403D500619955087070005A7D0246F91D421A0414559DD69688657165

Uniqueness

Uniqueness Score: -1.00%

Function 0132A3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fbb34db03acc84edfa041b9e45992fcbdb7d7d6d6853b8078413182afb9c81
Instruction ID: d1d808db274fd138c32fac279d392350b75efe96cf8abb1ad23247def6b64d19
Opcode Fuzzy Hash: 38fbb34db03acc84edfa041b9e45992fcbdb7d7d6d6853b8078413182afb9c81
Instruction Fuzzy Hash: 2390027521144002D5407199844460B5005B7E0346F91C421E0415555CC655886AA265

Uniqueness

Uniqueness Score: -1.00%

Function 01329A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be57f174e30033c24bad527380e24104b816612b446288145050d8419647f45
Instruction ID: e2098ed416aad08158a0720f8053ebb8aa5023ac90c3b56f6f7961636e833012
Opcode Fuzzy Hash: 8be57f174e30033c24bad527380e24104b816612b446288145050d8419647f45
Instruction Fuzzy Hash: 1A90027521140402D500619948087470005A7D0347F91C021A5154556EC6A5C8A57575

Uniqueness

Uniqueness Score: -1.00%

Function 01329610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04b5dffca00bff5105971dbcac8a1086b71face95f0df432c1c8ebf3702db15
Instruction ID: d0ca403cc8aafabbe71acfd019aebda1f4b33ba82dfbce3efe652600844e6659
Opcode Fuzzy Hash: b04b5dffca00bff5105971dbcac8a1086b71face95f0df432c1c8ebf3702db15
Instruction Fuzzy Hash: 1390027561500802D550719944147460005A7D0346F91C021A0014655DC7958A6976E5

Uniqueness

Uniqueness Score: -1.00%

Function 01329650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd89974400d7ee4be6723d1b9313c6b261a05d3d24d4f455044c97733c425163
Instruction ID: eef32acd636c1a88be0346bdc7e3eaeef52570fd67d05910a6591fe58a81eb34
Opcode Fuzzy Hash: fd89974400d7ee4be6723d1b9313c6b261a05d3d24d4f455044c97733c425163
Instruction Fuzzy Hash: 0290027521504842D54071994404A460015A7D034AF91C021A0054695DD6658D69B6A5

Uniqueness

Uniqueness Score: -1.00%

Function 01329A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d12cb6c9d5f352590524281315a2e48acce4c00350cb194d7bb89c9420d6be0
Instruction ID: 88a299f2c242164220aaeae33868b8095b3793a4904e3f2224c1ebb8b614a9bb
Opcode Fuzzy Hash: 1d12cb6c9d5f352590524281315a2e48acce4c00350cb194d7bb89c9420d6be0
Instruction Fuzzy Hash: 4A90026521144442D54062994804B0F4105A7E1247FD1C029A4146555CC95588696765

Uniqueness

Uniqueness Score: -1.00%

Function 013296D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d27bf6ca6a726c51cc12efbc71fc708cfc90bf4eb57a350c53791f41a98ff3
Instruction ID: 65b39182719b61536f94ae461e61f18aa969198ea0f856cd5d77e810ed49120c
Opcode Fuzzy Hash: 00d27bf6ca6a726c51cc12efbc71fc708cfc90bf4eb57a350c53791f41a98ff3
Instruction Fuzzy Hash: A190027521100842D50061994404B460005A7E0346F91C026A0114655DC655C8657565

Uniqueness

Uniqueness Score: -1.00%

Function 01329670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 0fdbf9c0ffafe6d95b1cd2c9cfbf7f013bd92a05c93e225781ce300f494b31dc
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0137FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0137FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0132CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E01375720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E01375720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0137fdda
0x0137fde2
0x0137fde5
0x0137fdec
0x0137fdfa
0x0137fdff
0x0137fe0a
0x0137fe0f
0x0137fe17
0x0137fe1e
0x0137fe19
0x0137fe19
0x0137fe19
0x0137fe20
0x0137fe21
0x0137fe22
0x0137fe25
0x0137fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0137FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0137FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0137FE2B

