Play interactive tour

Edit tour

Windows Analysis Report pug6mtV48A.exe

Overview

General Information

Sample Name:	pug6mtV48A.exe
Analysis ID:	491388
MD5:	74da6faf84783587dd82552dfa63eb00
SHA1:	276512acad7ec63916653862778438c169a3b890
SHA256:	584b5b4a74cb945f3be3ff0a4017d8ce2b073d6a98bfceb7bc59cb0f3fe7c3ee
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for domain / URL

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Modifies the prolog of user mode functions (user mode inline hooks)

Self deletion via cmd delete

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

pug6mtV48A.exe (PID: 6664 cmdline: 'C:\Users\user\Desktop\pug6mtV48A.exe' MD5: 74DA6FAF84783587DD82552DFA63EB00)

pug6mtV48A.exe (PID: 6980 cmdline: C:\Users\user\Desktop\pug6mtV48A.exe MD5: 74DA6FAF84783587DD82552DFA63EB00)

explorer.exe (PID: 3440 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

netsh.exe (PID: 6864 cmdline: C:\Windows\SysWOW64\netsh.exe MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

cmd.exe (PID: 3012 cmdline: /c del 'C:\Users\user\Desktop\pug6mtV48A.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.odysseysailingsantorini.com/cmsr/"], "decoy": ["dahlia-dolls.com", "iamawife.com", "gardunomx.com", "roweelitetrucking.com", "asapvk.com", "strategieslimited.com", "healthyweathorganics.com", "wedding-gallery.net", "fastoffer.online", "biolab33.cloud", "los40delocta.com", "charliepaton.com", "jenpaddock.com", "zzmweb.com", "poetarts.com", "techwork4u.com", "tracylynpropp.com", "rkbodyfit.site", "migaleriapanama.com", "cosmostco.com", "johnsoncamping.com", "flowfinancialplanning.com", "xn--caamosdemexico-rnb.com", "plusqueindia.com", "wwwhyprr.com", "benimofis.com", "tandteutopia.com", "spaintravelvacation.com", "dear.services", "zhiwugongfang.com", "blogdavnc.com", "justicefundingexchange.com", "alphasecreweb.info", "xitechgroup.com", "kendalmountain.digital", "nieght.com", "pieter-janenmaaike.online", "myexclusiveshop.com", "love-potato.online", "mondebestglobal.com", "ranchlandconcierge.com", "southerngraphx.com", "pray4usa.info", "vilchesfinancial.com", "zelvio.store", "zenibusiness.com", "kindredhue.com", "californiatacosdinuba.com", "uncommonsolutionsllc.com", "easy-lah.com", "disciplesevents.com", "856380127.xyz", "zapzapgone.com", "paradisgrp.com", "programmerworks.info", "purchasesuite.com", "dorotajedrusik.com", "555999dy.com", "uvoyus.com", "utang.net", "elizabethhelma.com", "noseainsight.com", "simpleterior.com", "casatensina.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.394206876.0000000002805000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x2675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x28ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x13dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x931a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x53f9:$sqlite3step: 68 34 1C 7B E1 0x550c:$sqlite3step: 68 34 1C 7B E1 0x5428:$sqlite3text: 68 38 2A 90 C5 0x554d:$sqlite3text: 68 38 2A 90 C5 0x543b:$sqlite3blob: 68 53 D8 7F 8C 0x5563:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x2675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x28ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x13dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x931a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x53f9:$sqlite3step: 68 34 1C 7B E1 0x550c:$sqlite3step: 68 34 1C 7B E1 0x5428:$sqlite3text: 68 38 2A 90 C5 0x554d:$sqlite3text: 68 38 2A 90 C5 0x543b:$sqlite3blob: 68 53 D8 7F 8C 0x5563:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x63a78:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x63ce2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1ad388:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1ad5f2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x6f805:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1b9115:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x6f2f1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1b8c01:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x6f907:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1b9217:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x6fa7f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x1b938f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x646fa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1ae00a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x6e56c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1b7e7c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x653f3:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1aed03:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x754a7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bedb7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x764aa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x72589:$sqlite3step: 68 34 1C 7B E1 0x7269c:$sqlite3step: 68 34 1C 7B E1 0x1bbe99:$sqlite3step: 68 34 1C 7B E1 0x1bbfac:$sqlite3step: 68 34 1C 7B E1 0x725b8:$sqlite3text: 68 38 2A 90 C5 0x726dd:$sqlite3text: 68 38 2A 90 C5 0x1bbec8:$sqlite3text: 68 38 2A 90 C5 0x1bbfed:$sqlite3text: 68 38 2A 90 C5 0x725cb:$sqlite3blob: 68 53 D8 7F 8C 0x726f3:$sqlite3blob: 68 53 D8 7F 8C 0x1bbedb:$sqlite3blob: 68 53 D8 7F 8C 0x1bc003:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: pug6mtV48A.exe PID: 6664	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.pug6mtV48A.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.pug6mtV48A.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15675:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15161:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15777:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa56a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb263:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b317:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c31a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.pug6mtV48A.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x183f9:$sqlite3step: 68 34 1C 7B E1 0x1850c:$sqlite3step: 68 34 1C 7B E1 0x18428:$sqlite3text: 68 38 2A 90 C5 0x1854d:$sqlite3text: 68 38 2A 90 C5 0x1843b:$sqlite3blob: 68 53 D8 7F 8C 0x18563:$sqlite3blob: 68 53 D8 7F 8C
5.2.pug6mtV48A.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
5.2.pug6mtV48A.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d52:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14875:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14361:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14977:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aef:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x976a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa463:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a517:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b51a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
5.2.pug6mtV48A.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x175f9:$sqlite3step: 68 34 1C 7B E1 0x1770c:$sqlite3step: 68 34 1C 7B E1 0x17628:$sqlite3text: 68 38 2A 90 C5 0x1774d:$sqlite3text: 68 38 2A 90 C5 0x1763b:$sqlite3blob: 68 53 D8 7F 8C 0x17763:$sqlite3blob: 68 53 D8 7F 8C
1.2.pug6mtV48A.exe.28c32c0.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 2 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.odysseysailingsantorini.com/cmsr/"], "decoy": ["dahlia-dolls.com", "iamawife.com", "gardunomx.com", "roweelitetrucking.com", "asapvk.com", "strategieslimited.com", "healthyweathorganics.com", "wedding-gallery.net", "fastoffer.online", "biolab33.cloud", "los40delocta.com", "charliepaton.com", "jenpaddock.com", "zzmweb.com", "poetarts.com", "techwork4u.com", "tracylynpropp.com", "rkbodyfit.site", "migaleriapanama.com", "cosmostco.com", "johnsoncamping.com", "flowfinancialplanning.com", "xn--caamosdemexico-rnb.com", "plusqueindia.com", "wwwhyprr.com", "benimofis.com", "tandteutopia.com", "spaintravelvacation.com", "dear.services", "zhiwugongfang.com", "blogdavnc.com", "justicefundingexchange.com", "alphasecreweb.info", "xitechgroup.com", "kendalmountain.digital", "nieght.com", "pieter-janenmaaike.online", "myexclusiveshop.com", "love-potato.online", "mondebestglobal.com", "ranchlandconcierge.com", "southerngraphx.com", "pray4usa.info", "vilchesfinancial.com", "zelvio.store", "zenibusiness.com", "kindredhue.com", "californiatacosdinuba.com", "uncommonsolutionsllc.com", "easy-lah.com", "disciplesevents.com", "856380127.xyz", "zapzapgone.com", "paradisgrp.com", "programmerworks.info", "purchasesuite.com", "dorotajedrusik.com", "555999dy.com", "uvoyus.com", "utang.net", "elizabethhelma.com", "noseainsight.com", "simpleterior.com", "casatensina.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: pug6mtV48A.exe

Virustotal: Detection: 25%

Perma Link

Yara detected FormBook

Show sources

Source: Yara match	File source: 5.2.pug6mtV48A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.pug6mtV48A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, type: MEMORY

Multi AV Scanner detection for domain / URL

Show sources

Source: www.odysseysailingsantorini.com/cmsr/

Virustotal: Detection: 6%

Perma Link

Source: 5.2.pug6mtV48A.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: pug6mtV48A.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: pug6mtV48A.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: netsh.pdb source: pug6mtV48A.exe, 00000005.00000002.493764285.0000000001141000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdbUGP source: pug6mtV48A.exe, 00000005.00000002.494671070.00000000014EF000.00000040.00000001.sdmp, netsh.exe, 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp
Source:	Binary string: netsh.pdbGCTL source: pug6mtV48A.exe, 00000005.00000002.493764285.0000000001141000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: pug6mtV48A.exe, 00000005.00000002.494671070.00000000014EF000.00000040.00000001.sdmp, netsh.exe

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 4x nop then pop ebx	5_2_00407AFA
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 4x nop then pop edi	5_2_00417D59
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 4x nop then pop ebx	16_2_02D77AFB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 4x nop then pop edi	16_2_02D87D59

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.wwwhyprr.com
Source: C:\Windows\explorer.exe	Domain query: www.wedding-gallery.net

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.odysseysailingsantorini.com/cmsr/

Source: unknown	DNS traffic detected: query: www.wwwhyprr.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.wedding-gallery.net replaycode: Name error (3)

Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000006.00000000.415008820.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: pug6mtV48A.exe, 00000001.00000002.393740885.0000000000E77000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

DNS traffic detected: queries for: www.wedding-gallery.net

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 5.2.pug6mtV48A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.pug6mtV48A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 5.2.pug6mtV48A.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.pug6mtV48A.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.pug6mtV48A.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.pug6mtV48A.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: pug6mtV48A.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 5.2.pug6mtV48A.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.pug6mtV48A.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.pug6mtV48A.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.pug6mtV48A.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 1_2_0039502D	1_2_0039502D
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 1_2_00DEC124	1_2_00DEC124
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 1_2_00DEE570	1_2_00DEE570
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 1_2_00DEE563	1_2_00DEE563
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00401030	5_2_00401030
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0041E993	5_2_0041E993
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00402D8A	5_2_00402D8A
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00402D90	5_2_00402D90
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00409E30	5_2_00409E30
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0041DFD0	5_2_0041DFD0
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00402FB0	5_2_00402FB0
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0094502D	5_2_0094502D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379EBB0	16_2_0379EBB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03786E30	16_2_03786E30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03760D20	16_2_03760D20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03784120	16_2_03784120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376F900	16_2_0376F900
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03831D55	16_2_03831D55
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377841F	16_2_0377841F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821002	16_2_03821002
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377B090	16_2_0377B090
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D79E30	16_2_02D79E30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D8DFD0	16_2_02D8DFD0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D72FB0	16_2_02D72FB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D72D90	16_2_02D72D90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D72D8A	16_2_02D72D8A

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00419D50 NtCreateFile,	5_2_00419D50
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00419E00 NtReadFile,	5_2_00419E00
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00419E80 NtClose,	5_2_00419E80
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00419F30 NtAllocateVirtualMemory,	5_2_00419F30
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00419D4A NtCreateFile,	5_2_00419D4A
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00419E7C NtClose,	5_2_00419E7C
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00419F2A NtAllocateVirtualMemory,	5_2_00419F2A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9710 NtQueryInformationToken,LdrInitializeThunk,	16_2_037A9710
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9FE0 NtCreateMutant,LdrInitializeThunk,	16_2_037A9FE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9780 NtMapViewOfSection,LdrInitializeThunk,	16_2_037A9780
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9A50 NtCreateFile,LdrInitializeThunk,	16_2_037A9A50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A96E0 NtFreeVirtualMemory,LdrInitializeThunk,	16_2_037A96E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A96D0 NtCreateKey,LdrInitializeThunk,	16_2_037A96D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9540 NtReadFile,LdrInitializeThunk,	16_2_037A9540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	16_2_037A9910
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A95D0 NtClose,LdrInitializeThunk,	16_2_037A95D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A99A0 NtCreateSection,LdrInitializeThunk,	16_2_037A99A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9860 NtQuerySystemInformation,LdrInitializeThunk,	16_2_037A9860
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9840 NtDelayExecution,LdrInitializeThunk,	16_2_037A9840
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9770 NtSetInformationFile,	16_2_037A9770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037AA770 NtOpenThread,	16_2_037AA770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9760 NtOpenProcess,	16_2_037A9760
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9730 NtQueryVirtualMemory,	16_2_037A9730
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037AA710 NtOpenProcessToken,	16_2_037AA710
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9B00 NtSetValueKey,	16_2_037A9B00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037AA3B0 NtGetContextThread,	16_2_037AA3B0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A97A0 NtUnmapViewOfSection,	16_2_037A97A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9670 NtQueryInformationProcess,	16_2_037A9670
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9660 NtAllocateVirtualMemory,	16_2_037A9660
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9650 NtQueryValueKey,	16_2_037A9650
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9A20 NtResumeThread,	16_2_037A9A20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9610 NtEnumerateValueKey,	16_2_037A9610
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9A10 NtQuerySection,	16_2_037A9A10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9A00 NtProtectVirtualMemory,	16_2_037A9A00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9A80 NtOpenDirectoryObject,	16_2_037A9A80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9560 NtWriteFile,	16_2_037A9560
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9950 NtQueueApcThread,	16_2_037A9950
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037AAD30 NtSetContextThread,	16_2_037AAD30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9520 NtWaitForSingleObject,	16_2_037A9520
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A95F0 NtQueryInformationFile,	16_2_037A95F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A99D0 NtCreateProcessEx,	16_2_037A99D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037AB040 NtSuspendThread,	16_2_037AB040
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A9820 NtEnumerateKey,	16_2_037A9820
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A98F0 NtReadVirtualMemory,	16_2_037A98F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A98A0 NtWriteVirtualMemory,	16_2_037A98A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D89E80 NtClose,	16_2_02D89E80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D89E00 NtReadFile,	16_2_02D89E00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D89D50 NtCreateFile,	16_2_02D89D50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D89E7C NtClose,	16_2_02D89E7C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D89D4A NtCreateFile,	16_2_02D89D4A

Source: pug6mtV48A.exe	Binary or memory string: OriginalFilename vs pug6mtV48A.exe
Source: pug6mtV48A.exe, 00000001.00000002.394206876.0000000002805000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameColladaLoader.dll4 vs pug6mtV48A.exe
Source: pug6mtV48A.exe, 00000001.00000000.352213953.0000000000392000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameICriticalNotifyCompleti.exe6 vs pug6mtV48A.exe
Source: pug6mtV48A.exe, 00000001.00000002.399085654.0000000006F70000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs pug6mtV48A.exe
Source: pug6mtV48A.exe	Binary or memory string: OriginalFilename vs pug6mtV48A.exe
Source: pug6mtV48A.exe, 00000005.00000002.503268988.000000000346C000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamenetsh.exej% vs pug6mtV48A.exe
Source: pug6mtV48A.exe, 00000005.00000002.492759291.0000000000942000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameICriticalNotifyCompleti.exe6 vs pug6mtV48A.exe
Source: pug6mtV48A.exe, 00000005.00000002.494671070.00000000014EF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs pug6mtV48A.exe
Source: pug6mtV48A.exe	Binary or memory string: OriginalFilenameICriticalNotifyCompleti.exe6 vs pug6mtV48A.exe

Source: pug6mtV48A.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: pug6mtV48A.exe

Virustotal: Detection: 25%

Source: pug6mtV48A.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\pug6mtV48A.exe 'C:\Users\user\Desktop\pug6mtV48A.exe'
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process created: C:\Users\user\Desktop\pug6mtV48A.exe C:\Users\user\Desktop\pug6mtV48A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\pug6mtV48A.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process created: C:\Users\user\Desktop\pug6mtV48A.exe C:\Users\user\Desktop\pug6mtV48A.exe	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\pug6mtV48A.exe'	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\pug6mtV48A.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pug6mtV48A.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@2/0

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6968:120:WilError_01

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\pug6mtV48A.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: pug6mtV48A.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: pug6mtV48A.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: netsh.pdb source: pug6mtV48A.exe, 00000005.00000002.493764285.0000000001141000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdbUGP source: pug6mtV48A.exe, 00000005.00000002.494671070.00000000014EF000.00000040.00000001.sdmp, netsh.exe, 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp
Source:	Binary string: netsh.pdbGCTL source: pug6mtV48A.exe, 00000005.00000002.493764285.0000000001141000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdb source: pug6mtV48A.exe, 00000005.00000002.494671070.00000000014EF000.00000040.00000001.sdmp, netsh.exe

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: pug6mtV48A.exe, CalendarId/MainForm.cs

.Net Code: InitializeComponent System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_004178AB pushfd ; ret	5_2_004178AC
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0040E27F push edx; iretd	5_2_0040E280
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00409BD5 push esp; iretd	5_2_00409BDC
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_004175F8 push edx; iretd	5_2_00417628
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_00419DA2 pushad ; retf	5_2_00419DAB
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0041660F push edx; iretd	5_2_00416610
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0041CEF2 push eax; ret	5_2_0041CEF8
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0041CEFB push eax; ret	5_2_0041CF62
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0041CEA5 push eax; ret	5_2_0041CEF8
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Code function: 5_2_0041CF5C push eax; ret	5_2_0041CF62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037BD0D1 push ecx; ret	16_2_037BD0E4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D7E27F push edx; iretd	16_2_02D7E280
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D79BD5 push esp; iretd	16_2_02D79BDC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D878AB pushfd ; ret	16_2_02D878AC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D8D90A push ebx; iretd	16_2_02D8D90D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D8CEFB push eax; ret	16_2_02D8CF62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D8CEF2 push eax; ret	16_2_02D8CEF8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D8CEA5 push eax; ret	16_2_02D8CEF8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D8660F push edx; iretd	16_2_02D86610
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D8CF5C push eax; ret	16_2_02D8CF62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D875F8 push edx; iretd	16_2_02D87628
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_02D89DA2 pushad ; retf	16_2_02D89DAB

Source: initial sample

Static PE information: section name: .text entropy: 7.61528648699

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x89 0x9E 0xEB

Self deletion via cmd delete

Show sources

Source: C:\Windows\SysWOW64\netsh.exe	Process created: /c del 'C:\Users\user\Desktop\pug6mtV48A.exe'
Source: C:\Windows\SysWOW64\netsh.exe	Process created: /c del 'C:\Users\user\Desktop\pug6mtV48A.exe'			Jump to behavior

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 1.2.pug6mtV48A.exe.28c32c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.394206876.0000000002805000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pug6mtV48A.exe PID: 6664, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: pug6mtV48A.exe, 00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: pug6mtV48A.exe, 00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\pug6mtV48A.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pug6mtV48A.exe	RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 0000000002D798E4 second address: 0000000002D798EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 0000000002D79B4E second address: 0000000002D79B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\pug6mtV48A.exe TID: 6668	Thread sleep time: -43898s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe TID: 6720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 6604	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Code function: 5_2_00409A80 rdtsc

5_2_00409A80

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Thread delayed: delay time: 43898			Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000006.00000000.404035872.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000006.00000000.426311357.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: pug6mtV48A.exe, 00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.394401104.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.399299998.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: pug6mtV48A.exe, 00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000006.00000000.404035872.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000006.00000000.399299998.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.395957236.00000000045BE000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}R
Source: explorer.exe, 00000006.00000000.426054952.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: pug6mtV48A.exe, 00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000006.00000000.426054952.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000006.00000000.426311357.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: pug6mtV48A.exe, 00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000006.00000000.415008820.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Code function: 5_2_00409A80 rdtsc

5_2_00409A80

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0381D380 mov ecx, dword ptr fs:[00000030h]	16_2_0381D380
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03793B7A mov eax, dword ptr fs:[00000030h]	16_2_03793B7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03793B7A mov eax, dword ptr fs:[00000030h]	16_2_03793B7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0382138A mov eax, dword ptr fs:[00000030h]	16_2_0382138A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376DB60 mov ecx, dword ptr fs:[00000030h]	16_2_0376DB60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377FF60 mov eax, dword ptr fs:[00000030h]	16_2_0377FF60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03835BA5 mov eax, dword ptr fs:[00000030h]	16_2_03835BA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376F358 mov eax, dword ptr fs:[00000030h]	16_2_0376F358
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376DB40 mov eax, dword ptr fs:[00000030h]	16_2_0376DB40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377EF40 mov eax, dword ptr fs:[00000030h]	16_2_0377EF40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379E730 mov eax, dword ptr fs:[00000030h]	16_2_0379E730
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03764F2E mov eax, dword ptr fs:[00000030h]	16_2_03764F2E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03764F2E mov eax, dword ptr fs:[00000030h]	16_2_03764F2E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FFF10 mov eax, dword ptr fs:[00000030h]	16_2_037FFF10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FFF10 mov eax, dword ptr fs:[00000030h]	16_2_037FFF10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0383070D mov eax, dword ptr fs:[00000030h]	16_2_0383070D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0383070D mov eax, dword ptr fs:[00000030h]	16_2_0383070D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0382131B mov eax, dword ptr fs:[00000030h]	16_2_0382131B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03838B58 mov eax, dword ptr fs:[00000030h]	16_2_03838B58
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03838F6A mov eax, dword ptr fs:[00000030h]	16_2_03838F6A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379B390 mov eax, dword ptr fs:[00000030h]	16_2_0379B390
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E7794 mov eax, dword ptr fs:[00000030h]	16_2_037E7794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E7794 mov eax, dword ptr fs:[00000030h]	16_2_037E7794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E7794 mov eax, dword ptr fs:[00000030h]	16_2_037E7794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03771B8F mov eax, dword ptr fs:[00000030h]	16_2_03771B8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03771B8F mov eax, dword ptr fs:[00000030h]	16_2_03771B8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A927A mov eax, dword ptr fs:[00000030h]	16_2_037A927A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378AE73 mov eax, dword ptr fs:[00000030h]	16_2_0378AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378AE73 mov eax, dword ptr fs:[00000030h]	16_2_0378AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378AE73 mov eax, dword ptr fs:[00000030h]	16_2_0378AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378AE73 mov eax, dword ptr fs:[00000030h]	16_2_0378AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378AE73 mov eax, dword ptr fs:[00000030h]	16_2_0378AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377766D mov eax, dword ptr fs:[00000030h]	16_2_0377766D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03830EA5 mov eax, dword ptr fs:[00000030h]	16_2_03830EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03830EA5 mov eax, dword ptr fs:[00000030h]	16_2_03830EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03830EA5 mov eax, dword ptr fs:[00000030h]	16_2_03830EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03769240 mov eax, dword ptr fs:[00000030h]	16_2_03769240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03769240 mov eax, dword ptr fs:[00000030h]	16_2_03769240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03769240 mov eax, dword ptr fs:[00000030h]	16_2_03769240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03769240 mov eax, dword ptr fs:[00000030h]	16_2_03769240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03777E41 mov eax, dword ptr fs:[00000030h]	16_2_03777E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03777E41 mov eax, dword ptr fs:[00000030h]	16_2_03777E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03777E41 mov eax, dword ptr fs:[00000030h]	16_2_03777E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03777E41 mov eax, dword ptr fs:[00000030h]	16_2_03777E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03777E41 mov eax, dword ptr fs:[00000030h]	16_2_03777E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03777E41 mov eax, dword ptr fs:[00000030h]	16_2_03777E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0381FEC0 mov eax, dword ptr fs:[00000030h]	16_2_0381FEC0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03838ED6 mov eax, dword ptr fs:[00000030h]	16_2_03838ED6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376E620 mov eax, dword ptr fs:[00000030h]	16_2_0376E620
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03783A1C mov eax, dword ptr fs:[00000030h]	16_2_03783A1C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376C600 mov eax, dword ptr fs:[00000030h]	16_2_0376C600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376C600 mov eax, dword ptr fs:[00000030h]	16_2_0376C600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376C600 mov eax, dword ptr fs:[00000030h]	16_2_0376C600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037776E2 mov eax, dword ptr fs:[00000030h]	16_2_037776E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037916E0 mov ecx, dword ptr fs:[00000030h]	16_2_037916E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037936CC mov eax, dword ptr fs:[00000030h]	16_2_037936CC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A8EC7 mov eax, dword ptr fs:[00000030h]	16_2_037A8EC7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0381FE3F mov eax, dword ptr fs:[00000030h]	16_2_0381FE3F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377AAB0 mov eax, dword ptr fs:[00000030h]	16_2_0377AAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377AAB0 mov eax, dword ptr fs:[00000030h]	16_2_0377AAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379FAB0 mov eax, dword ptr fs:[00000030h]	16_2_0379FAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037652A5 mov eax, dword ptr fs:[00000030h]	16_2_037652A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037652A5 mov eax, dword ptr fs:[00000030h]	16_2_037652A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037652A5 mov eax, dword ptr fs:[00000030h]	16_2_037652A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037652A5 mov eax, dword ptr fs:[00000030h]	16_2_037652A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037652A5 mov eax, dword ptr fs:[00000030h]	16_2_037652A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E46A7 mov eax, dword ptr fs:[00000030h]	16_2_037E46A7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0381B260 mov eax, dword ptr fs:[00000030h]	16_2_0381B260
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0381B260 mov eax, dword ptr fs:[00000030h]	16_2_0381B260
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03838A62 mov eax, dword ptr fs:[00000030h]	16_2_03838A62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379D294 mov eax, dword ptr fs:[00000030h]	16_2_0379D294
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379D294 mov eax, dword ptr fs:[00000030h]	16_2_0379D294
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FFE87 mov eax, dword ptr fs:[00000030h]	16_2_037FFE87
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376B171 mov eax, dword ptr fs:[00000030h]	16_2_0376B171
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376B171 mov eax, dword ptr fs:[00000030h]	16_2_0376B171
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378C577 mov eax, dword ptr fs:[00000030h]	16_2_0378C577
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378C577 mov eax, dword ptr fs:[00000030h]	16_2_0378C577
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03787D50 mov eax, dword ptr fs:[00000030h]	16_2_03787D50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A3D43 mov eax, dword ptr fs:[00000030h]	16_2_037A3D43
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378B944 mov eax, dword ptr fs:[00000030h]	16_2_0378B944
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378B944 mov eax, dword ptr fs:[00000030h]	16_2_0378B944
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E3540 mov eax, dword ptr fs:[00000030h]	16_2_037E3540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03794D3B mov eax, dword ptr fs:[00000030h]	16_2_03794D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03794D3B mov eax, dword ptr fs:[00000030h]	16_2_03794D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03794D3B mov eax, dword ptr fs:[00000030h]	16_2_03794D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379513A mov eax, dword ptr fs:[00000030h]	16_2_0379513A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379513A mov eax, dword ptr fs:[00000030h]	16_2_0379513A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03773D34 mov eax, dword ptr fs:[00000030h]	16_2_03773D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376AD30 mov eax, dword ptr fs:[00000030h]	16_2_0376AD30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037EA537 mov eax, dword ptr fs:[00000030h]	16_2_037EA537
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03784120 mov eax, dword ptr fs:[00000030h]	16_2_03784120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03784120 mov eax, dword ptr fs:[00000030h]	16_2_03784120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03784120 mov eax, dword ptr fs:[00000030h]	16_2_03784120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03784120 mov eax, dword ptr fs:[00000030h]	16_2_03784120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03784120 mov ecx, dword ptr fs:[00000030h]	16_2_03784120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03818DF1 mov eax, dword ptr fs:[00000030h]	16_2_03818DF1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03769100 mov eax, dword ptr fs:[00000030h]	16_2_03769100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03769100 mov eax, dword ptr fs:[00000030h]	16_2_03769100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03769100 mov eax, dword ptr fs:[00000030h]	16_2_03769100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376B1E1 mov eax, dword ptr fs:[00000030h]	16_2_0376B1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376B1E1 mov eax, dword ptr fs:[00000030h]	16_2_0376B1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0376B1E1 mov eax, dword ptr fs:[00000030h]	16_2_0376B1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03838D34 mov eax, dword ptr fs:[00000030h]	16_2_03838D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037935A1 mov eax, dword ptr fs:[00000030h]	16_2_037935A1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379FD9B mov eax, dword ptr fs:[00000030h]	16_2_0379FD9B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379FD9B mov eax, dword ptr fs:[00000030h]	16_2_0379FD9B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378C182 mov eax, dword ptr fs:[00000030h]	16_2_0378C182
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03762D8A mov eax, dword ptr fs:[00000030h]	16_2_03762D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03762D8A mov eax, dword ptr fs:[00000030h]	16_2_03762D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03762D8A mov eax, dword ptr fs:[00000030h]	16_2_03762D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03762D8A mov eax, dword ptr fs:[00000030h]	16_2_03762D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03762D8A mov eax, dword ptr fs:[00000030h]	16_2_03762D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379A185 mov eax, dword ptr fs:[00000030h]	16_2_0379A185
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0378746D mov eax, dword ptr fs:[00000030h]	16_2_0378746D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03780050 mov eax, dword ptr fs:[00000030h]	16_2_03780050
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03780050 mov eax, dword ptr fs:[00000030h]	16_2_03780050
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FC450 mov eax, dword ptr fs:[00000030h]	16_2_037FC450
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FC450 mov eax, dword ptr fs:[00000030h]	16_2_037FC450
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03838CD6 mov eax, dword ptr fs:[00000030h]	16_2_03838CD6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379BC2C mov eax, dword ptr fs:[00000030h]	16_2_0379BC2C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377B02A mov eax, dword ptr fs:[00000030h]	16_2_0377B02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377B02A mov eax, dword ptr fs:[00000030h]	16_2_0377B02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377B02A mov eax, dword ptr fs:[00000030h]	16_2_0377B02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0377B02A mov eax, dword ptr fs:[00000030h]	16_2_0377B02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E7016 mov eax, dword ptr fs:[00000030h]	16_2_037E7016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E7016 mov eax, dword ptr fs:[00000030h]	16_2_037E7016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E7016 mov eax, dword ptr fs:[00000030h]	16_2_037E7016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E6C0A mov eax, dword ptr fs:[00000030h]	16_2_037E6C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E6C0A mov eax, dword ptr fs:[00000030h]	16_2_037E6C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E6C0A mov eax, dword ptr fs:[00000030h]	16_2_037E6C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E6C0A mov eax, dword ptr fs:[00000030h]	16_2_037E6C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_038214FB mov eax, dword ptr fs:[00000030h]	16_2_038214FB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03821C06 mov eax, dword ptr fs:[00000030h]	16_2_03821C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0383740D mov eax, dword ptr fs:[00000030h]	16_2_0383740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0383740D mov eax, dword ptr fs:[00000030h]	16_2_0383740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0383740D mov eax, dword ptr fs:[00000030h]	16_2_0383740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E6CF0 mov eax, dword ptr fs:[00000030h]	16_2_037E6CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E6CF0 mov eax, dword ptr fs:[00000030h]	16_2_037E6CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E6CF0 mov eax, dword ptr fs:[00000030h]	16_2_037E6CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03834015 mov eax, dword ptr fs:[00000030h]	16_2_03834015
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03834015 mov eax, dword ptr fs:[00000030h]	16_2_03834015
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FB8D0 mov eax, dword ptr fs:[00000030h]	16_2_037FB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FB8D0 mov ecx, dword ptr fs:[00000030h]	16_2_037FB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FB8D0 mov eax, dword ptr fs:[00000030h]	16_2_037FB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FB8D0 mov eax, dword ptr fs:[00000030h]	16_2_037FB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FB8D0 mov eax, dword ptr fs:[00000030h]	16_2_037FB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037FB8D0 mov eax, dword ptr fs:[00000030h]	16_2_037FB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379F0BF mov ecx, dword ptr fs:[00000030h]	16_2_0379F0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379F0BF mov eax, dword ptr fs:[00000030h]	16_2_0379F0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_0379F0BF mov eax, dword ptr fs:[00000030h]	16_2_0379F0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037A90AF mov eax, dword ptr fs:[00000030h]	16_2_037A90AF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03822073 mov eax, dword ptr fs:[00000030h]	16_2_03822073
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03769080 mov eax, dword ptr fs:[00000030h]	16_2_03769080
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_03831074 mov eax, dword ptr fs:[00000030h]	16_2_03831074
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E3884 mov eax, dword ptr fs:[00000030h]	16_2_037E3884
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 16_2_037E3884 mov eax, dword ptr fs:[00000030h]	16_2_037E3884

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Code function: 5_2_0040ACC0 LdrLoadDll,

5_2_0040ACC0

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.wwwhyprr.com
Source: C:\Windows\explorer.exe	Domain query: www.wedding-gallery.net

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Section unmapped: C:\Windows\SysWOW64\netsh.exe base address: 9E0000

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Memory written: C:\Users\user\Desktop\pug6mtV48A.exe base: 400000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Thread register set: target process: 3440	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Thread register set: target process: 3440	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Thread register set: target process: 3440	Jump to behavior

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Process created: C:\Users\user\Desktop\pug6mtV48A.exe C:\Users\user\Desktop\pug6mtV48A.exe			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\pug6mtV48A.exe'			Jump to behavior

Source: explorer.exe, 00000006.00000000.404035872.00000000083EB000.00000004.00000001.sdmp, netsh.exe, 00000010.00000002.622564714.0000000004BD0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.439280693.00000000008B8000.00000004.00000020.sdmp, netsh.exe, 00000010.00000002.622564714.0000000004BD0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.394747320.0000000000EE0000.00000002.00020000.sdmp, netsh.exe, 00000010.00000002.622564714.0000000004BD0000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000006.00000000.394747320.0000000000EE0000.00000002.00020000.sdmp, netsh.exe, 00000010.00000002.622564714.0000000004BD0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Users\user\Desktop\pug6mtV48A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pug6mtV48A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pug6mtV48A.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 5.2.pug6mtV48A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.pug6mtV48A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 5.2.pug6mtV48A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.pug6mtV48A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Rootkit1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Masquerading1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools11	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion31	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection612	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
pug6mtV48A.exe	25%	Virustotal		Browse
pug6mtV48A.exe	9%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.pug6mtV48A.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
www.wedding-gallery.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
www.odysseysailingsantorini.com/cmsr/	7%	Virustotal		Browse
www.odysseysailingsantorini.com/cmsr/	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.wwwhyprr.com	unknown	unknown	true		unknown
www.wedding-gallery.net	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.odysseysailingsantorini.com/cmsr/	true	7%, Virustotal, Browse Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000006.00000000.415008820.000000000095C000.00000004.00000020.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	pug6mtV48A.exe, 00000001.00000002.393740885.0000000000E77000.00000004.00000040.sdmp	false		high
http://www.fontbureau.com/designersG	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.tiro.com	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.fonts.com	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	pug6mtV48A.exe, 00000001.00000002.398459967.0000000006942000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491388
Start date:	27.09.2021
Start time:	14:38:55
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	pug6mtV48A.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@2/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 27.4% (good quality ratio 24.4%) Quality average: 72.6% Quality standard deviation: 32.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 65 Number of non-executed functions: 91
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 20.50.102.62, 23.0.174.185, 23.0.174.200, 20.54.110.249, 40.112.88.60, 23.10.249.43, 23.10.249.26, 95.100.54.203 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:40:12	API Interceptor	2x Sleep call for process: pug6mtV48A.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pug6mtV48A.exe.log Download File
Process:	C:\Users\user\Desktop\pug6mtV48A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.6039035513802595
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	pug6mtV48A.exe
File size:	689152
MD5:	74da6faf84783587dd82552dfa63eb00
SHA1:	276512acad7ec63916653862778438c169a3b890
SHA256:	584b5b4a74cb945f3be3ff0a4017d8ce2b073d6a98bfceb7bc59cb0f3fe7c3ee
SHA512:	cdb99cd07b694c661b80c6ba53a00220784da5c7a14bc96e4bcf731886191556eed6082d8b45dcb9a7fb8a524b904012feb636148f6d23c58ba74973363ddf81
SSDEEP:	12288:41OlclRTqv/Q7z1jrRMd5mBJtxouynk/V5eb7e6OdDr:cP7bZSHmnT+k/Xemd
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]5Qa..............0..x............... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4a9786
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6151355D [Mon Sep 27 03:07:09 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [ecx], al
add al, byte ptr [ebx]
add al, 05h
push es
pop es
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa9734	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x660	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa779c	0xa7800	False	0.753477728545	data	7.61528648699	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x660	0x800	False	0.341796875	data	3.56505562485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xaa090	0x3ce	data
RT_MANIFEST	0xaa470	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Best Products All rights reserved
Assembly Version	253.13.3.4
InternalName	ICriticalNotifyCompleti.exe
FileVersion	253.13.2.1
CompanyName	Best Products
LegalTrademarks
Comments	Calendar ID Sorter
ProductName	CalendarId
ProductVersion	253.13.2.1
FileDescription	CalendarId
OriginalFilename	ICriticalNotifyCompleti.exe

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 14:39:50.867995977 CEST	64267	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:39:50.886336088 CEST	53	64267	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:22.055146933 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:22.084383965 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:42.795692921 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:42.814198971 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:45.078890085 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:45.185601950 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:47.045768976 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:47.046406031 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:47.062572002 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:47.076649904 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:48.172497988 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:48.266284943 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:49.382447004 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:49.400058031 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:50.329163074 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:50.430471897 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:51.794635057 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:51.808240891 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:52.449717999 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:52.462551117 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:53.853634119 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:53.916657925 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:55.180216074 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:55.242477894 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 27, 2021 14:40:55.791574001 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:40:55.804991961 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 27, 2021 14:41:02.467063904 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:41:02.487991095 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 27, 2021 14:41:17.310323954 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:41:17.388540983 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 27, 2021 14:41:33.899136066 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:41:33.912218094 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 27, 2021 14:41:36.299145937 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:41:36.327677965 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 27, 2021 14:41:39.849313021 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:41:39.863987923 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 27, 2021 14:42:00.493051052 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 27, 2021 14:42:00.530603886 CEST	53	49694	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 14:41:39.849313021 CEST	192.168.2.6	8.8.8.8	0x2b55	Standard query (0)	www.wedding-gallery.net	A (IP address)	IN (0x0001)
Sep 27, 2021 14:42:00.493051052 CEST	192.168.2.6	8.8.8.8	0xf059	Standard query (0)	www.wwwhyprr.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 27, 2021 14:41:39.863987923 CEST	8.8.8.8	192.168.2.6	0x2b55	Name error (3)	www.wedding-gallery.net	none	none	A (IP address)	IN (0x0001)
Sep 27, 2021 14:42:00.530603886 CEST	8.8.8.8	192.168.2.6	0xf059	Name error (3)	www.wwwhyprr.com	none	none	A (IP address)	IN (0x0001)