Memory Dump Source

Source File: 00000008.00000002.378058116.00000000012C0000.00000040.00000001.sdmp, Offset: 012C0000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 704ebaa0b135f025891f91bb521a30fd713c176600800318c88a88b9469a8bfd
Instruction ID: c8eb4b7cbd70e4e5268160496b04673c246bc40d0dc08e18a1398f350cd12715
Opcode Fuzzy Hash: 704ebaa0b135f025891f91bb521a30fd713c176600800318c88a88b9469a8bfd
Instruction Fuzzy Hash: BEF0F632200641BFE6341A59DC02F23BF6EEB44B34F240314F628565D1EA62F82097F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exe PID: 5076 Parent PID: 3472 explorer.exeCOMMON

Executed Functions

Function 033A81D0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,033A3BA7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,033A3BA7,007A002E,00000000,00000060,00000000,00000000), ref: 033A821D

Strings

.z`, xrefs: 033A820D, 033A8218

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 1bad4228b1e22c66b7c3988d4202402b2659ff5de12f8b0c06b81d9249f56bf6
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 6FF0BDB2201208ABCB08CF88DC84EEB77ADAF8C754F158248BA0D97240C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 033A81CD, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,033A3BA7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,033A3BA7,007A002E,00000000,00000060,00000000,00000000), ref: 033A821D

Strings

.z`, xrefs: 033A820D, 033A8218

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 335798988628a601fe2fe68b1e6752fff10f69a0d69e688ce1dad58b249d6c19
Instruction ID: fb8b14aa802438dc72160fc6a4e50ac4fbc7a1011c8538c7c6a859af9ea679d6
Opcode Fuzzy Hash: 335798988628a601fe2fe68b1e6752fff10f69a0d69e688ce1dad58b249d6c19
Instruction Fuzzy Hash: FCF0B2B2605508AFCB08CF88DC95EEB37A9AF8C754F158248BA0DD7240D630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033A82FA, Relevance: 1.5, APIs: 1, Instructions: 42nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(033A3D40,?,?,033A3D40,00000000,FFFFFFFF), ref: 033A8325

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 795a423464bfdde17ba19a54f54535ad533a06cc657dff85fbfbea5493a393c0
Instruction ID: 1192b29528984c259ee1ec7c06aea5b37649f4c3e0cdafb2a8e289d948010062
Opcode Fuzzy Hash: 795a423464bfdde17ba19a54f54535ad533a06cc657dff85fbfbea5493a393c0
Instruction Fuzzy Hash: 14F06D76600314BBD720EF98CC85EA77B6CEF88660F014599FA1C9F282C630FA0087E0

Uniqueness

Uniqueness Score: -1.00%

Function 033A8280, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(033A3D62,5E972F59,FFFFFFFF,033A3A21,?,?,033A3D62,?,033A3A21,FFFFFFFF,5E972F59,033A3D62,?,00000000), ref: 033A82C5

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: e7900f1a5f90189d0eb0a7b2196b312b77028adb48856fcf5c2f9840dc8673fe
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 04F0A4B6200208ABCB14DF89DC80EEB77ADEF8C754F158248BA1D97241D630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 033A83AA, Relevance: 1.5, APIs: 1, Instructions: 31memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,03392D11,00002000,00003000,00000004), ref: 033A83E9

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: bb73c3b3b2e68f5e0504fbe36701a003556ccd13b024d34a2fd06f4f0f523005
Instruction ID: feaef9fb85657dee4d07867d091aa4342433ac61fc6eb05d17116b6a4aeba9ef
Opcode Fuzzy Hash: bb73c3b3b2e68f5e0504fbe36701a003556ccd13b024d34a2fd06f4f0f523005
Instruction Fuzzy Hash: A5F01CB6601108AFDB18DF89DC85EEBB7ADEF88354F118649FE1997640C630E911CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033A83B0, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,03392D11,00002000,00003000,00000004), ref: 033A83E9

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 32c6963e6c0f8158498d3c34a4fa1deb61fcc74ef74ef8c8d446c05a2e2ad1fc
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 3EF015B6200208ABCB14DF89CC80EAB77ADEF88654F118248BE089B241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033A8300, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(033A3D40,?,?,033A3D40,00000000,FFFFFFFF), ref: 033A8325