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x89 0x9E 0xEB
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x81 0x1E 0xEB
GetMessageW	INLINE	0x48 0x8B 0xB8 0x81 0x1E 0xEB
GetMessageA	INLINE	0x48 0x8B 0xB8 0x89 0x9E 0xEB

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: pug6mtV48A.exe PID: 6664 Parent PID: 1256

General

Start time:	14:39:57
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\pug6mtV48A.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\pug6mtV48A.exe'
Imagebase:	0x390000
File size:	689152 bytes
MD5 hash:	74DA6FAF84783587DD82552DFA63EB00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.394111409.0000000002791000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.394206876.0000000002805000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.394935099.0000000003799000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: pug6mtV48A.exe PID: 6980 Parent PID: 6664

General

Start time:	14:40:15
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\pug6mtV48A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\pug6mtV48A.exe
Imagebase:	0x940000
File size:	689152 bytes
MD5 hash:	74DA6FAF84783587DD82552DFA63EB00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.493424502.0000000001060000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.493490719.0000000001090000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3440 Parent PID: 6980

General

Start time:	14:40:16
Start date:	27/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6f22f0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.424163979.000000000762F000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.452200423.000000000762F000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: netsh.exe PID: 6864 Parent PID: 3440

General

Start time:	14:40:59
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\netsh.exe
Imagebase:	0x9e0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.618457588.0000000000A70000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.619152070.0000000002CB0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3012 Parent PID: 6864

General

Start time:	14:41:03
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\pug6mtV48A.exe'
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6968 Parent PID: 3012

General

Start time:	14:41:04
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: pug6mtV48A.exe PID: 6664 Parent PID: 1256 pug6mtV48A.exeCOMMON

Executed Functions

Function 00DEB681, Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00DEB6F0
GetCurrentThread.KERNEL32 ref: 00DEB72D
GetCurrentProcess.KERNEL32 ref: 00DEB76A
GetCurrentThreadId.KERNEL32 ref: 00DEB7C3

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c0efcc28dfbde4d13734b50119c068b1b179d207f2946798533ca817c0e5d815
Instruction ID: aa45aabf75b35f19b7e4cb0bc1c72f7e2eda3d3734f1b6d0f22cf5494d38c186
Opcode Fuzzy Hash: c0efcc28dfbde4d13734b50119c068b1b179d207f2946798533ca817c0e5d815
Instruction Fuzzy Hash: 2E5177B09007898FDB10DFAAC5487EEBBF4EB88314F14845AE418B7751C7746884CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00DEB690, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00DEB6F0
GetCurrentThread.KERNEL32 ref: 00DEB72D
GetCurrentProcess.KERNEL32 ref: 00DEB76A
GetCurrentThreadId.KERNEL32 ref: 00DEB7C3

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0f8d443cc4cf201205854bf126d2860ec9756491ea6fbb3559f127d84576ef8a
Instruction ID: 6af651abaea9e7176d5f08d1f49e367a047dcc9af0a14f998696e325d6fd1daa
Opcode Fuzzy Hash: 0f8d443cc4cf201205854bf126d2860ec9756491ea6fbb3559f127d84576ef8a
Instruction Fuzzy Hash: 755154B09007498FDB14DFAAC588BDEBBF5EB88314F24846AE419B3750D7746884CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00DEFCF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00DEFE0A

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b52f70172e6e8acc29682dd9f5edee24bcdfa9705eadcfa4e375df7a1dcec09a
Instruction ID: 98c54ace103e02751d7e52d643d8c6d473e927987412657abfde7c7145b22840
Opcode Fuzzy Hash: b52f70172e6e8acc29682dd9f5edee24bcdfa9705eadcfa4e375df7a1dcec09a
Instruction Fuzzy Hash: 1A41D0B1D003489FDB14DFAAC880ADEBFB5FF48314F24812AE419AB210D774A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DE5365, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00DE5421

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d77f1da19d53736deca61770e38bc9524928a06cdf85cc0cb57029c0f916698f
Instruction ID: c38af4913d5c77f08f3741186bba583931c54ea1d9239970e044f8cb02762fce
Opcode Fuzzy Hash: d77f1da19d53736deca61770e38bc9524928a06cdf85cc0cb57029c0f916698f
Instruction Fuzzy Hash: B7411570C00658CEDB24DFAAC8447DEFBB9BF48308F248569D409AB255DBB16946CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE3DE8, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00DE5421

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: afa838e74487033fd68a21acfae5e40168331d4338b0fd2e8737dbca88d220dc
Instruction ID: f2854e87729898ba6d271c7685a9bc4239bc6ad4ce71c8e59af22f926b758e03
Opcode Fuzzy Hash: afa838e74487033fd68a21acfae5e40168331d4338b0fd2e8737dbca88d220dc
Instruction Fuzzy Hash: 6341F270C00658CBDB24DFAAC8447DEFBB9BF48308F248469D409AB255DBB16945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9490, Relevance: 1.6, APIs: 1, Instructions: 80libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00DE9951,00000800,00000000,00000000), ref: 00DE9B62

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 917ce3fecf22ad46b1efe945194a3f2e1d4a6b85fe5e2cd3f95942c3b344fcf7
Instruction ID: 92cea374fc0ec1966fb405fe93e11f8616231ed8940c50822b7206d033292f9e
Opcode Fuzzy Hash: 917ce3fecf22ad46b1efe945194a3f2e1d4a6b85fe5e2cd3f95942c3b344fcf7
Instruction Fuzzy Hash: EE31E3B2C053888FCB10DFAAC494AEAFFB8AF55360F08845ED455A7241D3749905CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00DEB8B3, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00DEB93F

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7d64fd570d823b284f67d05fe03d0a5c39622672fa749e9ac7d073f7f6d66942
Instruction ID: 05818b2e1f95995e124235b46daea9216af201b9743691f6c1c8a915351936a3
Opcode Fuzzy Hash: 7d64fd570d823b284f67d05fe03d0a5c39622672fa749e9ac7d073f7f6d66942
Instruction Fuzzy Hash: 7821E5B59002499FDB10CFAAD884AEEBFF8FB48324F14841AE915B3311D375A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9AF0, Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00DE9951,00000800,00000000,00000000), ref: 00DE9B62

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2684b4b03f4fc6bb24d02327db4a2695d0cee918fc4e986e01ef6fbf2769fe3e
Instruction ID: f73f8994a9b0a33390e5c7f7e5643dfb3fa07eb3456cd942c621ae47e8a1b6db
Opcode Fuzzy Hash: 2684b4b03f4fc6bb24d02327db4a2695d0cee918fc4e986e01ef6fbf2769fe3e
Instruction Fuzzy Hash: 2A2149B6D012488FCB10DF9AD484AEEFBF4EB98324F04852AD519A7200C375A946CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DEB8B8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00DEB93F

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8606677f148ba1041a76da56751669cd5f650319e6a173c37b52806f128af944
Instruction ID: 0399123d47cb60302611cb58d803ab970c998e4bad7bfbc40a2df1d833a2a00c
Opcode Fuzzy Hash: 8606677f148ba1041a76da56751669cd5f650319e6a173c37b52806f128af944
Instruction Fuzzy Hash: 0321E2B59002489FDB10CFAAD884ADEBFF8FB48324F14841AE914A3311D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9478, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00DE9951,00000800,00000000,00000000), ref: 00DE9B62

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 56efa07dc5487f8ea7a07faf3cbe1fb6fe1f4e7dd8600f8ea892d582495d0ee2
Instruction ID: 1acb0d616bf4005ae6555ea6895131e3476c49de52a12fc80ae687f36103bed4
Opcode Fuzzy Hash: 56efa07dc5487f8ea7a07faf3cbe1fb6fe1f4e7dd8600f8ea892d582495d0ee2
Instruction Fuzzy Hash: 1D1103B6D003498FCB10DF9AD484ADEFBF8EB48324F14852AE419A7600C3B5A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9869, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00DE98D6

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2008d7e03922866283efc3a8aa980f977e8a8f09ea1b985be57e566be1df773b
Instruction ID: 00899a3aad31d339a6a57e4fd420d6fd059eff41b10f6f9275fd385f512200e5
Opcode Fuzzy Hash: 2008d7e03922866283efc3a8aa980f977e8a8f09ea1b985be57e566be1df773b
Instruction Fuzzy Hash: 751100B5C006498ACB24DFAAD484ADEFBF4EB89324F14851AC419A7610C375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DE9870, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00DE98D6

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ccde7acbd6aaf96db06ac08cdb1652aac03750b297f564f4aad5929725f4fd4a
Instruction ID: 488f7ed40261eed1623033f405d6b244d8a254efd0d4d5e3aa8d99c137976e6a
Opcode Fuzzy Hash: ccde7acbd6aaf96db06ac08cdb1652aac03750b297f564f4aad5929725f4fd4a
Instruction Fuzzy Hash: 73110FB5C006498FDB10DF9AC484BDEFBF8EB89324F14852AD429B7610C375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.392826252.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d860ee3c430a4aa19a6b4e9ff5d6efcd2bf798879f31badfcdb864224fc8ce84
Instruction ID: 4b58a3c2a08e8ded781bc85ca45aa9e68f9421e146d7e74a628efd0545a6bbc5
Opcode Fuzzy Hash: d860ee3c430a4aa19a6b4e9ff5d6efcd2bf798879f31badfcdb864224fc8ce84
Instruction Fuzzy Hash: CF212571504248DFCB14DF20D8D0B26BBA6FB84314F20C9A9D9094B286CB3AD80BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.392826252.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2062c081b023f404f1e6e8ae12c405b17fdc54dc9db58d0e78958199c16706
Instruction ID: b9cc143b02cf115f999d93153c60588b99ffeb12ec3caaeec3f25ddf24a4be07
Opcode Fuzzy Hash: 9f2062c081b023f404f1e6e8ae12c405b17fdc54dc9db58d0e78958199c16706
Instruction Fuzzy Hash: 6421F571504248DFDB05DF54D9C0B36BBA6FB84314F24C9ADD9094B286C336D84ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD006, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.392826252.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5afb3e0ce49e5373e59b5624f6a6c5fd049541cc183d65cc980bdc8a79a5c327
Instruction ID: a239fa7d89c709c3584c0c21c52c2c98fd01ac35410daa964c35d6bb95389410
Opcode Fuzzy Hash: 5afb3e0ce49e5373e59b5624f6a6c5fd049541cc183d65cc980bdc8a79a5c327
Instruction Fuzzy Hash: 3C21C6755093848FCB12CF20D5A0B15BFB2EB45314F28C5EAD8498B697C33AD81ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.392826252.0000000000BFD000.00000040.00000001.sdmp, Offset: 00BFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f76a4c832885a47eef9ebc7b6c2ce687a7dfcf81a03017dce253b815f903819
Instruction ID: b7dd97b861c75c7895e1557df4c785ec6fb68261ec6f9bf0fb92d36ab665bc9f
Opcode Fuzzy Hash: 0f76a4c832885a47eef9ebc7b6c2ce687a7dfcf81a03017dce253b815f903819
Instruction Fuzzy Hash: 7311BB75504284DFCB12CF10D5C0B25FFA2FB84324F28C6AAD9494B696C33AD85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0039502D, Relevance: 3.7, Instructions: 3670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.391741707.0000000000392000.00000002.00020000.sdmp, Offset: 00390000, based on PE: true

Associated: 00000001.00000002.391728106.0000000000390000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4782f7b14636ad16663f12a16ee39fde5395a34f51f848ed264f05e79dbb79
Instruction ID: 7eb935cbca05f9cf7c4fbd85bb9b2670e44b25b47252076696f275abf5f9c43d
Opcode Fuzzy Hash: ac4782f7b14636ad16663f12a16ee39fde5395a34f51f848ed264f05e79dbb79
Instruction Fuzzy Hash: D863DD6140F7C29FDB034BB85CB5291BFB19E6721471E49CBC4C1CF0A3E21969AAD726

Uniqueness

Uniqueness Score: -1.00%

Function 00DEE570, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff01e9a98a9c0f16d17eb866cd49d40368e5846092c0d0c589af0109bd920236
Instruction ID: a4416eb3c923fc1886e3289662dc5d88b717b13da688ebbe3f76536d58ea4bcb
Opcode Fuzzy Hash: ff01e9a98a9c0f16d17eb866cd49d40368e5846092c0d0c589af0109bd920236
Instruction Fuzzy Hash: 8212C5F1C917468BD338CF65E89A1993F71B745328BD2CA09D2612BAD0D7B4116ECF48

Uniqueness

Uniqueness Score: -1.00%

Function 00DEC124, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74dd1fa9763fcc09f8f3f3e50b4f0ff2ca9b6379d9af019410f74000edd5b4d
Instruction ID: db7f60b5e43be3737d417367fa86b65080d5f201861d08107d2d5968cc4dd93c
Opcode Fuzzy Hash: c74dd1fa9763fcc09f8f3f3e50b4f0ff2ca9b6379d9af019410f74000edd5b4d
Instruction Fuzzy Hash: DDA16E32E102598FCF15EFA6C84459EBBB2FF85300B15856AE805AB261EB71A915CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00DEE563, Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.393381103.0000000000DE0000.00000040.00000001.sdmp, Offset: 00DE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d080afe6e0f3ce669d3f677cbbfdf97cefa84d0b1670705643b35ff90ed93d09
Instruction ID: b35a24a6f521b5c24519a3e9d1d862db84a498edf381e8d31622488fb6f5befb
Opcode Fuzzy Hash: d080afe6e0f3ce669d3f677cbbfdf97cefa84d0b1670705643b35ff90ed93d09
Instruction Fuzzy Hash: E9C159B1C917458BD728DF65E88A1993F71FB85328F92CB09D2612B6D0D7B4106ECF88

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: pug6mtV48A.exe PID: 6980 Parent PID: 6664 pug6mtV48A.exeCOMMON

Executed Functions

Function 00419E00, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419E00(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E0041A950(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x414d32
				_t12 =  &_a8; // 0x414d32
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00419e03
0x00419e0f
0x00419e17
0x00419e22
0x00419e3d
0x00419e45
0x00419e49

APIs

NtReadFile.NTDLL(2MA,5EB6522D,FFFFFFFF,004149F1,?,?,2MA,?,004149F1,FFFFFFFF,5EB6522D,00414D32,?,00000000), ref: 00419E45

Strings

2MA, xrefs: 00419E3D, 00419E44
2MA, xrefs: 00419E22, 00419E30

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: 2MA$2MA
API String ID: 2738559852-947276439
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: e2eeafcdabc96c90d19f56ab9cfe9238ee24689222a5818d11d4b5cf4f7c0d6d
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 90F0B7B2210208AFCB14DF89DC91EEB77ADEF8C754F158649BE1D97241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419D4A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419D4A(void* __edx, signed int __edi, intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, char _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t22;

				ss = __edx;
				_t35 = __edi ^  *0x00000107;
				_t16 = _a4;
				_t4 = _t16 + 0xc40; // 0xc40
				E0041A950(_t35, _a4, _t4,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t12 =  &_a20; // 0x414b77
				_t22 = NtCreateFile(_a8, _a12, _a16,  *_t12, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t22;
			}

0x00419d4c
0x00419d4e
0x00419d53
0x00419d5f
0x00419d67
0x00419d89
0x00419d9d
0x00419da1

APIs

NtCreateFile.NTDLL(00000060,00409CC3,?,wKA,00409CC3,FFFFFFFF,?,?,FFFFFFFF,00409CC3,00414B77,?,00409CC3,00000060,00000000,00000000), ref: 00419D9D

Strings

wKA, xrefs: 00419D89, 00419D94

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID: wKA
API String ID: 823142352-3165208591
Opcode ID: 7ab8469d83ad9bd10d0e6db8322583e6e74e3138565224800667b1ee1b7d3bde
Instruction ID: 9ed6e26d88a505840e18b06861ebfba83fffb53acf388e89c63ac865cd2a6e33
Opcode Fuzzy Hash: 7ab8469d83ad9bd10d0e6db8322583e6e74e3138565224800667b1ee1b7d3bde
Instruction Fuzzy Hash: 7501F2B2201108AFCB08CF89CC91EEB37A9BF8C354F118248FA1C97241C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00419D50, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419D50(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, char _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E0041A950(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t11 =  &_a20; // 0x414b77
				_t21 = NtCreateFile(_a8, _a12, _a16,  *_t11, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x00419d5f
0x00419d67
0x00419d89
0x00419d9d
0x00419da1

APIs

NtCreateFile.NTDLL(00000060,00409CC3,?,wKA,00409CC3,FFFFFFFF,?,?,FFFFFFFF,00409CC3,00414B77,?,00409CC3,00000060,00000000,00000000), ref: 00419D9D

Strings

wKA, xrefs: 00419D89, 00419D94

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID: wKA
API String ID: 823142352-3165208591
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 0d977cd1f4fbd36c9bd444ef8f6a04c43f7f15de33bda2cf86b45a3658e1eede
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: BFF0BDB2211208AFCB08CF89DC95EEB77ADAF8C754F158248BA1D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACC0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACC0(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_v8 =  &_v536;
				_t15 = E0041C640( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041CA60(__eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041CCE0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041AE90(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040acdc
0x0040acdf
0x0040ace4
0x0040ace9
0x0040acf3
0x0040acf8
0x0040acfb
0x0040acfd
0x0040ad05
0x0040ad0a
0x0040ad0a
0x0040ad11
0x0040ad19
0x0040ad1c
0x0040ad1e
0x0040ad32
0x00000000
0x0040ad34
0x0040ad3a
0x0040acee
0x0040acee
0x0040acee

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD32

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: 8d9c8c5cc187846e167d7fc499b748faaade23025a89af1130ee390205ce80a6
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: C40152B5D4020DA7DB10DBE5DC42FDEB7789F14308F0041AAE908A7281F634EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 00419F2A, Relevance: 1.5, APIs: 1, Instructions: 33
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00419F2A(void* __eax, void* __ecx, signed int __esi, intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t19;
				void* _t27;
				signed int _t29;

				asm("scasd");
				_t29 = __esi ^  *(__ecx + 0x55);
				_t15 = _a4;
				_push(_t29);
				_t6 = _t15 + 0xc60; // 0xca0
				E0041A950(_t27, _a4, _t6,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t19 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t19;
			}

0x00419f2d
0x00419f2e
0x00419f33
0x00419f39
0x00419f3f
0x00419f47
0x00419f69
0x00419f6d

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB24,?,00000000,?,00003000,00000040,00000000,00000000,00409CC3), ref: 00419F69

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 53d5a4eeab02fea0f899319b816af1ebeb7531070fdd4f966839788e8bcbef93
Instruction ID: f7523287f29d6fe6f2cf7956ba2f0c2abdca80545f7a8a6e2d1ce2ccf1de4634
Opcode Fuzzy Hash: 53d5a4eeab02fea0f899319b816af1ebeb7531070fdd4f966839788e8bcbef93
Instruction Fuzzy Hash: 6BF058B2210208AFDB14DF98CC81EEB77A8EF88358F118549FE1CA7241C234E811CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00419F30, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419F30(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E0041A950(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x00419f3f
0x00419f47
0x00419f69
0x00419f6d

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB24,?,00000000,?,00003000,00000040,00000000,00000000,00409CC3), ref: 00419F69

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: c2721ea4e084a79d388e091216dcc94a475298a8aa449db6134383b78daf1f40
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 7DF015B2210208AFCB14DF89CC81EEB77ADAF88754F118549BE1897241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E7C, Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00419E7C(void* __eflags, intOrPtr _a4, void* _a8) {
				void* _t7;
				long _t11;
				void* _t14;
				intOrPtr _t21;

				L0:
				while(1) {
					L0:
					asm("pushad");
					asm("popad");
					if(__eflags < 0) {
						break;
					}
					L1:
					 *((intOrPtr*)(_t7 + 0x55fa7161)) = _t21;
				}
				L2:
				_t8 = _a4;
				_t4 = _t8 + 0x10; // 0x300
				_t5 = _t8 + 0xc50; // 0x40a913
				E0041A950(_t14, _a4, _t5,  *_t4, 0, 0x2c);
				_t11 = NtClose(_a8); // executed
				return _t11;
			}

0x00419e7c
0x00419e7c
0x00419e7c
0x00419e7c
0x00419e7d
0x00419e7e
0x00000000
0x00000000
0x00419e7a
0x00419e7a
0x00419e7a
0x00419e80
0x00419e83
0x00419e86
0x00419e8f
0x00419e97
0x00419ea5
0x00419ea9

APIs

NtClose.NTDLL(00414D10,?,?,00414D10,00409CC3,FFFFFFFF), ref: 00419EA5

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 076a299f7c407e1331a305a4888a038f6a5f5e7c31a648711791beeed5cdc0c0
Instruction ID: 139aa4a7a0a911ada602052342df41cd9bde445464c7247a71f2d17c10fc803e
Opcode Fuzzy Hash: 076a299f7c407e1331a305a4888a038f6a5f5e7c31a648711791beeed5cdc0c0
Instruction Fuzzy Hash: C3E0DF712403007BCA14DBD5CC45E977B6CEF05330F11405AFA095B242C530A54086E1

Uniqueness

Uniqueness Score: -1.00%

Function 00419E80, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419E80(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x40a913
				E0041A950(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x00419e83
0x00419e86
0x00419e8f
0x00419e97
0x00419ea5
0x00419ea9

APIs

NtClose.NTDLL(00414D10,?,?,00414D10,00409CC3,FFFFFFFF), ref: 00419EA5

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: abd226b249efdbe90954a2e5a1f5a103ee35f8531edac2b51595525400ebd06d
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: FED01776200214ABD710EB99CC86EE77BACEF48760F15449ABA5C9B242C530FA5086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00409A80, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea422489a25dcefea3ed0f1b9a3fefea2ebcd7ffde6029fed25eb79b3bdcb825
Instruction ID: 31b1220a7bfbfd16f43a3644c83f2c17606f0388dd956b3420c92d1797c928f5
Opcode Fuzzy Hash: ea422489a25dcefea3ed0f1b9a3fefea2ebcd7ffde6029fed25eb79b3bdcb825
Instruction Fuzzy Hash: 202137B2D4020857CB25DA64AD42AEF73BCAB54304F04007FE949A7182F63CBE49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00408286, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00408286(void* __ebx, intOrPtr* _a4) {
				void* _t10;
				void* _t11;

				asm("in al, 0x8e");
				asm("loope 0x66");
				asm("sbb [esi], ebp");
				 *((char*)(__ebx - 0x7f)) =  *((char*)(__ebx - 0x7f)) + 0x28;
				_t11 = E0041B160(_t10);
				if(_t11 == 0 || _t11 == 0x33333333) {
					return 0;
				} else {
					return  *_a4 + _t11;
				}
			}

0x00408286
0x00408288
0x0040828a
0x0040828c
0x00408298
0x0040829c
0x004082b2
0x004082a6
0x004082ae
0x004082ae

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Strings

(, xrefs: 0040828C

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID: (
API String ID: 1836367815-3887548279
Opcode ID: b784bc7f3e88494daba021be060d48e12c8f2a7faf1ca8a68c7348251b259488
Instruction ID: 3bd0e3de3a48e026a73040ff265cd42116660e97523665222c81487ff7b89774
Opcode Fuzzy Hash: b784bc7f3e88494daba021be060d48e12c8f2a7faf1ca8a68c7348251b259488
Instruction Fuzzy Hash: A201FE31A403187BE720A6A58C42FFE771CAF40F04F04401DFE44BA1C1D6F9691A47EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A020, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A020(intOrPtr _a4, void* _a8, long _a12, char _a16) {
				void* _t10;
				void* _t15;

				E0041A950(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t4 =  &_a16; // 0x414c6f
				_t10 = RtlAllocateHeap(_a8, _a12,  *_t4); // executed
				return _t10;
			}

0x0041a037
0x0041a03c
0x0041a04d
0x0041a051

APIs

RtlAllocateHeap.NTDLL(004144F6,?,oLA,00414C6F,?,004144F6,?,?,?,?,?,00000000,00409CC3,?), ref: 0041A04D

Strings

oLA, xrefs: 0041A03C, 0041A048

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: oLA
API String ID: 1279760036-3789366272
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 3e9cccf5f91448adbf19cee7c08a6922c38dacc77a606dc9f5f43a2a80c29887
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 4BE012B1210208ABDB14EF99CC41EA777ACAF88664F118559BA185B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 004082B3, Relevance: 1.6, APIs: 1, Instructions: 71
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E004082B3(void* __ecx, void* __edi, intOrPtr _a8, long _a12) {
				char _v63;
				char _v64;
				void* _t11;
				void* _t15;
				int _t16;
				void* _t19;
				void* _t27;
				long _t28;
				int _t33;
				void* _t37;
				void* _t39;

				_t27 = __edi;
				_t23 = __ecx + 1;
				asm("outsd");
				if( *((intOrPtr*)(__ecx + 1)) < __edi) {
					if(__eflags < 0) {
						_t27 = 0x551c4722;
						_push(_t37);
						_t37 = _t39;
					}
					_push(_t30);
					_v64 = 0;
					E0041B850( &_v63, 0, 0x3f);
					E0041C3F0( &_v64, 3);
					_t15 = E0040ACC0(__eflags, _a8 + 0x1c,  &_v64); // executed
					_t16 = E00414E10(_a8 + 0x1c, _t15, 0, 0, 0xc4e7b6d6);
					_t33 = _t16;
					__eflags = _t33;
					if(_t33 != 0) {
						_push(_t27);
						_t28 = _a12;
						_t16 = PostThreadMessageW(_t28, 0x111, 0, 0); // executed
						__eflags = _t16;
						if(__eflags == 0) {
							_t16 =  *_t33(_t28, 0x8003, _t37 + (E0040A450(__eflags, 1, 8) & 0x000000ff) - 0x40, _t16);
						}
					}
					return _t16;
				} else {
					asm("invalid");
					asm("adc dword [esi+eax*2+0x5e68569d], 0xe811c6f9");
					_push(_t30);
					_t19 = E0041B290(_t11, _t23, 0x11c6f95e);
					return E0041B140(_t23) + _t19 + 0x1000;
				}
			}

0x004082b3
0x004082b3
0x004082b6
0x004082b8
0x004082ea
0x004082ec
0x004082f0
0x004082f1
0x004082f1
0x004082f6
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x00408338
0x0040833a
0x0040833c
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x0040836d
0x00408372
0x004082ba
0x004082ba
0x004082bc
0x004082c0
0x004082c6
0x004082dd
0x004082dd

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 9a6df075b3a899bbcc8e66ea9f4f4b1dfdcf750ef061f88f866bd59aa0326e67
Instruction ID: 15bcf26793c5adb4b30de96ac94af9ddbe6e7cdc6d38737c83c8a5ad6bd04a3e
Opcode Fuzzy Hash: 9a6df075b3a899bbcc8e66ea9f4f4b1dfdcf750ef061f88f866bd59aa0326e67
Instruction Fuzzy Hash: 0F113B31940324BBD721A6A49C02FEE7368AF41B54F05006DFE04BB1C2E7B9A91583E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041A231, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F192,0040F192,0000003C,00000000,?,00409D35), ref: 0041A1F0

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 56050d8244913e3bb370970d1dbd85be66a8c23741eff3f4d1711a73f959f3de
Instruction ID: bad0358d1984c2e8f8fd26a54909ca9b9a107d454ad3037bbbf37e326c04f907
Opcode Fuzzy Hash: 56050d8244913e3bb370970d1dbd85be66a8c23741eff3f4d1711a73f959f3de
Instruction Fuzzy Hash: 9E1104B41052846FDB11EFB8CC91CDBBFA8EF41220B00898EF8D847202C635E965CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004082E9, Relevance: 1.6, APIs: 1, Instructions: 56
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004082E9(void* __ecx, void* __eflags, intOrPtr _a8, long _a12) {
				char _v63;
				char _v64;
				void* _t13;
				int _t14;
				long _t23;
				int _t28;
				void* _t30;
				void* _t32;

				_t37 = __eflags;
				if(__eflags < 0) {
					_push(_t30);
					_t30 = _t32;
				}
				_v64 = 0;
				E0041B850( &_v63, 0, 0x3f);
				E0041C3F0( &_v64, 3);
				_t13 = E0040ACC0(_t37, _a8 + 0x1c,  &_v64); // executed
				_t14 = E00414E10(_a8 + 0x1c, _t13, 0, 0, 0xc4e7b6d6);
				_t28 = _t14;
				if(_t28 != 0) {
					_push(0x551c4722);
					_t23 = _a12;
					_t14 = PostThreadMessageW(_t23, 0x111, 0, 0); // executed
					_t39 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t28(_t23, 0x8003, _t30 + (E0040A450(_t39, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
				}
				return _t14;
			}

0x004082e9
0x004082ea
0x004082f0
0x004082f1
0x004082f1
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833c
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: e021297182014d911c4727aa76fd82cc414bc15ba45ee236aca104e310637bf7
Instruction ID: c11f41c2e629a8b0ca5c2bb86d734e15c96e32f6bf9f39254c705a1de3a96043
Opcode Fuzzy Hash: e021297182014d911c4727aa76fd82cc414bc15ba45ee236aca104e310637bf7
Instruction Fuzzy Hash: CF012831A803187BE720A6A49C03FFF762C6B40F54F04401DFF04BA2C2E6A9690643EA

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004082F0(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				int _t13;
				long _t20;
				int _t25;
				void* _t27;
				void* _t32;

				_t32 = __eflags;
				_v68 = 0;
				E0041B850( &_v67, 0, 0x3f);
				E0041C3F0( &_v68, 3);
				_t12 = E0040ACC0(_t32, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E10(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t20 = _a8;
					_t13 = PostThreadMessageW(_t20, 0x111, 0, 0); // executed
					_t34 = _t13;
					if(_t13 == 0) {
						_t13 =  *_t25(_t20, 0x8003, _t27 + (E0040A450(_t34, 1, 8) & 0x000000ff) - 0x40, _t13);
					}
				}
				return _t13;
			}

0x004082f0
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 195adcb3c98d531bb162281db2f5ccaf52fb57ebc6795e714fc563aee22d5922
Instruction ID: 7ca1aeaa7978e6d3a4d0f1b4208387e2518013786dff53ee4b69e84d93d23419
Opcode Fuzzy Hash: 195adcb3c98d531bb162281db2f5ccaf52fb57ebc6795e714fc563aee22d5922
Instruction Fuzzy Hash: 7301AC31A803187BE720A6959C43FFF775C6B40F54F05411DFF04BA1C1D6A9691546FA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1B1, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F192,0040F192,0000003C,00000000,?,00409D35), ref: 0041A1F0

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 81e7f82f74da59e32287c8610a01331687c91399019749a179af90c6b8378f79
Instruction ID: 6abfda86bcbcaadf275e5732025c7802f3ad21e74311e4aa4e9a40d80b62961e
Opcode Fuzzy Hash: 81e7f82f74da59e32287c8610a01331687c91399019749a179af90c6b8378f79
Instruction Fuzzy Hash: 28F0E5B82042952BD710DF71D844ED33FA9DF41360F14459EF8991B143C034A45ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A060(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E0041A950(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x0041a06f
0x0041a077
0x0041a08d
0x0041a091

APIs

RtlFreeHeap.NTDLL(00000060,00409CC3,?,?,00409CC3,00000060,00000000,00000000,?,?,00409CC3,?,00000000), ref: 0041A08D

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 52797000195eaed384c72aa9dcce9225c0ea881c405841437723114bb70c3a82
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: AEE012B1210208ABDB18EF99CC49EA777ACAF88760F018559BA185B242C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F192,0040F192,0000003C,00000000,?,00409D35), ref: 0041A1F0

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 2f72ad50c13f3bcf2c9af244d49b542148f264c451808f1d297bb805e18cb808
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: CDE01AB12002086BDB10DF49CC85EE737ADAF88650F018555BA0C57241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A0, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A0A0(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E0041A950(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0041a0a3
0x0041a0ba
0x0041a0c8

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0C8

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 12fe1e20a4fde289fa2c932464272cdbd0b6c77391ac3b13e7111125b87f0676
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 14D012716102147BD620DB99CC85FD7779CDF48760F018465BA5C5B241C531BA1086E1

Uniqueness

Uniqueness Score: -1.00%

Function 0041A093, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041A093(intOrPtr _a4, int _a8) {
				void* _t12;

				asm("lds ebp, [edx-0x616c598e]");
				_t6 = _a4;
				E0041A950(_t12, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t6 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x0041a098
0x0041a0a3
0x0041a0ba
0x0041a0c8

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0C8

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1fc7d20f58702dfe1a6385b027fd4cb1ef8faf4408b6f8ab23ddb250741d824d
Instruction ID: 6ec1928867d70db06631118dd6a6670a4e80df2ae2211c676bcc51d2afbf419b
Opcode Fuzzy Hash: 1fc7d20f58702dfe1a6385b027fd4cb1ef8faf4408b6f8ab23ddb250741d824d
Instruction Fuzzy Hash: 27E08C753022046BD620EF54CDC9EC777689F09360F128899BA586F241D234EA00C7A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407AFA, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1669e11ad3f2db42f4edb2d1b6af7db5eb305ab2e62030786c1ba521431501a
Instruction ID: 55eabb77780294906751bcd01b9747c7c601a56198358abbad2850f632ef602e
Opcode Fuzzy Hash: f1669e11ad3f2db42f4edb2d1b6af7db5eb305ab2e62030786c1ba521431501a
Instruction Fuzzy Hash: F6D01233B5817509D9369D6CE8946B4FBB5DB83624F0013ABDC84B72918957B05241C9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D59, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.492622072.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7af3753b33950736067c3ba3dab4c3a1ac96de5145e04d7940ba504d0c7c6f
Instruction ID: 9801893d2f5d77c543fc2294b50c0aebf5bb5c1a5ce7f1126ec7bee5f6fadfab
Opcode Fuzzy Hash: be7af3753b33950736067c3ba3dab4c3a1ac96de5145e04d7940ba504d0c7c6f
Instruction Fuzzy Hash: A0D0C775B091018AC301AF5954415B1FB75E747161704229AF959D7651D321845287E9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: netsh.exe PID: 6864 Parent PID: 3440 netsh.exeCOMMON

Executed Functions

Function 02D89D4A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,02D84B77,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,02D84B77,007A002E,00000000,00000060,00000000,00000000), ref: 02D89D9D

Strings

.z`, xrefs: 02D89D8D, 02D89D98

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 3d249981c2f94a86238b41bd2d08ac809d6446110284ea8c76c0b66675d65cba
Instruction ID: 76683908b2718decd11cbe6e8d51e0fbe8ce745365fca5d7a9b8e2a2d1378bf2
Opcode Fuzzy Hash: 3d249981c2f94a86238b41bd2d08ac809d6446110284ea8c76c0b66675d65cba
Instruction Fuzzy Hash: E501EFB2200108AFCB08DF88CC91EEB33AAAF8C344F118248FA1C97240C630E8018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D89D50, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,02D84B77,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,02D84B77,007A002E,00000000,00000060,00000000,00000000), ref: 02D89D9D

Strings

.z`, xrefs: 02D89D8D, 02D89D98

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 7720e1a6ce42e296fb9c101d70e600c339323bbb8b022beb35bf637a0e6da466
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 76F0BDB2204208AFCB08DF88DC95EEB77ADAF8C754F158248BA1D97240C630E8118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D89E00, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(02D84D32,5EB6522D,FFFFFFFF,02D849F1,?,?,02D84D32,?,02D849F1,FFFFFFFF,5EB6522D,02D84D32,?,00000000), ref: 02D89E45

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 6d9a317e295f269919446d29b2447332723fa8796f269ed677a8d709db915683
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 3FF0A4B2200208AFCB14DF89DC91EEB77ADEF8C754F158249BA1D97241D630E8118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D89E7C, Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(02D84D10,?,?,02D84D10,00000000,FFFFFFFF), ref: 02D89EA5

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 4a8ce73e574b98a1c119f262e88fcf6cf625d9a6ae90818fedafe3a9836e9d42
Instruction ID: cf87ea96a92f0b01685ea7a5c4580932b77585ff11b7cf57fbf7216e9064cf1b
Opcode Fuzzy Hash: 4a8ce73e574b98a1c119f262e88fcf6cf625d9a6ae90818fedafe3a9836e9d42
Instruction Fuzzy Hash: 4FE0DF72240200BBCA11EBD4CC45EA77BADEF05220F114095BA095B302C530A90086E0

Uniqueness

Uniqueness Score: -1.00%

Function 02D89E80, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(02D84D10,?,?,02D84D10,00000000,FFFFFFFF), ref: 02D89EA5

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: a7865b851c4c122c3f9fb513e7ae43074989ffc6074ebe5d8707d506d00c4f04
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 12D01776200214ABD710EB98CC85EAB7BADEF48760F154499BA5C9B242C530FA008AE0

Uniqueness

Uniqueness Score: -1.00%

Function 037A9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A971A

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a2c1402db40efd1dd0b37f6fa6cf4b1d9f14eca53bd68d5ed8a36e82f9351936
Instruction ID: e248ac0fde0bbb18c3b9c6e044b10b442e6300df7b91fbe0b3b425ae164ab7ee
Opcode Fuzzy Hash: a2c1402db40efd1dd0b37f6fa6cf4b1d9f14eca53bd68d5ed8a36e82f9351936
Instruction Fuzzy Hash: FD90027120104807E150A99954087860065D7E4341F51D031A5014555EC7A598917171