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: d0c099412b0943ec8a05c7a713cf3c1c932cfc3a25f1dafb008c90764c8ff931
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: B7D01776600318ABD710EF98CC85EA77BACEF88660F154599BA189B242C570FA0087E0

Uniqueness

Uniqueness Score: -1.00%

Function 05619540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0561954A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bfd380eb9858c0e50afca4973cfd25afc6e85f5fe0f609ebb4254d326379b069
Instruction ID: 49370a9a4b31a596bcc7e1f391ae197db4e37a0d9d750671df6864c875c0d18e
Opcode Fuzzy Hash: bfd380eb9858c0e50afca4973cfd25afc6e85f5fe0f609ebb4254d326379b069
Instruction Fuzzy Hash: 92900265311410030105A9590745507006A97D53A13A1C021F5045650CD6618862A561

Uniqueness

Uniqueness Score: -1.00%

Function 05619910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0561991A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: caa6376f44992085985196ef8b4db39685fbec42e14debca904c4cc4f411f693
Instruction ID: 0fffbbdd76b7252e0ed9b070b467ee699bda3fcdf67641656513298ea3bd14eb
Opcode Fuzzy Hash: caa6376f44992085985196ef8b4db39685fbec42e14debca904c4cc4f411f693
Instruction Fuzzy Hash: CA9002B130141402D14075594445746002997D0351FA1C011A9094654E86998DD6BAA5

Uniqueness

Uniqueness Score: -1.00%

Function 056195D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 056195DA

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2c8868832d19aaf8762509520e9e4bb8f4ff0aed71ec90902c8ddb3307aafec3
Instruction ID: b5c97b0b39e0d046772a53ec0510533fced9f3cf873854aaaace2fdeead37fae
Opcode Fuzzy Hash: 2c8868832d19aaf8762509520e9e4bb8f4ff0aed71ec90902c8ddb3307aafec3
Instruction Fuzzy Hash: 589002A130241003410575594455616402E97E0251BA1C021E5044690DC5658892B565

Uniqueness

Uniqueness Score: -1.00%

Function 056199A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 056199AA

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5966144279589ceecf27cf3ec14b5e99430b06701bb4d041c0f253360710f05a
Instruction ID: 3271ac32ee64253c033de09840fd2bffc4db8617842e3b8aac2f7b2d6ce2dc08
Opcode Fuzzy Hash: 5966144279589ceecf27cf3ec14b5e99430b06701bb4d041c0f253360710f05a
Instruction Fuzzy Hash: 9D9002A134141442D10065594455B060029D7E1351FA1C015E5094654D8659CC53B566

Uniqueness

Uniqueness Score: -1.00%

Function 05619860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0561986A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 192c96c5ad413fccc737b9942acda8e109edf08578a264715ee606918b899aa9
Instruction ID: bfd706ebf7b69e66231e613ca869e509cdbe79b5c02aca0eadab1313e9487732
Opcode Fuzzy Hash: 192c96c5ad413fccc737b9942acda8e109edf08578a264715ee606918b899aa9
Instruction Fuzzy Hash: 3190027130141413D11165594545707002D97D0291FE1C412A4454658D96968953F561

Uniqueness

Uniqueness Score: -1.00%

Function 05619840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0561984A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2065be78db3ad9a4e095ebffad330f22b03385d34a3d7e6a81d03d7acaa9c414
Instruction ID: e6447d90e9d812321edd8bdfd9bf77c576fc406336c6c77af0ed60e978df95e5
Opcode Fuzzy Hash: 2065be78db3ad9a4e095ebffad330f22b03385d34a3d7e6a81d03d7acaa9c414
Instruction Fuzzy Hash: 1B900261342451525545B5594445507402AA7E02917E1C012A5444A50C85669857EA61

Uniqueness

Uniqueness Score: -1.00%

Function 05619710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0561971A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e42ed2302aa78f6df89f129b603536e9c518a5c8a5a1e26a877eafd4e1d83abf
Instruction ID: 429fc586bf91acd0c5606261e1a7d0f83c5892a533da11706a25063320e6a9a5
Opcode Fuzzy Hash: e42ed2302aa78f6df89f129b603536e9c518a5c8a5a1e26a877eafd4e1d83abf
Instruction Fuzzy Hash: FA90027130141402D10069995449646002997E0351FA1D011A9054655EC6A58892B571