Uniqueness

Uniqueness Score: -1.00%

Function 037A9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A9FEA

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 372b4887cfe0c6de54b74f04aa152fdca8924b88be537f5bebb3d921a35407e9
Instruction ID: d9210d3507be6727846b0b4ce3e0b3684bf1ae6fa4b4ee797358d0243a3d01f6
Opcode Fuzzy Hash: 372b4887cfe0c6de54b74f04aa152fdca8924b88be537f5bebb3d921a35407e9
Instruction Fuzzy Hash: F690027131118807E160A55984047460065D7D5241F51C431A0814558DC7D598917162

Uniqueness

Uniqueness Score: -1.00%

Function 037A9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A978A

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 11e1c55679b45ef882808028a558d3701b5517d8c4743e8503aca4944a6cffb2
Instruction ID: e490a115c7462b0529ca69240290c568d9b2d3eab530cbe834e5fb9c08e84161
Opcode Fuzzy Hash: 11e1c55679b45ef882808028a558d3701b5517d8c4743e8503aca4944a6cffb2
Instruction Fuzzy Hash: 7190026921304407E1D0B559540874A0065D7D5242F91D435A0005558CCA5598697361

Uniqueness

Uniqueness Score: -1.00%

Function 037A9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A9A5A

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: de3b8d8d94228c5c9affbcf983c87e1957ad09430d4fa52732c65ba31f2766c5
Instruction ID: c1c78c2fc942798baf84a5822983a371e8666885fd7cfb53beb8c79d6df3e539
Opcode Fuzzy Hash: de3b8d8d94228c5c9affbcf983c87e1957ad09430d4fa52732c65ba31f2766c5
Instruction Fuzzy Hash: 9590026121184447E250A9694C14B470065D7D4343F51C135A0144554CCA5598617561

Uniqueness

Uniqueness Score: -1.00%

Function 037A96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A96EA

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 979f9b7a412eeb72c9b30960c03934070a17124cc3d86a004a6fd565b970f876
Instruction ID: cc975a48d08155bd6c9612487d483d8648c9e1ee6f7bbf42899c0344f569b918
Opcode Fuzzy Hash: 979f9b7a412eeb72c9b30960c03934070a17124cc3d86a004a6fd565b970f876
Instruction Fuzzy Hash: E19002712010CC07E160A559840478A0065D7D4341F55C431A4414658DC7D598917161

Uniqueness

Uniqueness Score: -1.00%

Function 037A96D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A96DA

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8e415d27d73d9226b63f12fd9df92df0b6ac8f0e903e14b6eb2caa6286d61769
Instruction ID: cbc3c6a5704c54f20be81d197bf4fbe4a99133d81fea4e811801a5a2eadc0181
Opcode Fuzzy Hash: 8e415d27d73d9226b63f12fd9df92df0b6ac8f0e903e14b6eb2caa6286d61769
Instruction Fuzzy Hash: BF90027120104C47E150A5594404B860065D7E4341F51C036A0114654DC755D8517561

Uniqueness

Uniqueness Score: -1.00%

Function 037A9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A954A

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 74cf34be0c364599329075d4ba53e4f28452287aab69e7f77321d3a72fb7a220
Instruction ID: 9f3f6d9cff58f181039b41d3b0be55ce8d71712d558980f36bdeef4b645926c1
Opcode Fuzzy Hash: 74cf34be0c364599329075d4ba53e4f28452287aab69e7f77321d3a72fb7a220
Instruction Fuzzy Hash: 83900265211044075155E959070464700A6D7D9391351C031F1005550CD76198617161

Uniqueness

Uniqueness Score: -1.00%

Function 037A9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A991A

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ec6ea0aa57fa43aa05d40f0da56d9f576024edba8b6fcb0eb20ff9699dfc3a78
Instruction ID: e5be933e6413246b6be94a1b33aef9519b0b2dd9fd2b52233222a2032c413599
Opcode Fuzzy Hash: ec6ea0aa57fa43aa05d40f0da56d9f576024edba8b6fcb0eb20ff9699dfc3a78
Instruction Fuzzy Hash: 5F9002B120104807E190B55944047860065D7D4341F51C031A5054554EC7999DD576A5

Uniqueness

Uniqueness Score: -1.00%

Function 037A95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A95DA

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2a12b17842eaa6fc6161af0b263d6f024c56e173506a97c99d6e6e1138161b23
Instruction ID: 21f07fa56b6205fe972fdd6ee8fed5680eb4016ae36c46cdbd4ef18ae65db3f1
Opcode Fuzzy Hash: 2a12b17842eaa6fc6161af0b263d6f024c56e173506a97c99d6e6e1138161b23
Instruction Fuzzy Hash: 3D9002A1202044079155B5594414756406AD7E4241B51C031E1004590DC66598917165

Uniqueness

Uniqueness Score: -1.00%

Function 037A99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A99AA

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 08d7e9c9db7158138b98106c9e265e83be22bc21a417498ae9dbd7f899e1b967
Instruction ID: 1be302a4fdfe3ebedf7459615366dec61503efa26e6b652f234f52c7b93b8771
Opcode Fuzzy Hash: 08d7e9c9db7158138b98106c9e265e83be22bc21a417498ae9dbd7f899e1b967
Instruction Fuzzy Hash: B39002A134104847E150A5594414B460065D7E5341F51C035E1054554DC759DC527166

Uniqueness

Uniqueness Score: -1.00%

Function 037A9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A986A

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d57a654523186d1872b698a38e42bdcb2a4cfe3030528f57d2a84d0b391c46f3
Instruction ID: a269301871cf3b7f246386682f0b89b6afe687e8767e9c2f3ff8137ffa697d72
Opcode Fuzzy Hash: d57a654523186d1872b698a38e42bdcb2a4cfe3030528f57d2a84d0b391c46f3
Instruction Fuzzy Hash: 1B90027120104817E161A55945047470069D7D4281F91C432A0414558DD7969952B161

Uniqueness

Uniqueness Score: -1.00%

Function 037A9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A984A

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 09d64793c0735a559df0333d4c057cdd43b4f3004df776816baf48e2512d2e58
Instruction ID: 3750126772128ff3b4e5c5ac223db8deb5f75349d92ba4254b2a6fc37f50ef85
Opcode Fuzzy Hash: 09d64793c0735a559df0333d4c057cdd43b4f3004df776816baf48e2512d2e58
Instruction Fuzzy Hash: E290026124208557A595F55944046474066E7E4281791C032A1404950CC666A856F661

Uniqueness

Uniqueness Score: -1.00%

Function 02D78286, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02D7834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02D7836B

Strings

(, xrefs: 02D7828C

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID: (
API String ID: 1836367815-3887548279
Opcode ID: 0f77880918468b826ef316e0b605fa5662b05b4cbf0210c9ebd72f0a44e0bafb
Instruction ID: 94fe7fc55477fefb31c9a2ef31082d3602e30a4c80097da9f715a05d9a8e600d
Opcode Fuzzy Hash: 0f77880918468b826ef316e0b605fa5662b05b4cbf0210c9ebd72f0a44e0bafb
Instruction Fuzzy Hash: 9401D631A40218BAE720AB949C06FBE7728EF40B00F044119FE44FA2C1E6996D0A47F5

Uniqueness

Uniqueness Score: -1.00%

Function 02D8A060, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02D73AF8), ref: 02D8A08D

Strings

.z`, xrefs: 02D8A07C, 02D8A088

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: f169f61d14db3ac2b6aa5aa079ddfc4896b23958c1fd8a298e90385774243f0f
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 12E012B1200208ABDB18EF99CC49EAB77ADEF88750F018599BA185B241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 02D782B3, Relevance: 3.1, APIs: 2, Instructions: 71threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02D7834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02D7836B

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 674de84dc9db4dd8d795384c2e185764d14368e4d6e4d207fb7e58096c2d8b02
Instruction ID: c7a7f7b4ef528d1b35fd408dcc5fb38afff1329517a9fc87e39c95373335f480
Opcode Fuzzy Hash: 674de84dc9db4dd8d795384c2e185764d14368e4d6e4d207fb7e58096c2d8b02
Instruction Fuzzy Hash: 4B11E631940224BBD721A6A89C06FEE7369EF01B55F050059FA04FA2C1F7A9AD0687F1

Uniqueness

Uniqueness Score: -1.00%

Function 02D782E9, Relevance: 3.1, APIs: 2, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02D7834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02D7836B

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 5ed7abfa808dff033bc60c3a6ba676829cdb2273da32cd1a871efb644e9ca1e0
Instruction ID: be4d2763f2527151180912a62f57e42258cabc0404997ce46c9ad75a156cefb4
Opcode Fuzzy Hash: 5ed7abfa808dff033bc60c3a6ba676829cdb2273da32cd1a871efb644e9ca1e0
Instruction Fuzzy Hash: 8D012431A80228BBE720B6989C02FBE762CAB40B51F040019FF04FA2C1F6996D0647F1

Uniqueness

Uniqueness Score: -1.00%

Function 02D782F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02D7834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02D7836B

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a9eaf362903775027c150ff98c96e6efb369b36fefc0dc9cb72da198acfa231a
Instruction ID: afdf0797e66faf8e4a4cca0b756702d2ad1881617bcb413e5a7702957e0cf488
Opcode Fuzzy Hash: a9eaf362903775027c150ff98c96e6efb369b36fefc0dc9cb72da198acfa231a
Instruction Fuzzy Hash: 9D01A231A802287BE721B6989C06FBF776CAB40B55F050119FF04FA2C1F6996D064AF5

Uniqueness

Uniqueness Score: -1.00%

Function 02D8A231, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,02D7F192,02D7F192,?,00000000,?,?), ref: 02D8A1F0

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5a03e0d439bc587cf6d8f2d6a1aae73b66b7442a0b6c74102f1669eef416251d
Instruction ID: edb61e20d485792394abceb010f4bafdca84213cd2a97aebb221bb4bb68a2991
Opcode Fuzzy Hash: 5a03e0d439bc587cf6d8f2d6a1aae73b66b7442a0b6c74102f1669eef416251d
Instruction Fuzzy Hash: 5E11C4751082846FDB11FFB8DC91DABBBA9EF45210B15898AF8D847302C635E915CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02D7ACC0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 02D7AD32

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: 2306e30baa754a7e917c3bdbec85c57296ee4d7bb062e77239fab900d2b52135
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: 98011EB6E0020DABDB14EBA4EC41FDEB379AB44308F0045A5A90997240F635EB54CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D8A0D0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 02D8A124

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: c3ae4abb428406e3d5b1e6f06b0e83ae8a7a212fd0f583cffd9bff7c0aa6264d
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 0B01AFB2214108AFCB54DF89DC80EEB77ADAF8C754F158258BA0D97240C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D8A1B1, Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,02D7F192,02D7F192,?,00000000,?,?), ref: 02D8A1F0

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 0efb2b171b6206de05d9c5f2caa03bcfc09fc4014dc36b083393782b0a22da9d
Instruction ID: 65742df65fa731c9c261a12c1b5bfe1a398ca5c3817ec9149eab0414cfa033b5
Opcode Fuzzy Hash: 0efb2b171b6206de05d9c5f2caa03bcfc09fc4014dc36b083393782b0a22da9d
Instruction Fuzzy Hash: 4DF0E5B82082956BD710EF71D844ED73FA9DF41350F14419DF8991B142C034A81ACBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02D8A1C0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,02D7F192,02D7F192,?,00000000,?,?), ref: 02D8A1F0

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 0c9a4a94b34452f848e76327c05b093d98cf8521cdba3b80682d25e2d25f20f6
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 34E01AB1200208ABDB10EF49CC85EEB37ADEF88650F018155BA0C57241C934E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 02D7F690, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,02D78CF4,?), ref: 02D7F6BB

Memory Dump Source

Source File: 00000010.00000002.619310420.0000000002D70000.00000040.00020000.sdmp, Offset: 02D70000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: bd7eed9b85bb6cebd91b63191ba1be2b25adc80fa2c8cd41ead6a5cc6b7dd00d
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: 5DD0A7727903043BE610FBA4DC03F2732CDAB44B04F490064FA48DB3C3EA54E4008575

Uniqueness

Uniqueness Score: -1.00%

Function 037A967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 037A9694

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 07304f8c395b8595512d5c0f0a4613c532f84ced6f26bc4de683b6e227d260a9
Instruction ID: 7e61d0357bc4a5815b474808d1bb9ace439704dbbdd56b7f4309872bdb997fbc
Opcode Fuzzy Hash: 07304f8c395b8595512d5c0f0a4613c532f84ced6f26bc4de683b6e227d260a9
Instruction Fuzzy Hash: FDB09B719014D9CAE651D76446087177954BBD5741F16C171D2020641A4778D091F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0381B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

The instruction at %p tried to %s , xrefs: 0381B4B6
The critical section is owned by thread %p., xrefs: 0381B3B9
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0381B2F3
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0381B484
The resource is owned exclusively by thread %p, xrefs: 0381B374
*** enter .exr %p for the exception record, xrefs: 0381B4F1
*** An Access Violation occurred in %ws:%s, xrefs: 0381B48F
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0381B47D
This failed because of error %Ix., xrefs: 0381B446
The instruction at %p referenced memory at %p., xrefs: 0381B432
a NULL pointer, xrefs: 0381B4E0
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0381B2DC
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0381B3D6
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0381B305
an invalid address, %p, xrefs: 0381B4CF
<unknown>, xrefs: 0381B27E, 0381B2D1, 0381B350, 0381B399, 0381B417, 0381B48E
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0381B476
*** Resource timeout (%p) in %ws:%s, xrefs: 0381B352
write to, xrefs: 0381B4A6
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0381B38F
*** enter .cxr %p for the context, xrefs: 0381B50D
read from, xrefs: 0381B4AD, 0381B4B2
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0381B323
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0381B314
*** Inpage error in %ws:%s, xrefs: 0381B418
Go determine why that thread has not released the critical section., xrefs: 0381B3C5
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0381B39B
*** then kb to get the faulting stack, xrefs: 0381B51C
The resource is owned shared by %d threads, xrefs: 0381B37E
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0381B53F

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: b664b27b0a217f40d19e900bf7b77f9569aa3e0ea61560319b4b5b52c7d14664
Instruction ID: 20aa795b98701e0bfe742b252684aae2af003577b7bdf0913905d9e86cc7171b
Opcode Fuzzy Hash: b664b27b0a217f40d19e900bf7b77f9569aa3e0ea61560319b4b5b52c7d14664
Instruction Fuzzy Hash: 2F8117B5A00200FFDB26EB85CC49D6F3F29EF46765F4440C8F9149F212D3A59561DAB2

Uniqueness

Uniqueness Score: -1.00%

Function 03821C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E03821C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x37448a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0376B150();
				} else {
					E0376B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x385589c);
				E0376B150("Heap error detected at %p (heap handle %p)\n",  *0x38558a0);
				_t27 =  *0x3855898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M03821E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0376B150();
				} else {
					E0376B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0376B150("Error code: %d - %s\n",  *0x3855898);
				_t113 =  *0x38558a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0376B150();
					} else {
						E0376B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0376B150("Parameter1: %p\n",  *0x38558a4);
				}
				_t115 =  *0x38558a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0376B150();
					} else {
						E0376B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0376B150("Parameter2: %p\n",  *0x38558a8);
				}
				_t117 =  *0x38558ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0376B150();
					} else {
						E0376B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0376B150("Parameter3: %p\n",  *0x38558ac);
				}
				_t119 =  *0x38558b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0376B150();
					} else {
						E0376B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x38558b4);
					E0376B150("Last known valid blocks: before - %p, after - %p\n",  *0x38558b0);
				} else {
					_t120 =  *0x38558b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0376B150();
				} else {
					E0376B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0376B150("Stack trace available at %p\n", 0x38558c0);
			}

0x03821c10
0x03821c16
0x03821c1e
0x03821c3d
0x03821c3e
0x03821c20
0x03821c35
0x03821c3a
0x03821c44
0x03821c55
0x03821c5a
0x03821c65
0x03821c67
0x00000000
0x03821c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x03821c67
0x03821cdc
0x03821ce5
0x03821d04
0x03821d05
0x03821ce7
0x03821cfc
0x03821d01
0x03821d0b
0x03821d17
0x03821d1f
0x03821d25
0x03821d30
0x03821d4f
0x03821d50
0x03821d32
0x03821d47
0x03821d4c
0x03821d61
0x03821d67
0x03821d68
0x03821d6e
0x03821d79
0x03821d98
0x03821d99
0x03821d7b
0x03821d90
0x03821d95
0x03821daa
0x03821db0
0x03821db1
0x03821db7
0x03821dc2
0x03821de1
0x03821de2
0x03821dc4
0x03821dd9
0x03821dde
0x03821df3
0x03821df9
0x03821dfa
0x03821e00
0x03821e0a
0x03821e13
0x03821e32
0x03821e33
0x03821e15
0x03821e2a
0x03821e2f
0x03821e39
0x03821e4a
0x03821e02
0x03821e02
0x03821e08
0x00000000
0x00000000
0x03821e08
0x03821e5b
0x03821e7a
0x03821e7b
0x03821e5d
0x03821e72
0x03821e77
0x03821e95

Strings

heap_failure_buffer_underrun, xrefs: 03821C9F
Parameter1: %p, xrefs: 03821D5C
heap_failure_lfh_bitmap_mismatch, xrefs: 03821CD7
HEAP[%wZ]: , xrefs: 03821C30, 03821CF7, 03821D42, 03821D8B, 03821DD4, 03821E25, 03821E6D
Parameter2: %p, xrefs: 03821DA5
heap_failure_cross_heap_operation, xrefs: 03821CC2
heap_failure_unknown, xrefs: 03821C75
heap_failure_virtual_block_corruption, xrefs: 03821C91
heap_failure_invalid_argument, xrefs: 03821CAD
HEAP: , xrefs: 03821C16, 03821C3D, 03821D04, 03821D4F, 03821D98, 03821DE1, 03821E32, 03821E7A
heap_failure_listentry_corruption, xrefs: 03821CD0
heap_failure_buffer_overrun, xrefs: 03821C98
heap_failure_generic, xrefs: 03821C7C
Parameter3: %p, xrefs: 03821DEE
Heap error detected at %p (heap handle %p), xrefs: 03821C50
heap_failure_freelists_corruption, xrefs: 03821CC9
heap_failure_multiple_entries_corruption, xrefs: 03821C8A
heap_failure_internal, xrefs: 03821C6E
heap_failure_invalid_allocation_type, xrefs: 03821CB4
Stack trace available at %p, xrefs: 03821E86
Last known valid blocks: before - %p, after - %p, xrefs: 03821E45
heap_failure_block_not_busy, xrefs: 03821CA6
heap_failure_usage_after_free, xrefs: 03821CBB
Error code: %d - %s, xrefs: 03821D12
heap_failure_entry_corruption, xrefs: 03821C83

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: a4d1d1a6dfcb54363326c8a4223b4a8aa8ba14bc0efdc99b81170b2c40ea7f42
Instruction ID: 25b454170082487afff8daa3a6bdfeb5fea28885a5bee290e2c76d6941b67331
Opcode Fuzzy Hash: a4d1d1a6dfcb54363326c8a4223b4a8aa8ba14bc0efdc99b81170b2c40ea7f42
Instruction Fuzzy Hash: C461027B61165CEFD219EBC9D8DDA2577A4EB05A34B1880FAFC0ADF701C6749880CB09