Uniqueness

Uniqueness Score: -1.00%

Function 05619FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05619FEA

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7726e7bf928056a6b38edd9dc5c2e2c6fb4b5db917524534f94054bdd8eb3291
Instruction ID: a9761b8e7abb6fe9ea4ba66d62177cdfc1885100b80cd720aec8901f446727af
Opcode Fuzzy Hash: 7726e7bf928056a6b38edd9dc5c2e2c6fb4b5db917524534f94054bdd8eb3291
Instruction Fuzzy Hash: E690027131155402D11065598445706002997D1251FA1C411A4854658D86D58892B562

Uniqueness

Uniqueness Score: -1.00%

Function 05619780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0561978A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: eae11ea959500c7ca346bc6a813b3bd60b2991bea53f96a5fa5c8406d69113ed
Instruction ID: b46ffd7f887fef4919089f6d58f8effe3d4af1ba70e0671a2ea7f7213ac583a8
Opcode Fuzzy Hash: eae11ea959500c7ca346bc6a813b3bd60b2991bea53f96a5fa5c8406d69113ed
Instruction Fuzzy Hash: 6890026931341002D1807559544960A002997D1252FE1D415A4045658CC955886AA761

Uniqueness

Uniqueness Score: -1.00%

Function 05619660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0561966A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 80830d5fb76a287093d1eae0311ed993f84e2f05226add12d6cf3dfb7b327e66
Instruction ID: c593176b297f1d3ecc230d001386737ab2d7412329492d1db3a7d97eb6ce2a93
Opcode Fuzzy Hash: 80830d5fb76a287093d1eae0311ed993f84e2f05226add12d6cf3dfb7b327e66
Instruction Fuzzy Hash: CD90027130141802D1807559444564A002997D1351FE1C015A4055754DCA558A5ABBE1

Uniqueness

Uniqueness Score: -1.00%

Function 05619A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05619A5A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b972c8f172bf4d97970147e82e3546199fee4c651a975b6e79d3bdf88ea7d7e0
Instruction ID: d4765c12262ec97c06e1c36c5e784c016e4f9791e730043b34db69370543b2f3
Opcode Fuzzy Hash: b972c8f172bf4d97970147e82e3546199fee4c651a975b6e79d3bdf88ea7d7e0
Instruction Fuzzy Hash: 7B900261311C1042D20069694C55B07002997D0353FA1C115A4184654CC9558862A961

Uniqueness

Uniqueness Score: -1.00%

Function 05619650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0561965A

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3f7476b59d53f78a18ba79414680500fdb4e65c055e5da88c0c8ae1a37c48043
Instruction ID: c609791d374934c3d63fcfbf99fdb81f2908af42b0070b10268ff7eefe7e436a
Opcode Fuzzy Hash: 3f7476b59d53f78a18ba79414680500fdb4e65c055e5da88c0c8ae1a37c48043
Instruction Fuzzy Hash: 1090027130545842D14075594445A46003997D0355FA1C011A4094794D96658D56FAA1

Uniqueness

Uniqueness Score: -1.00%

Function 056196E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 056196EA

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8386d823f28d5a582e5aa4cd990f10cd0b792d3073de82cf88a01ddaa9175d0c
Instruction ID: f216a389ebc6855071cb1eaeb3fe914e51d7e2461d6d60734c79010cf0e69f1d
Opcode Fuzzy Hash: 8386d823f28d5a582e5aa4cd990f10cd0b792d3073de82cf88a01ddaa9175d0c
Instruction Fuzzy Hash: 3F90027130149802D1106559844574A002997D0351FA5C411A8454758D86D58892B561

Uniqueness

Uniqueness Score: -1.00%

Function 056196D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 056196DA

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a5b45b660fbe7c6ddc49ddde30a77f3553233a3aba5337230092c68059b4e1c1
Instruction ID: dde298ae09feb89e7f6f699918b58a0e86f3f7c19ee86f9c3dd33b0aaf674cf3
Opcode Fuzzy Hash: a5b45b660fbe7c6ddc49ddde30a77f3553233a3aba5337230092c68059b4e1c1
Instruction Fuzzy Hash: 0590027130141842D10065594445B46002997E0351FA1C016A4154754D8655C852B961

Uniqueness

Uniqueness Score: -1.00%

Function 033A6EF0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 033A6F98

Strings

net.dll, xrefs: 033A6F61, 033A6FE7, 033A6FBF, 033A6FCB, 033A6FF3
wininet.dll, xrefs: 033A6F4E, 033A6F57

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 1e32fdd0ce2ab61163a3fbac29b198ac1e1d3b676b06e78fcd68b48c8f556a16
Instruction ID: 26910d778e262118d2385ac43ce0aa32f6bb6a0820b851b4fd51a82fac82c645
Opcode Fuzzy Hash: 1e32fdd0ce2ab61163a3fbac29b198ac1e1d3b676b06e78fcd68b48c8f556a16
Instruction Fuzzy Hash: 7B315CB6601B04ABD715DFA8C8E1FA7B7B8EB88700F04851DB61A6B240D774A545CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 033A6EE7, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 83sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 033A6F98

Strings

net.dll, xrefs: 033A6F61, 033A6FBF, 033A6FCB
wininet.dll, xrefs: 033A6F4E, 033A6F57

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: bbd9a1d6a73d4757bac04a39c00ff5028aed7994467b75e943cd4820b8c8d169
Instruction ID: 2e87c6a5c6af2bda4bbdc6cff880435c0b9dc102b24185988ac8d7a7a6dc004b
Opcode Fuzzy Hash: bbd9a1d6a73d4757bac04a39c00ff5028aed7994467b75e943cd4820b8c8d169
Instruction Fuzzy Hash: 3A31BFB6901B04ABD711DFA8CCE1F6BB7B8EB88700F08812DF6196B241D374A545CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 033A7013, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0339CCE0,?,?), ref: 033A705C

Strings

net.dll, xrefs: 033A6FBF, 033A6FCB

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID: net.dll
API String ID: 2422867632-2431746569
Opcode ID: ed31e5e8e467276c89dfbab021750ba200186b8f4a301e302dea6c7f43c07f30
Instruction ID: 97104ebb3baadac23ed5f797273175038111d3b47d77205dff5e1f2150caffca
Opcode Fuzzy Hash: ed31e5e8e467276c89dfbab021750ba200186b8f4a301e302dea6c7f43c07f30
Instruction Fuzzy Hash: 4211E576201B047AC321DA6CDCE2FA7B7ACEF85710F48011DF65A6B280D6B1F40587E1

Uniqueness

Uniqueness Score: -1.00%

Function 033A8512, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,03393B93), ref: 033A850D

Strings

.z`, xrefs: 033A84FC, 033A8508

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 890cd71a1a427ad87af43f862400b71f0c0793819465d7d876b8032b74a51042
Instruction ID: 13918753133d65859144351876551c2a61da64c8a8cf2f53652f40bc67f6bcda
Opcode Fuzzy Hash: 890cd71a1a427ad87af43f862400b71f0c0793819465d7d876b8032b74a51042
Instruction Fuzzy Hash: 9AF08CB2600205ABCB14DFA8CC85EE77B7DAF95254F114598F8499B602C631E804CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 033A84D2, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,03393B93), ref: 033A850D

Strings

.z`, xrefs: 033A84FC, 033A8508

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 00560e60dfbd1a3be1c73e9aadc3ddcf9cf81af96e468d86e6088e91fb42cdef
Instruction ID: 5dc9c9ad14a972586096a152554ec87faa1483fa53c97df1a46f866fac9c6ae5
Opcode Fuzzy Hash: 00560e60dfbd1a3be1c73e9aadc3ddcf9cf81af96e468d86e6088e91fb42cdef
Instruction Fuzzy Hash: 15E0ED75600604AFCB24CF69CC84EEB3B6CEF84304F004158F9089B302C630E801CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033A84E0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,03393B93), ref: 033A850D