Uniqueness

Uniqueness Score: -1.00%

Function 03773D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E03773D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E03771B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E03771B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E03771B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E03771B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E03771B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L03784620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E037AF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E037B1370(_t276, 0x3744e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E037ABB40(0,  &_v68, _t170);
									if(L037743C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E037ABB40(_t257,  &_v68, _t243);
								if(L037743C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E037B1370(_t278, 0x3744e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L03784620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E037AF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E037B1370(_v16, 0x3744e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E037ABB40(_t262,  &_v68, _t244);
								if(L037743C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E037B1370(_t282, 0x3744e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E037ABB40(_t262,  &_v68, _t201);
							if(L037743C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L03784620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E037AF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E037B1370(_t280, 0x3744e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E037ABB40(_t267,  &_v68, _t245);
							if(L037743C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E037B1370(_t284, 0x3744e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E037ABB40(_t267,  &_v68, _t224);
						if(L037743C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x03773d3c
0x03773d42
0x03773d44
0x03773d46
0x03773d49
0x03773d4c
0x03773d4f
0x03773d52
0x03773d55
0x03773d58
0x03773d5b
0x03773d5f
0x03773d61
0x03773d66
0x037c8213
0x037c8218
0x03774085
0x03774088
0x0377408e
0x03774094
0x0377409a
0x037740a0
0x037740a6
0x037740a9
0x037740af
0x037740b6
0x037740bd
0x037740bd
0x03773d83
0x037c821f
0x037c8229
0x037c8238
0x037c8238
0x037c823d
0x037c823d
0x03773da0
0x03773daf
0x03773db5
0x03773dba
0x03773dba
0x03773dd4
0x03773e94
0x03773eab
0x03773f6d
0x03773f84
0x0377406b
0x0377406b
0x0377406e
0x0377406e
0x03774070
0x03774074
0x037c8351
0x037c8351
0x0377407a
0x0377407f
0x037c835d
0x037c8370
0x037c8377
0x037c8379
0x037c837c
0x037c837c
0x037c835d
0x00000000
0x0377407f
0x03773f8a
0x03773f8d
0x03773f90
0x03773f95
0x037c830d
0x037c830f
0x03773f9b
0x03773fac
0x03773fae
0x03773fb1
0x03773fb1
0x03773fb6
0x037c8317
0x037c831a
0x00000000
0x03773fbc
0x03773fc1
0x03773fc9
0x03773fd7
0x03773fda
0x03773fdd
0x03774021
0x03774021
0x03774029
0x03774030
0x03774044
0x03774046
0x03774046
0x03774044
0x03774049
0x037c8327
0x037c8334
0x037c8339
0x037c833c
0x0377404f
0x0377404f
0x0377404f
0x03774051
0x03774056
0x03774063
0x03774063
0x03774068
0x00000000
0x03774068
0x03773fdf
0x03773fe2
0x03773fe4
0x03773fe7
0x03773fef
0x03774003
0x03774005
0x03774005
0x0377400c
0x03774013
0x03774016
0x03774017
0x0377401b
0x0377401e
0x00000000
0x0377401e
0x03773fb6
0x03773eb1
0x03773eb4
0x03773eb7
0x03773ebc
0x037c82a9
0x037c82ab
0x03773ec2
0x03773ed3
0x03773ed5
0x03773ed8
0x03773ed8
0x03773edd
0x037c82b3
0x037c82b6
0x00000000
0x03773ee3
0x03773ee8
0x03773eed
0x03773ef0
0x03773ef3
0x03773f02
0x03773f05
0x03773f08
0x037c82c0
0x037c82c3
0x037c82c5
0x037c82c8
0x037c82d0
0x037c82e4
0x037c82e6
0x037c82e6
0x037c82ed
0x037c82f4
0x037c82f7
0x037c82f8
0x037c82fc
0x037c82ff
0x037c82ff
0x03773f0e
0x03773f11
0x03773f16
0x03773f1d
0x03773f31
0x037c8307
0x037c8307
0x03773f31
0x03773f39
0x03773f48
0x03773f4d
0x03773f50
0x03773f50
0x03773f53
0x03773f58
0x03773f65
0x03773f65
0x03773f6a
0x00000000
0x03773f6a
0x03773edd
0x03773dda
0x03773ddd
0x03773de0
0x03773de5
0x037c8245
0x03773deb
0x03773df7
0x03773dfc
0x03773dfe
0x03773e01
0x03773e01
0x03773e06
0x037c824d
0x037c824f
0x037c8254
0x00000000
0x03773e0c
0x03773e11
0x03773e16
0x03773e19
0x03773e29
0x03773e2c
0x03773e2f
0x037c825c
0x037c825f
0x037c8261
0x037c8264
0x037c826c
0x037c8280
0x037c8282
0x037c8282
0x037c8289
0x037c8290
0x037c8293
0x037c8294
0x037c8298
0x037c829b
0x037c829b
0x03773e35
0x03773e38
0x03773e3d
0x03773e44
0x03773e58
0x037c82a3
0x037c82a3
0x03773e58
0x03773e60
0x03773e6f
0x03773e74
0x03773e77
0x03773e77
0x03773e7a
0x03773e7f
0x03773e8c
0x03773e8c
0x03773e91
0x00000000
0x03773e91

Strings

WindowsExcludedProcs, xrefs: 03773D6F
Kernel-MUI-Language-Disallowed, xrefs: 03773E97
Kernel-MUI-Number-Allowed, xrefs: 03773D8C
Kernel-MUI-Language-Allowed, xrefs: 03773DC0
Kernel-MUI-Language-SKU, xrefs: 03773F70

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 25bc4c76ed59bf3a110822a4c94b68e0c39dae86fca5bc9aee37af8126203a8e
Instruction ID: 0d62495fff19c61a9124866746fc76be22062535a4c922129cf3dbe5cfb22787
Opcode Fuzzy Hash: 25bc4c76ed59bf3a110822a4c94b68e0c39dae86fca5bc9aee37af8126203a8e
Instruction Fuzzy Hash: 70F16A76D10658EFCF11DF99C984AEEBBB9FF48750F14016AE805AB210E7709E01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03777E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E03777E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0377CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0376C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x3855780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E037E5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x3855780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E03787D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E03787D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E037E7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E03787D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E03787D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E037E7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E0379A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0376B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x03777e4c
0x03777e50
0x03777e55
0x03777e58
0x03777e5d
0x03777e71
0x03777f33
0x03777e77
0x03777e77
0x03777e79
0x03777e79
0x03777e7e
0x03777f45
0x037c9848
0x00000000
0x037c9848
0x03777f4e
0x03777f53
0x03777f5a
0x00000000
0x00000000
0x037c985a
0x037c9862
0x037c9866
0x00000000
0x037c986c
0x00000000
0x037c986c
0x03777e84
0x03777e84
0x03777e8d
0x037c9871
0x03777eb8
0x03777ec0
0x03777ec0
0x03777e9a
0x037c987e
0x00000000
0x00000000
0x037c9884
0x037c988b
0x037c98a7
0x037c98ac
0x037c98b1
0x037c98b6
0x037c98b8
0x037c98b8
0x037c98b9
0x00000000
0x037c98b9
0x03777ea0
0x03777ea7
0x00000000
0x00000000
0x03777eac
0x03777eb1
0x03777ec6
0x03777ed0
0x037c98cc
0x03777ed6
0x03777ed6
0x03777ed6
0x03777ede
0x03777ee3
0x037c98e3
0x037c98f0
0x037c9902
0x037c98f2
0x037c98fb
0x037c98fb
0x037c9907
0x037c991d
0x037c991d
0x037c9907
0x037c98e3
0x03777ef0
0x03777f14
0x03777f14
0x03777f1e
0x037c9946
0x03777f24
0x03777f24
0x03777f24
0x03777f2c
0x037c996a
0x037c9975
0x037c9975
0x037c997e
0x037c9993
0x037c9993
0x037c997e
0x00000000
0x03777ef2
0x03777efc
0x03777f0a
0x03777f0e
0x037c9933
0x00000000
0x037c9933
0x00000000
0x03777f0e
0x00000000
0x00000000
0x00000000
0x03777eb1

Strings

LdrpCompleteMapModule, xrefs: 037C9898
Could not validate the crypto signature for DLL %wZ, xrefs: 037C9891
minkernel\ntdll\ldrmap.c, xrefs: 037C98A2

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 0aec4cd2d76eb74a499bc89e4944ec0291800ac40b0e5692155a844d146346a0
Instruction ID: 45b310e2c83cd6be9195cd0df2bdbaeec74cce5c5cb71b16ff8ce81184c62a56
Opcode Fuzzy Hash: 0aec4cd2d76eb74a499bc89e4944ec0291800ac40b0e5692155a844d146346a0
Instruction Fuzzy Hash: 0F5101316107C59BEB29CB68C944B3ABBE4BB46314F1806ADE9629B7E1D7B0ED00C750

Uniqueness

Uniqueness Score: -1.00%

Function 0376E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0376E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0376F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E037A95D0();
						}
						if(_t78 != 0) {
							L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E037AFA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E037ABB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E037A9600();
					if(_t97 < 0) {
						goto L6;
					}
					E037ABB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0376F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E037ABB40(_t83, _t102 + 0x24, _t78);
								if(L037743C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E037ABB40(_t84, _t102 + 0x24, _t94);
									if(L037743C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x0376e620
0x0376e628
0x0376e62f
0x0376e631
0x0376e635
0x0376e637
0x0376e63e
0x037c5503
0x037c5503
0x0376e64c
0x0376e64c
0x0376e651
0x00000000
0x00000000
0x0376e661
0x0376e665
0x037c542a
0x0376e715
0x0376e71a
0x0376e71c
0x0376e720
0x0376e720
0x0376e727
0x0376e736
0x0376e736
0x0376e743
0x0376e743
0x0376e673
0x0376e678
0x0376e67d
0x0376e682
0x0376e685
0x0376e692
0x0376e69b
0x0376e6a3
0x0376e6ad
0x0376e6b1
0x0376e6b2
0x0376e6bb
0x0376e6bf
0x0376e6c0
0x0376e6c8
0x0376e6cc
0x0376e6d5
0x0376e6d9
0x00000000
0x00000000
0x0376e6e5
0x0376e6ea
0x0376e6f9
0x0376e70b
0x0376e70f
0x037c5439
0x037c545e
0x037c545e
0x00000000
0x037c545e
0x037c543b
0x037c543e
0x037c5440
0x037c5445
0x037c5472
0x037c5475
0x037c548d
0x037c5493
0x037c54a9
0x00000000
0x00000000
0x037c54ab
0x037c54b4
0x037c54bc
0x037c54c8
0x037c54de
0x037c54fb
0x037c54e0
0x037c54e6
0x037c54eb
0x037c54eb
0x037c54de
0x00000000
0x037c54bc
0x037c5477
0x037c547a
0x037c5480
0x037c5483
0x037c5486
0x037c548b
0x00000000
0x00000000
0x00000000
0x037c548b
0x00000000
0x00000000
0x00000000
0x00000000
0x037c5447
0x037c5447
0x037c5447
0x037c5447
0x037c544e
0x00000000
0x00000000
0x037c5450
0x037c5452
0x037c5455
0x037c545a
0x00000000
0x00000000
0x00000000
0x037c545c
0x037c546a
0x037c546d
0x037c546f
0x00000000
0x037c546f
0x0376e70f

Strings

InstallLanguageFallback, xrefs: 0376E6DB
@, xrefs: 0376E6C0
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0376E68C

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: c92277e9e99a94e9cbd7ff7de4af9aa44627774babff138341cebfe9dde6fbe1
Instruction ID: c962633a5c52d14afa4f62288a32f2d137245baffea10bac2f09d76354297446
Opcode Fuzzy Hash: c92277e9e99a94e9cbd7ff7de4af9aa44627774babff138341cebfe9dde6fbe1
Instruction Fuzzy Hash: 1D51F5765183459BC710DF26D454BABB3E8BF89724F09092EF985DB240F731EA04CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0376B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0376B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x383f7a8);
				E037BD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E037BD130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E037AD000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E037AF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L037BDEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E037AB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E037AB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E037AE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E037AA890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x0376b171
0x0376b171
0x0376b171
0x0376b171
0x0376b171
0x0376b176
0x0376b17b
0x0376b180
0x0376b186
0x0376b18f
0x0376b198
0x0376b1a4
0x0376b1aa
0x037c4802
0x037c4802
0x037c4805
0x037c480c
0x037c480e
0x0376b1d1
0x0376b1d3
0x0376b1de
0x0376b1de
0x037c4817
0x037c481e
0x037c4820
0x037c4822
0x037c4822
0x037c4824
0x037c4824
0x037c482a
0x00000000
0x00000000
0x037c4835
0x037c483a
0x037c483d
0x037c483f
0x037c4842
0x037c4842
0x037c4842
0x037c4846
0x037c484c
0x037c484e
0x037c4851
0x037c4851
0x037c4853
0x037c4854
0x037c4854
0x037c4858
0x037c485a
0x037c485a
0x037c485d
0x037c485f
0x037c4861
0x037c4861
0x037c4866
0x037c486b
0x037c486e
0x037c4871
0x037c4876
0x037c4876
0x037c4878
0x037c487b
0x037c4884
0x037c4884
0x00000000
0x037c487d
0x037c487d
0x037c4882
0x037c4889
0x037c4889
0x037c488f
0x037c4891
0x037c48e0
0x037c48e2
0x037c48e4
0x037c48e4
0x037c48e7
0x037c48e7
0x037c48ed
0x037c48f4
0x037c48f6
0x037c4951
0x037c4951
0x037c4953
0x037c4953
0x037c4956
0x037c4956
0x037c4958
0x037c4959
0x037c4959
0x037c495d
0x037c495d
0x037c495f
0x037c495f
0x037c4965
0x037c4969
0x037c49ba
0x037c49ba
0x037c49c1
0x037c49c5
0x037c49cc
0x037c49d4
0x037c49d7
0x037c49da
0x037c49e4
0x037c49e5
0x037c49f3
0x037c4a02
0x00000000
0x037c4a02
0x037c4972
0x037c4974
0x00000000
0x00000000
0x037c4976
0x037c4979
0x037c4982
0x037c4983
0x037c4984
0x037c498b
0x037c498d
0x037c4991
0x037c4993
0x037c4999
0x037c499d
0x037c49a2
0x037c49a2
0x037c49a2
0x037c4999
0x037c49ac
0x00000000
0x037c49b3
0x037c48f8
0x037c48fe
0x00000000
0x00000000
0x00000000
0x037c48fe
0x037c4895
0x037c489c
0x037c48ad
0x037c48b2
0x037c48b5
0x037c48b7
0x037c48ba
0x037c48bc
0x037c48c6
0x037c48c6
0x037c48cb
0x037c48d1
0x037c48d4
0x037c48d8
0x037c48d8
0x00000000
0x037c48d8
0x037c48be
0x037c48c0
0x00000000
0x00000000
0x037c48c2
0x00000000
0x00000000
0x00000000
0x037c48c4
0x00000000
0x037c4882
0x037c487b
0x037c4904
0x037c4906
0x00000000
0x00000000
0x037c4908
0x037c490e
0x00000000
0x00000000
0x037c4910
0x037c4917
0x037c4917
0x00000000
0x037c4917
0x0376b1ba
0x037c47f9
0x037c47fc
0x00000000
0x00000000
0x00000000
0x037c47fc
0x0376b1c0
0x0376b1c0
0x0376b1c3
0x0376b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 037C48AD

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 39a84103f97e7de2c880cccb02b7890cc5100a928d3772e9d65614d3f1e5915f
Instruction ID: f573c5041ed93d5757d7bd80eb77420895dcb6370e73493d89307af188d37b7d
Opcode Fuzzy Hash: 39a84103f97e7de2c880cccb02b7890cc5100a928d3772e9d65614d3f1e5915f
Instruction Fuzzy Hash: FD510275D242A98FDF36CF69C864BAEBBF0BF04310F1442ADD859AB281D7744941EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0378B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0378B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x385d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E03787D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E03838CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E037A9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E037AB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E037ACE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E03787D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E03838F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E037AAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x3858628; // 0x0
								_v68 = _t77;
								_t78 =  *0x385862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x3858628; // 0x0
							_t116 =  *0x385862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0378b94c
0x0378b956
0x0378b95c
0x0378b95e
0x0378b964
0x0378b969
0x0378b96d
0x0378b96d
0x0378b970
0x0378b974
0x0378b97a
0x0378badf
0x0378badf
0x0378bae2
0x0378bae4
0x0378bae6
0x0378baf0
0x037d2cb8
0x0378baf6
0x0378baf6
0x0378baf6
0x0378bafd
0x0378bb1f
0x0378bb1f
0x0378baff
0x0378bb00
0x0378bb00
0x0378bb03
0x0378bb03
0x0378bacb
0x0378bacf
0x0378bad0
0x0378bad1
0x0378badc
0x0378badc
0x0378b980
0x0378b980
0x0378b988
0x0378b98b
0x0378b98d
0x0378b990
0x0378b993
0x0378b999
0x0378b99b
0x0378b9a1
0x0378b9a5
0x0378b9aa
0x0378b9b0
0x0378b9bb
0x0378b9c0
0x0378b9c3
0x0378b9ca
0x0378b9cc
0x0378b9cf
0x0378b9d3
0x0378b9d7
0x0378ba94
0x0378ba94
0x0378ba98
0x0378baa3
0x037d2ccb
0x0378baa9
0x0378baa9
0x0378baa9
0x0378bab1
0x037d2cd5
0x037d2cdd
0x037d2cdd
0x0378babb
0x0378babc
0x0378bac2
0x0378bac3
0x0378bac3
0x0378bac6
0x00000000
0x0378b9dd
0x0378b9dd
0x0378b9e7
0x0378b9e7
0x0378b9ec
0x0378b9ec
0x0378b9f1
0x0378b9f5
0x0378b9fa
0x0378ba00
0x0378ba0c
0x0378ba10
0x0378ba10
0x0378ba12
0x0378ba18
0x00000000
0x00000000
0x0378bb26
0x0378bb26
0x0378ba1e
0x0378ba1e
0x0378ba23
0x0378ba25
0x0378ba2c
0x0378ba30
0x0378ba35
0x0378ba35
0x0378ba41
0x0378ba46
0x0378ba4c
0x0378ba50
0x0378ba54
0x0378ba6a
0x0378ba6e
0x0378ba70
0x0378ba74
0x0378ba78
0x0378ba7a
0x0378ba7c
0x0378ba8e
0x0378ba90
0x0378ba92
0x0378bb14
0x0378bb14
0x0378bb16
0x0378bb16
0x00000000
0x0378ba7c
0x0378bb0a
0x0378bb0d
0x00000000
0x00000000
0x00000000
0x0378bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0378B9A5

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 80bc4110239b08d6c668a0b74eb95d6865316e05563588e0e52bc9d85d573f01
Instruction ID: 9c152bc9b070bccc184bbc26c78119c4457b0db3c1e1bbbd471be840b8e114e0
Opcode Fuzzy Hash: 80bc4110239b08d6c668a0b74eb95d6865316e05563588e0e52bc9d85d573f01
Instruction Fuzzy Hash: 11515971A08741CFC720EF29C4C492AFBE9FB88610F1849AEF59697354D771E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0379FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0379FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E0377EEF0(0x3857b60);
					_t134 =  *0x3857b84; // 0x77f07b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x3857b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x3857b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E03776D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E037776E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E03808938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E0376B150();
													}
													_t116 = E03806D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E037775CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x3858638; // 0x0
																	_t122 = L037738A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E037776E2(_t154);
																			goto L41;
																		}
																	} else {
																		E037776E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L0379FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L037770F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E0379FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E0379FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E0379FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E0379FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E0379FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x3857b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x3857b84 = _t75;
						_t73 = E0377EB70(_t134, 0x3857b60);
						if( *0x3857b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E0377FF60( *0x3857b20);
							}
						}
						goto L5;
					}
				}
			}

0x0379fab0
0x0379fab2
0x0379fab3
0x0379fab4
0x0379fabc
0x0379fac0
0x0379fb14
0x0379fb17
0x0379fac2
0x0379fac8
0x0379facd
0x0379fad3
0x0379fad3
0x0379fadd
0x0379fb18
0x0379fb1b
0x0379fb1d
0x0379fb1e
0x0379fb1f
0x0379fb20
0x0379fb21
0x0379fb22
0x0379fb23
0x0379fb24
0x0379fb25
0x0379fb26
0x0379fb27
0x0379fb28
0x0379fb29
0x0379fb2a
0x0379fb2b
0x0379fb2c
0x0379fb2d
0x0379fb2e
0x0379fb2f
0x0379fb3a
0x0379fb3b
0x0379fb3e
0x0379fb41
0x0379fb44
0x0379fb47
0x0379fb4a
0x0379fb4d
0x0379fb53
0x037dbdcb
0x037dbdcb
0x0379fb59
0x0379fb5b
0x0379fb5b
0x0379fb5e
0x037dbdd5
0x037dbdd8
0x00000000
0x037dbdda
0x00000000
0x037dbdda
0x0379fb64
0x0379fb64
0x0379fb64
0x0379fb67
0x0379fb6e
0x0379fb70
0x0379fb72
0x00000000
0x0379fb78
0x0379fb7a
0x0379fb7a
0x0379fb7d
0x0379fb80
0x037dbddf
0x037dbde1
0x00000000
0x037dbde3
0x00000000
0x037dbde3
0x0379fb86
0x0379fb86
0x0379fb86
0x0379fb8b
0x0379fb90
0x0379fb92
0x0379fb94
0x0379fb9a
0x0379fb9b
0x0379fba1
0x037dbde8
0x037dbdeb
0x037dbded
0x037dbeb5
0x037dbeb5
0x037dbebb
0x037dbebd
0x037dbec3
0x037dbed2
0x037dbedd
0x037dbedd
0x037dbeed
0x00000000
0x037dbdf3
0x037dbdfe
0x037dbe06
0x037dbe0b
0x037dbe0d
0x037dbe0f
0x037dbe14
0x037dbe19
0x037dbe20
0x037dbe25
0x037dbe27
0x037dbe35
0x037dbe39
0x037dbe46
0x037dbe4f
0x037dbe54
0x037dbe56
0x037dbef8
0x037dbef8
0x00000000
0x037dbe5c
0x037dbe5c
0x037dbe60
0x00000000
0x037dbe66
0x037dbe66
0x037dbe7f
0x037dbe84
0x037dbe87
0x037dbe89
0x037dbe8b
0x037dbe99
0x037dbe9d
0x037dbea0
0x037dbeac
0x037dbeaf
0x037dbeb1
0x037dbeb3
0x037dbeb3
0x00000000
0x037dbea2
0x037dbea2
0x00000000
0x037dbea2
0x037dbe8d
0x037dbe8d
0x037dbe92
0x00000000
0x037dbe92
0x037dbe8b
0x037dbe60
0x037dbe3b
0x037dbe3b
0x037dbe3e
0x00000000
0x037dbe40
0x037dbe40
0x037dbe44
0x00000000
0x00000000
0x00000000
0x00000000
0x037dbe44
0x037dbe3e
0x037dbe29
0x037dbe29
0x00000000
0x037dbe29
0x037dbe27
0x00000000
0x0379fba7
0x0379fba7
0x0379fbab
0x037dbf02
0x0379fbb1
0x0379fbb1
0x0379fbb8
0x0379fbbd
0x0379fbbd
0x0379fbbf
0x0379fbbf
0x0379fbc5
0x0379fbcb
0x0379fbf8
0x0379fbf8
0x0379fbfa
0x00000000
0x0379fc00
0x0379fc00
0x0379fc03
0x00000000
0x0379fc09
0x0379fc09
0x0379fc0f
0x0379fc15
0x0379fc23
0x0379fc23
0x0379fc25
0x0379fc27
0x0379fc75
0x0379fc7c
0x0379fc84
0x00000000
0x0379fc29
0x0379fc29
0x0379fc2d
0x0379fc30
0x037dbf0f
0x00000000
0x0379fc36
0x0379fc38
0x0379fc3b
0x0379fc41
0x037dbf17
0x037dbf19
0x037dbf48
0x037dbf4b
0x00000000
0x037dbf1b
0x037dbf22
0x037dbf24
0x037dbf26
0x00000000
0x037dbf2c
0x037dbf37
0x037dbf39
0x037dbf3b
0x00000000
0x037dbf41
0x037dbf41
0x037dbf41
0x037dbf41
0x037dbf45
0x00000000
0x037dbf45
0x037dbf3b
0x037dbf26
0x00000000
0x0379fc47
0x0379fc47
0x0379fc49
0x0379fcb2
0x0379fcb4
0x0379fcb6
0x0379fcdc
0x0379fcdc
0x00000000
0x0379fcb8
0x0379fcc3
0x0379fcc5
0x0379fcc7
0x00000000
0x0379fcc9
0x0379fcc9
0x0379fccd
0x00000000
0x0379fccd
0x0379fcc7
0x00000000
0x0379fc4b
0x0379fc4b
0x0379fc4e
0x0379fc4e
0x0379fc51
0x0379fc51
0x0379fc54
0x0379fc5a
0x0379fc5c
0x0379fc5f
0x0379fc61
0x0379fc63
0x0379fc65
0x0379fc67
0x0379fc6e
0x0379fc72
0x0379fc72
0x0379fc72
0x0379fc72
0x0379fc67
0x0379fc61
0x00000000
0x0379fc5a
0x0379fc49
0x0379fc41
0x0379fc30
0x0379fc27
0x0379fc03
0x0379fbcd
0x0379fbd3
0x0379fbd9
0x0379fbdc
0x0379fbde
0x0379fc99
0x0379fc9b
0x0379fc9d
0x0379fcd5
0x0379fcd5
0x0379fc89
0x0379fc89
0x00000000
0x0379fc9f
0x0379fc9f
0x0379fca3
0x00000000
0x0379fca3
0x00000000
0x0379fbe4
0x0379fbe4
0x0379fbe4
0x0379fbe4
0x0379fbe9
0x0379fbf2
0x00000000
0x0379fbf2
0x0379fbde
0x0379fbcb
0x0379fbab
0x0379fc8b
0x0379fc8b
0x0379fc8c
0x0379fb80
0x0379fb72
0x0379fb5e
0x0379fc8d
0x0379fc91
0x0379fadf
0x0379fadf
0x0379fae1
0x0379fae4
0x0379fae7
0x0379faec
0x0379faf8
0x0379fb00
0x0379fb07
0x0379fb0f
0x0379fb0f
0x0379fb07
0x00000000
0x0379faf8
0x0379fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 037DBE0F

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 9b436ad8de34231c57a171559cd3f31e141b1cca35998eb5b49591d447e03e5f
Instruction ID: 0fecc3010c5f6a5a349e75529a8b88e4bd6638b4e1d1da83f30627190e3f020a
Opcode Fuzzy Hash: 9b436ad8de34231c57a171559cd3f31e141b1cca35998eb5b49591d447e03e5f
Instruction Fuzzy Hash: E5A10475B007058BEF25DF68D454B7AB3F5AF49712F0986ABE906DB680DB30D841CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03762D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E03762D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x3855350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x3857bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E037A97C0();
				}
				if( *0x38579c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x38579c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E03791624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E03787D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E037FFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E037A9520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0379E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L037BDF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x3856901;
								_push(_t109);
								_v52 = _t98;
								if( *0x3856901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E037A9980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E037A95D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E03787D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E03787D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E037E7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E037FFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x3855350;
							if(_t109 != 0x3855350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E037FFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E037F5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x03762d8a
0x03762d8a
0x03762d92
0x03762d96
0x03762d9e
0x03762da0
0x03762da3
0x03762da5
0x03762da8
0x03762dab
0x03762db2
0x037bf9aa
0x037bf9ab
0x037bf9ae
0x037bf9ae
0x03762db8
0x03762dc2
0x037bf9b9
0x037bf9be
0x037bf9bf
0x037bf9bf
0x03762dcf
0x037bf9c9
0x03762dd5
0x03762dd5
0x03762dd5
0x03762dde
0x03762de1
0x03762e70
0x03762e72
0x03762e72
0x03762de7
0x03762deb
0x03762e7c
0x03762e83
0x03762e85
0x03762e8b
0x03762e8d
0x03762e92
0x03762e92
0x03762e85
0x03762df1
0x03762df7
0x03762df9
0x03762df9
0x03762dfc
0x03762dff
0x03762e02
0x00000000
0x03762e05
0x03762e0c
0x037bf9d9
0x03762e12
0x03762e12
0x03762e12
0x03762e1a
0x037bf9e3
0x037bf9e9
0x037bf9f0
0x037bf9f6
0x037bf9f8
0x037bf9f8
0x037bf9f0
0x03762e23
0x037bfa02
0x037bfa03
0x037bfa05
0x037bfa06
0x00000000
0x03762e29
0x03762e29
0x03762e2e
0x03762e34
0x03762e3e
0x00000000
0x00000000
0x03762e44
0x03762e47
0x03762e4d
0x00000000
0x00000000
0x03762e4f
0x03762e54
0x00000000
0x00000000
0x03762e5a
0x03762e5f
0x03762e9a
0x03762ea4
0x03762ea5
0x03762ea8
0x03762eaf
0x03762eb2
0x03762eb5
0x037bfae9
0x037bfaeb
0x037bfaed
0x037bfaef
0x037bfaf7
0x037bfaf8
0x037bfafd
0x037bfaff
0x037bfb04
0x037bfb04
0x037bfaff
0x03762ec0
0x03762ec4
0x03762ec6
0x03762ec8
0x037bfb14
0x037bfb18
0x037bfb1e
0x037bfb21
0x037bfb21
0x03762ece
0x03762ece
0x03762ece
0x03762ed7
0x03762e61
0x03762e63
0x037bfa6b
0x037bfa71
0x037bfa76
0x037bfa78
0x037bfa8a
0x037bfa7a
0x037bfa83
0x037bfa83
0x037bfa8f
0x037bfa91
0x037bfa97
0x037bfa9d
0x037bfaa4
0x037bfaaa
0x037bfaaf
0x037bfab1
0x037bfac3
0x037bfab3
0x037bfabc
0x037bfabc
0x037bfac8
0x037bfacb
0x037bfadf
0x037bfadf
0x037bfacb
0x037bfaa4
0x037bfa91
0x03762e6f
0x03762e6f
0x03762e5f
0x037bfa13
0x037bfa15
0x037bfa17
0x037bfa1f
0x037bfa21
0x037bfa22
0x037bfa25
0x037bfa28
0x037bfa2f
0x037bfa2f
0x037bfa2a
0x037bfa2a
0x037bfa2a
0x037bfa31
0x037bfa34
0x037bfa36
0x037bfa3c
0x037bfa3e
0x037bfa41
0x037bfa43
0x037bfa45
0x037bfa45
0x037bfa41
0x037bfa3c
0x037bfa4a
0x037bfa4f
0x037bfa51
0x037bfa53
0x037bfa56
0x037bfa5b
0x037bfa5e
0x00000000
0x037bfa5e
0x03762e23

Strings

RTL: Re-Waiting, xrefs: 037BFA4A

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 181ac0d33cae942832bdd4e5db7f70bfec933a3a0651748a21ff529d03c3b7f9
Instruction ID: 007fb2bb429427a5c452aa9649acd46f345f623674e8f8b064be54d697c5796e
Opcode Fuzzy Hash: 181ac0d33cae942832bdd4e5db7f70bfec933a3a0651748a21ff529d03c3b7f9
Instruction Fuzzy Hash: 91613871A00744EFDB35DF68CC98BBEB7B5EB45B14F184AA9E911AB2C2C7349900C791

Uniqueness

Uniqueness Score: -1.00%

Function 03830EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E03830EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E0382FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E03831074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E037A9730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E0382A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E0382A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x3858b04 >> 0x14) + (_v44 -  *0x3858b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E03787D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0382138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E03787D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0381FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x3858724 & 0x00000008) != 0) {
						E038252F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E038315B5(0x3858ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x03830eb7
0x03830eb9
0x03830ec0
0x03830ec2
0x03830ecd
0x0383105b
0x0383105b
0x03831061
0x03831066
0x03831066
0x0383106b
0x03831073
0x03831073
0x03830ed3
0x03830ed6
0x03830edc
0x03830ee0
0x03830ee7
0x03830ef0
0x03830ef5
0x03830efa
0x03830efc
0x03830efd
0x03830f03
0x03830f04
0x03830f06
0x03830f07
0x03830f09
0x03830f0e
0x03830f14
0x03830f23
0x03830f2d
0x03830f34
0x03830f34
0x03830f14
0x03830f52
0x00000000
0x00000000
0x03830f58
0x03830f73
0x03830f74
0x03830f79
0x03830f7d
0x03830f80
0x03830f86
0x03830fab
0x03830fb5
0x03830fc6
0x03830fd1
0x03830fe3
0x03830fd3
0x03830fdc
0x03830fdc
0x03830feb
0x03831009
0x03831009
0x03831015
0x03831027
0x03831017
0x03831020
0x03831020
0x0383102f
0x0383103c
0x0383103c
0x03831048
0x03831050
0x03831050
0x03831055
0x00000000
0x03831055
0x03830f88
0x03830f9e
0x03830fa2
0x03830fa9
0x00000000
0x00000000
0x00000000
0x03830fa9
0x00000000

Strings

`, xrefs: 03830F16

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: a656a695ffd7ccb1c9172ef44c2532aa7f1bd8b4f59f7444eabaf87ebf99d26b
Instruction ID: 0abe47c2e3ea456a93c410794f441bed20db2b6536bd2ea3dcc2e8640cba13a0
Opcode Fuzzy Hash: a656a695ffd7ccb1c9172ef44c2532aa7f1bd8b4f59f7444eabaf87ebf99d26b
Instruction Fuzzy Hash: CA51BF702083819FD325EFA9D894B5BB7E5EBC5704F0409ACF996DB390D635E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0379F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0379F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E03784120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E037A9830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E037A9990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E037A95D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0xba1cd01a
							_t109 = L03784620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2000ba1c
								E037AF3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2000ba1c
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E037A95D0();
										L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x0379f0d3
0x0379f0d9
0x0379f0e0
0x0379f0e7
0x0379f0f2
0x0379f0f4
0x0379f0f8
0x0379f100
0x0379f108
0x0379f10d
0x0379f115
0x0379f116
0x0379f11f
0x0379f123
0x0379f124
0x0379f12c
0x0379f130
0x0379f134
0x0379f13d
0x0379f144
0x0379f14b
0x0379f152
0x037dbab0
0x037dbab0
0x0379f158
0x0379f158
0x0379f15a
0x0379f160
0x0379f165
0x0379f166
0x0379f16f
0x0379f173
0x037dbaa7
0x037dbaa7
0x037dbaab
0x00000000
0x0379f179
0x0379f179
0x0379f18d
0x0379f191
0x037dbaa2
0x00000000
0x0379f197
0x0379f19b
0x0379f1a2
0x0379f1a9
0x0379f1af
0x0379f1b2
0x0379f1b6
0x0379f1b9
0x0379f1c0
0x0379f1c4
0x0379f1d8
0x0379f1df
0x0379f1e3
0x0379f1e6
0x0379f1eb
0x0379f1ee
0x0379f1f4
0x0379f20f
0x037dbab7
0x037dbabb
0x037dbacc
0x037dbad1
0x0379f215
0x0379f218
0x0379f226
0x0379f22b
0x00000000
0x0379f22b
0x0379f1f6
0x0379f1f6
0x0379f1f9
0x0379f1fb
0x0379f1fb
0x0379f1f4
0x0379f191
0x0379f173
0x0379f152
0x0379f203

Strings

@, xrefs: 0379F124

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 909ac536ccd48caf9373d5f026734ec9d10361a43713349ab53558461ade2d50
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: C0518D75504710AFD320DF19C841A6BBBF8FF88710F008A2EFA958B690E7B4E914CB91

Uniqueness

Uniqueness Score: -1.00%

Function 037E3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E037E3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x385d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E037A0BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E037E3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E037AFA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E037E3540;
						E037AFA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E037BDDD0( &_v1072, _t75, _t79, _t80, _t81);
						E037F0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E037A97C0();
					}
					return E037AB640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E037E3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E037E3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E037AFA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E037A9650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E037E3787(_a4,  &_v352, _t80);
						}
					}
					L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E037A95D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x037e3552
0x037e355a
0x037e355d
0x037e3566
0x037e3567
0x037e357e
0x037e358f
0x037e35a1
0x037e35a5
0x037e366b
0x037e366b
0x037e366d
0x037e3672
0x037e3679
0x037e3685
0x037e368d
0x037e369d
0x037e36a7
0x037e36b8
0x037e36c6
0x037e36c7
0x037e36dc
0x037e36e1
0x037e36e7
0x037e36e9
0x037e36e9
0x037e3703
0x037e3703
0x037e35b5
0x037e35c0
0x037e35c4
0x00000000
0x00000000
0x037e35ca
0x037e35d7
0x037e35e2
0x037e35e6
0x037e35e8
0x037e35f5
0x037e35fa
0x037e3603
0x037e3604
0x037e3609
0x037e360a
0x037e3612
0x037e3613
0x037e361e
0x037e3622
0x037e3628
0x037e362f
0x037e362f
0x037e3636
0x037e3638
0x037e363b
0x037e3642
0x037e3642
0x037e3636
0x037e3657
0x037e3657
0x037e365c
0x037e3662
0x037e3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 037E358F

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 92cba01a8e89f719ea073d1e92140d9e59d4093a71153f288084e836ebba276c
Instruction ID: b20670a1511bef664891a2253c5400da1ddcfde2c20b2c23b9818267bc29fca6
Opcode Fuzzy Hash: 92cba01a8e89f719ea073d1e92140d9e59d4093a71153f288084e836ebba276c
Instruction Fuzzy Hash: E04158B5D0062CABEB21DB64CC84FDEB77CAB44714F0045E5EA09AB240DB309E88CF95