Strings

.z`, xrefs: 033A84FC, 033A8508

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 06818acc78ca61187b746d4e2f1e8f65d00e40fc2b55c0995bd8e9155b66bbcb
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 6BE01AB5600208ABD714DF59CC44EA777ACEF88650F014554B9085B241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 03397270, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 033972CA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 033972EB

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 09350f0977cb4fff66594aa475f7d372e44b91cfdea5af49cc09773f218eb5b3
Instruction ID: 267ede5bcca54926e8a953c064fdae913baeb6e5c9e665df657b6d5f43c1c041
Opcode Fuzzy Hash: 09350f0977cb4fff66594aa475f7d372e44b91cfdea5af49cc09773f218eb5b3
Instruction Fuzzy Hash: 8C018F36E90328B7FB20E6948C82FBEB76C9F04B51F150119FF04BE1C0E6946A0686E5

Uniqueness

Uniqueness Score: -1.00%

Function 033A8631, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0339CFB2,0339CFB2,?,00000000,?,?), ref: 033A8670

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 4d607f7e2c424d612413577cde7ddc3fa664c034cc954a3daaf237ce006c53fa
Instruction ID: 8f637347e258b00e00d091edf8dbdb2199973251a44e7e63156d43035a316398
Opcode Fuzzy Hash: 4d607f7e2c424d612413577cde7ddc3fa664c034cc954a3daaf237ce006c53fa
Instruction Fuzzy Hash: 6EF0A9B6A00308ABDA14EF58DC84EEB3BA9EF89254F158459FA489B241C531E91187F0

Uniqueness

Uniqueness Score: -1.00%

Function 033A8550, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 033A85A4

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: b29168a376981adb53af7238a9e3184116dcaf07e1f34291761570e330a1970c
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 7401AFB2210208ABCB54DF89DC80EEB77ADAF8C754F158258BA0D97240C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 033A854D, Relevance: 1.5, APIs: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 033A85A4

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 3494cf2dde0149106e2608ae2870ee538cc30cbd7cd917729b7fa53cd91d60b5
Instruction ID: e328a9b16d59136ed7b43341a1afad0929765176011596ecb8c766c65c1bbfbc
Opcode Fuzzy Hash: 3494cf2dde0149106e2608ae2870ee538cc30cbd7cd917729b7fa53cd91d60b5
Instruction Fuzzy Hash: BE01ABB2601108BFCB58DF89DC80EEB77ADAF8C354F158249FA0DA7250C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 033A85A9, Relevance: 1.5, APIs: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 033A85A4

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 0c5b38709d2b64afdb15ebffaaa2fde4eb641dbfce7596dfe7b7f43f91556a6c
Instruction ID: 5abeffa0492004861ff4960f354bf93b85cf17f9e6dca8eab2a95eda74a4d344
Opcode Fuzzy Hash: 0c5b38709d2b64afdb15ebffaaa2fde4eb641dbfce7596dfe7b7f43f91556a6c
Instruction Fuzzy Hash: 47F0F9B52442097BD714DF99DC84EAB77ACEF88660F048559F9199B241C930A9148BB0

Uniqueness

Uniqueness Score: -1.00%

Function 033A7020, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,0339CCE0,?,?), ref: 033A705C

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 095b0b520be20d85b9640018a1fec647bbd965483516bedb257205f626dfced0
Instruction ID: 136aa5e2a117012e20c8f3a0e6df7e10afa5cd1f3172ff2d7ed279dbf6572aa8
Opcode Fuzzy Hash: 095b0b520be20d85b9640018a1fec647bbd965483516bedb257205f626dfced0
Instruction Fuzzy Hash: 1AE092777807043AE330A59DAC42FA7B79CDB91B30F550026FB0DEB2C0D595F80142A4

Uniqueness

Uniqueness Score: -1.00%

Function 033A8640, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0339CFB2,0339CFB2,?,00000000,?,?), ref: 033A8670

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 8e109fe34f846939fa346075f2870117b61aef946f36c5a43a415b40635a63ff
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 2AE01AB5600208ABDB10DF49CC84EE737ADEF88650F018154BA085B241C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 033A84A0, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(033A3526,?,033A3C9F,033A3C9F,?,033A3526,?,?,?,?,?,00000000,00000000,?), ref: 033A84CD