Uniqueness

Uniqueness Score: -1.00%

Function 037E3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E037E3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E037A9650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L03784620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E037A9650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x037e3893
0x037e3896
0x037e3899
0x037e389f
0x037e38a0
0x037e38a4
0x037e38a9
0x037e38ac
0x037e38ad
0x037e38ae
0x037e38af
0x037e38b1
0x037e38b4
0x037e38bb
0x037e38bc
0x037e38bd
0x037e38c4
0x037e38c8
0x037e38ca
0x037e38ca
0x037e38d5
0x037e393e
0x037e3940
0x037e3942
0x037e3952
0x037e3954
0x037e3961
0x037e3961
0x037e3967
0x037e396e
0x037e396e
0x037e3947
0x037e394c
0x00000000
0x037e394c
0x037e38ea
0x037e38ee
0x037e38f8
0x037e38f9
0x037e38ff
0x037e3900
0x037e3902
0x037e3903
0x037e390b
0x037e390f
0x037e3950
0x00000000
0x037e3950
0x037e3915
0x037e391d
0x037e391d
0x037e3922
0x037e3926
0x00000000
0x037e3928
0x037e392b
0x037e392b
0x037e3935
0x037e3937
0x037e3937
0x00000000
0x037e3935
0x037e3926
0x037e38f0
0x00000000

Strings

BinaryName, xrefs: 037E38B4

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 4c8bafa0344546e65134ea61f929687154d59b89252dc2b623a66818acb2491a
Instruction ID: 357c634860a33522b58c3448351285465d82f18325bc850b615565eabfb3418b
Opcode Fuzzy Hash: 4c8bafa0344546e65134ea61f929687154d59b89252dc2b623a66818acb2491a
Instruction Fuzzy Hash: CF31037AD0061ABFFB15DB58C945E6FF778EF88B24F024169E914AB240D7309E00D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0379D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0379D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x385d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E03784120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E037AB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E037A98D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E037A95D0();
					L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x0379d29c
0x0379d2a6
0x0379d2b1
0x0379d2b5
0x0379d2b6
0x0379d2bc
0x0379d2bd
0x0379d2be
0x0379d2bf
0x0379d2c2
0x0379d2c4
0x0379d2cc
0x0379d384
0x0379d34b
0x0379d34f
0x0379d350
0x0379d351
0x0379d35c
0x0379d35c
0x0379d2d6
0x0379d2da
0x0379d2e1
0x0379d361
0x0379d369
0x0379d36d
0x0379d2e3
0x0379d2e3
0x0379d2e3
0x0379d2e5
0x0379d2ed
0x0379d2f5
0x0379d2fa
0x0379d302
0x0379d303
0x0379d30b
0x0379d30f
0x0379d313
0x0379d318
0x0379d31c
0x0379d320
0x0379d379
0x0379d37d
0x00000000
0x00000000
0x037daffe
0x037db001
0x037db011
0x00000000
0x0379d322
0x0379d322
0x0379d330
0x0379d337
0x0379d35d
0x0379d339
0x0379d33f
0x0379d38c
0x0379d38c
0x0379d33f
0x0379d349
0x00000000
0x0379d349

Strings

@, xrefs: 0379D303

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9836694bddc41fe0f815246d7c6641a4be7d32e43e037ca4e8c5da8b6195b3ea
Instruction ID: 03265882204ed0955ad1a1d7c512e25e3a7827c86eb3e6fdb03371b610752b74
Opcode Fuzzy Hash: 9836694bddc41fe0f815246d7c6641a4be7d32e43e037ca4e8c5da8b6195b3ea
Instruction Fuzzy Hash: 6C31DFB5508705DFDB20DF28D884A6BBBE8EBCD654F040A2EF99487210E634DD08DB92

Uniqueness

Uniqueness Score: -1.00%

Function 03771B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E03771B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E037ABB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E037AA9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E037AA9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L03784620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x03771b8f
0x03771b9a
0x03771b9c
0x03771b9e
0x03771ba3
0x037c7010
0x037c7010
0x00000000
0x03771ba9
0x03771ba9
0x03771bae
0x00000000
0x03771bc5
0x03771bca
0x03771bcf
0x03771bd0
0x03771bd1
0x03771bd2
0x03771bd6
0x03771bdc
0x03771be0
0x037c6ffc
0x037c7000
0x00000000
0x037c7006
0x037c7009
0x037c7009
0x03771be6
0x03771bec
0x03771c0b
0x03771c0b
0x03771c0c
0x03771c11
0x03771c12
0x03771c15
0x03771c1b
0x03771c1f
0x03771c31
0x03771c33
0x037c7026
0x037c7026
0x03771c21
0x03771c24
0x03771c24
0x03771bee
0x03771bee
0x03771bf2
0x03771c3a
0x03771bf4
0x03771bf4
0x03771c05
0x03771c05
0x03771c09
0x03771c3e
0x00000000
0x00000000
0x00000000
0x03771c09
0x03771bec
0x03771be0
0x03771bae
0x03771c2e

Strings

WindowsExcludedProcs, xrefs: 03771BC5

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 00d21456aace5cb31a1f348bd74dd5348619d3dafca231f0834782c17a8bce59
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: B921D477601668AFCF21DA99C845F6BB7EDEF81B50F094469FD049B200EA30DD00EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03818DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E03818DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x3840d50);
				E037BD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E037F5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L037BDEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L037BDEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E037BD130(_t34, _t39, _t40);
			}

0x03818df1
0x03818df1
0x03818df1
0x03818df1
0x03818df1
0x03818df1
0x03818df3
0x03818df8
0x03818dfd
0x03818e00
0x03818e0e
0x03818e2a
0x03818e36
0x03818e38
0x03818e3c
0x03818e46
0x03818e46
0x03818e36
0x03818e50
0x03818e56
0x03818e59
0x03818e5c
0x03818e60
0x03818e67
0x03818e6d
0x03818e73
0x03818e74
0x03818eb1
0x03818ebd

Strings

Critical error detected %lx, xrefs: 03818E21

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 8b291359a02309e19b1397fa24319f5ba346cb2aa0258a9c67f83d70af11a803
Instruction ID: c83245ca5e1db12f4f717963eaf756f198c428a115d0c7d80d7bc10190594a3a
Opcode Fuzzy Hash: 8b291359a02309e19b1397fa24319f5ba346cb2aa0258a9c67f83d70af11a803
Instruction Fuzzy Hash: 9B1179B5D04348DADF24CFA8850A7DDBBB4BB04314F2442ADE528AB382C3740602CF15

Uniqueness

Uniqueness Score: -1.00%

Function 037FFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 037FFF60

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 003bf185712a078f4f600e7df82e1e3e5d7d429f6c9d895f819577cd4e43c495
Instruction ID: 7ec407454a4d4f74dfe36dd530848ef80693e0c21a19c39307d7238457d532b0
Opcode Fuzzy Hash: 003bf185712a078f4f600e7df82e1e3e5d7d429f6c9d895f819577cd4e43c495
Instruction Fuzzy Hash: 3F11AD75950648EFDB26EF50C948F9CBBB1FB09714F188094F609AB6A1CB799940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 03835BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E03835BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x3841178);
				E037BD0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E03834C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E037AD000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E03835542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x38560e8;
								if( *0x38560e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x38560e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E037A9710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E037A6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E037AF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E037AF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E037AF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E037AFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E037AFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E037AF3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E037AF3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E03834CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E037BD130(_t427, _t494, _t511);
				}
			}

0x03835ba5
0x03835baa
0x03835baf
0x03835bb4
0x03835bb6
0x03835bbc
0x03835bbe
0x03835bc4
0x03835bcd
0x03835bd3
0x03835bd6
0x03835bdc
0x03835be0
0x03835be3
0x03835beb
0x03835bf2
0x03835bf8
0x03835bfe
0x03835c04
0x03835c0e
0x03835c18
0x03835c1f
0x03835c25
0x03835c2a
0x03835c2c
0x03835c32
0x03835c3a
0x03835c3f
0x03835c42
0x03835c48
0x03835c5b
0x03835c5b
0x03835c2c
0x03835cb7
0x03835cb9
0x03835cbf
0x03835cc2
0x03835cca
0x03835ccb
0x03835ccb
0x03835cd1
0x03835cd7
0x03835cda
0x03835ce1
0x03835ce4
0x03835ce7
0x03835ced
0x03835cf3
0x03835cf9
0x03835cff
0x03835d08
0x03835d0a
0x03835d0e
0x03835d10
0x00000000
0x00000000
0x03835d16
0x03835d1a
0x00000000
0x00000000
0x03835d20
0x03835d22
0x03835d25
0x03835d2f
0x03835d2f
0x03835d33
0x03835d3d
0x03835d49
0x03835d4b
0x00000000
0x00000000
0x03835d5a
0x03835d5d
0x03835d60
0x00000000
0x00000000
0x03835d66
0x03835d69
0x00000000
0x00000000
0x03835d6f
0x03835d6f
0x03835d73
0x03835d79
0x03835d7f
0x03835d86
0x03835d95
0x03835d98
0x03835dba
0x03835dcb
0x03835dce
0x03835dd3
0x03835dd6
0x03835dd8
0x03835de6
0x03835dec
0x03835dee
0x03835df1
0x03835df3
0x0383635a
0x0383635a
0x00000000
0x0383635a
0x03835dfe
0x03835e02
0x03835e05
0x03835e07
0x03835e10
0x03835e13
0x03835e1b
0x03835e1c
0x03835e21
0x03835e22
0x03835e23
0x03835e25
0x03835e2a
0x03835e2c
0x03835e2e
0x03835e36
0x03835e39
0x03835e42
0x03835e47
0x03835e4d
0x03835e54
0x03835e54
0x03835e54
0x03835e2e
0x03835e5c
0x03835e5f
0x03835e62
0x03835e64
0x03835e6b
0x03835e70
0x03835e7a
0x03835e7a
0x03835e7a
0x03835e6b
0x03835e7e
0x03835e7f
0x03835e7f
0x03835e81
0x03835e87
0x03835e8b
0x03835e8c
0x03835e8c
0x03835e8c
0x03835e9a
0x03835e9c
0x03835ea2
0x03835ea6
0x03835f50
0x03835f50
0x03835f57
0x03835f66
0x03835f66
0x03835f66
0x03835f68
0x03835f6a
0x038363d0
0x00000000
0x03835f70
0x03835f70
0x03835f91
0x03835f9c
0x03835f9e
0x03835fa4
0x03835fa6
0x0383638c
0x03836392
0x038363a1
0x038363a7
0x038363af
0x038363af
0x038363bd
0x038363d8
0x00000000
0x038363d8
0x03835fac
0x03835fb2
0x03835fb4
0x03835fbd
0x03835fc6
0x03835fce
0x03835fd4
0x03835fdc
0x03835fec
0x03835fed
0x03835fee
0x03835fef
0x03835ff9
0x03835ffa
0x03835ffb
0x03835ffc
0x03836000
0x03836004
0x03836012
0x03836012
0x03836018
0x03836019
0x0383601a
0x0383601b
0x0383601c
0x03836020
0x03836059
0x0383605c
0x03836061
0x03836061
0x03836022
0x03836022
0x03836022
0x03836025
0x0383602a
0x0383602b
0x03836031
0x03836037
0x03836038
0x0383603e
0x03836048
0x03836049
0x0383604a
0x0383604b
0x0383604c
0x0383604d
0x03836053
0x03836054
0x03836054
0x03836062
0x03836065
0x03836067
0x0383606a
0x03836070
0x03836075
0x03836076
0x03836081
0x03836087
0x03836095
0x03836099
0x0383609e
0x038360a4
0x038360ae
0x038360b0
0x038360b3
0x038360b6
0x038360b8
0x038360ba
0x038360ba
0x038360ba
0x038360ba
0x038360be
0x038360c0
0x038360c5
0x038360c5
0x038360c5
0x038360c6
0x038360cd
0x03836114
0x038360cf
0x038360cf
0x038360d4
0x038360d5
0x038360da
0x038360db
0x038360e1
0x038360e2
0x038360e8
0x038360f8
0x038360fd
0x038360fe
0x03836102
0x03836104
0x03836107
0x03836109
0x0383610b
0x0383610b
0x0383610b
0x0383610b
0x0383610f
0x0383610f
0x03836117
0x0383611a
0x0383611f
0x03836125
0x03836134
0x03836139
0x0383613f
0x03836146
0x03836148
0x0383614b
0x0383614d
0x0383614f
0x0383614f
0x0383614f
0x0383614f
0x03836153
0x03836159
0x03836159
0x0383615c
0x03836163
0x03836169
0x0383616c
0x03836172
0x03836181
0x03836186
0x03836187
0x0383618b
0x03836191
0x03836195
0x038361a3
0x038361bb
0x038361c0
0x038361c3
0x038361cc
0x038361d0
0x038361dc
0x038361de
0x038361e1
0x038361e4
0x038361e6
0x038361e8
0x038361e8
0x038361e8
0x038361e8
0x038361e6
0x038361ec
0x038361f3
0x03836203
0x03836209
0x0383620a
0x03836216
0x0383621d
0x03836227
0x03836241
0x03836246
0x0383624c
0x03836257
0x03836259
0x0383625c
0x0383625e
0x03836260
0x03836260
0x03836260
0x03836260
0x0383625e
0x03836264
0x03836267
0x03836269
0x03836315
0x03836315
0x0383631b
0x0383631e
0x03836324
0x03836327
0x0383632f
0x03836330
0x03836333
0x0383633a
0x0383633c
0x03836335
0x03836335
0x03836335
0x0383633f
0x03836342
0x0383634c
0x03836352
0x03836355
0x03836355
0x03836359
0x00000000
0x0383626f
0x03836275
0x03836275
0x03836278
0x0383627e
0x0383627e
0x03836281
0x03836287
0x0383628d
0x03836298
0x0383629c
0x038362a2
0x0383629e
0x0383629e
0x0383629e
0x038362a7
0x038362a7
0x038362aa
0x038362b0
0x038362f0
0x038362f0
0x038362f2
0x038362f8
0x038362fd
0x038362b2
0x038362b2
0x038362b2
0x038362b5
0x038362dd
0x038362e2
0x038362e5
0x038362b7
0x038362b8
0x038362bb
0x038362bd
0x038362c0
0x038362c4
0x038362cd
0x038362cd
0x038362c0
0x038362bb
0x038362b5
0x03836302
0x03836303
0x03836305
0x03836305
0x03836305
0x0383630c
0x0383630c
0x00000000
0x0383627e
0x03836269
0x03835eac
0x03835ebb
0x03835ebe
0x03835ecb
0x03835ecb
0x03835ece
0x03835ece
0x03835ed4
0x03835ed7
0x03835ed9
0x03835edb
0x03835edb
0x03835ee1
0x03835ee1
0x03835ee3
0x03835f20
0x03835f20
0x03835ee5
0x03835ee5
0x03835ee5
0x03835ee8
0x03835f11
0x03835f18
0x03835eea
0x03835eea
0x03835eed
0x03835ef2
0x03835ef8
0x03835efb
0x03835f0a
0x03835f0a
0x03835eed
0x03835ee8
0x03835f22
0x03835f28
0x00000000
0x00000000
0x03835f30
0x03835f31
0x03835f37
0x03835f3a
0x03835f3d
0x03835f44
0x00000000
0x00000000
0x00000000
0x03835f46
0x03835f48
0x03835f4d
0x00000000
0x03835f4d
0x03835dda
0x03835ddf
0x00000000
0x03835ddf
0x03835dd8
0x03835da7
0x03835da9
0x03835dac
0x03835dae
0x00000000
0x03835db4
0x03835db4
0x00000000
0x03835db4
0x03835dae
0x03835d88
0x03835d8d
0x03836363
0x03836369
0x0383636a
0x03836370
0x03836372
0x0383637a
0x0383637b
0x0383637d
0x00000000
0x00000000
0x0383637f
0x03836385
0x00000000
0x03836385
0x03835d38
0x03835d3b
0x00000000
0x00000000
0x00000000
0x03835d3b
0x03835d27
0x03835d29
0x00000000
0x00000000
0x00000000
0x03836360
0x00000000
0x03836360
0x03835c10
0x03835c10
0x038363da
0x038363e5
0x038363e5

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85349a73bb4f117ca7b2990de52e2e8bab1c8e53adf8833e1d80b0c538993fbd
Instruction ID: 557a2a04a553909ed742fc4b2ad749a9f43a0365634e07f891981ff9a09b6d03
Opcode Fuzzy Hash: 85349a73bb4f117ca7b2990de52e2e8bab1c8e53adf8833e1d80b0c538993fbd
Instruction Fuzzy Hash: 75423A75900229DFDB24CFA8C880BA9B7B1FF46304F1981EAD949EB341E7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03784120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E03784120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x385d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0379F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E03786E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L03784620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E03786E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M037845F8))) {
												case 0:
													_v568 = 0x3741078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x37411c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L03784620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E037AF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E037AF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E037652A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E0377EB70(1, 0x38579a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E0377AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E037A95D0();
																			L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E037AB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E037A3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E037AB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x03784128
0x03784135
0x0378413c
0x03784141
0x03784145
0x03784147
0x0378414e
0x03784151
0x03784159
0x0378415c
0x03784160
0x03784164
0x03784168
0x0378416c
0x0378417f
0x03784181
0x0378446a
0x0378446a
0x0378418c
0x03784195
0x03784199
0x03784432
0x03784439
0x0378443d
0x03784442
0x03784447
0x00000000
0x0378419f
0x037841a3
0x037841b1
0x037841b9
0x037841bd
0x037845db
0x037845db
0x00000000
0x037841c3
0x037841c3
0x037841ce
0x037841d4
0x037ce138
0x037ce13e
0x037ce169
0x037ce16d
0x037ce19e
0x037ce16f
0x037ce16f
0x037ce175
0x037ce179
0x037ce18f
0x037ce193
0x00000000
0x037ce199
0x00000000
0x037ce199
0x037ce193
0x00000000
0x00000000
0x00000000
0x037841da
0x037841da
0x037841df
0x037841e4
0x037841ec
0x03784203
0x03784207
0x037ce1fd
0x03784222
0x03784226
0x037ce1f3
0x037ce1f3
0x0378422c
0x0378422c
0x03784233
0x037ce1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x03784239
0x03784239
0x03784239
0x03784239
0x03784233
0x03784226
0x037841ee
0x037841ee
0x037841f4
0x03784575
0x037ce1b1
0x037ce1b1
0x00000000
0x0378457b
0x0378457b
0x03784582
0x037ce1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x03784588
0x03784588
0x0378458c
0x037ce1c4
0x037ce1c4
0x00000000
0x03784592
0x03784592
0x03784599
0x037ce1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0378459f
0x0378459f
0x037845a3
0x037ce1d7
0x037ce1e4
0x00000000
0x037845a9
0x037845a9
0x037845b0
0x037ce1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x037845b6
0x037845b6
0x037845b6
0x00000000
0x037845b6
0x037845b0
0x037845a3
0x03784599
0x0378458c
0x03