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: f2c3a0edab2066eab4a6a35d04ab3312e7fe5732acc01febf44be8baa208900d
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 4FE046B6600308ABDB14EF99CC80EA777ACEF88654F118558FE085B241C630F910CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0339D451, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,03397C73,?), ref: 0339D44B

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6fdc500a2d98a3d6606a2adffefe56b1c7bcd87acd7b9ad423bd9a718fdddfef
Instruction ID: dc039dc6a5eea9a972c3b43ff379794be8b8be7c4fbdf5decbdfd45b1766cabf
Opcode Fuzzy Hash: 6fdc500a2d98a3d6606a2adffefe56b1c7bcd87acd7b9ad423bd9a718fdddfef
Instruction Fuzzy Hash: F2D02287A1060A80B800EBFCEC02A2BC6068A949D0B858972E948D8703EE02C0830022

Uniqueness

Uniqueness Score: -1.00%

Function 0339D420, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,03397C73,?), ref: 0339D44B

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction ID: f55b41ef00b719068ccdc893ca92c9b17a564baa268c6e2bc01798a1f39ecfff
Opcode Fuzzy Hash: 49ec7ea19b45082ce71059444928ac468c46794dc6bfedb52c16374b2d1231c4
Instruction Fuzzy Hash: 93D05E667503046AEA10FAA89C43F26B2C89B54A10F494064F9489A2C3D954E4004161

Uniqueness

Uniqueness Score: -1.00%

Function 0339D424, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,03397C73,?), ref: 0339D44B

Memory Dump Source

Source File: 0000000A.00000002.497338116.0000000003390000.00000040.00000001.sdmp, Offset: 03390000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b88236c9f23931ce690ca6e34adc5dacd998571976cd8df0623987e31d550955
Instruction ID: 28f94e63393d5d27844a42ee747b4904bf309ecb881592438892055b917ad922
Opcode Fuzzy Hash: b88236c9f23931ce690ca6e34adc5dacd998571976cd8df0623987e31d550955
Instruction Fuzzy Hash: 5ED0A79566834425FB10FBB41C43F07A6440B11650F0945A4A44CEE0C3D848C0540136

Uniqueness

Uniqueness Score: -1.00%

Function 0561967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05619694

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa778de5255b58f2e839ac8d86b2fa1cbd8d20ae1b17df7c683f951481673ebb
Instruction ID: 889c1aec14fedcfb5bb755ce55d25d20ad1074652b012eddb995784b3406ea2e
Opcode Fuzzy Hash: aa778de5255b58f2e839ac8d86b2fa1cbd8d20ae1b17df7c683f951481673ebb
Instruction Fuzzy Hash: 63B02B719014C0C5E600D7600608B37391077C0300F26C011D2020380A0338C0C1F5F5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0566FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0566FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0561CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E05665720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E05665720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0566fdda
0x0566fde2
0x0566fde5
0x0566fdec
0x0566fdfa
0x0566fdff
0x0566fe0a
0x0566fe0f
0x0566fe17
0x0566fe1e
0x0566fe19
0x0566fe19
0x0566fe19
0x0566fe20
0x0566fe21
0x0566fe22
0x0566fe25
0x0566fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0566FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0566FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0566FE2B

Memory Dump Source

Source File: 0000000A.00000002.500707422.00000000055B0000.00000040.00000001.sdmp, Offset: 055B0000, based on PE: true

Associated: 0000000A.00000002.501366258.00000000056CB000.00000040.00000001.sdmp Download File
Associated: 0000000A.00000002.501377974.00000000056CF000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: a820293f7fd28763cd8f9c59e9c3e13a18dd3a913ece0245a9d74bc7439a877c
Instruction ID: 551b40fefbbd823a0c318a3d35e851f668e0cf27ecdf88ea5ad889a209003d0d
Opcode Fuzzy Hash: a820293f7fd28763cd8f9c59e9c3e13a18dd3a913ece0245a9d74bc7439a877c
Instruction Fuzzy Hash: 2DF0F036240601BFEA201A85DC06F23BF6AEB44730F240318F668565E1EA62F830D6F9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PI-0387991.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers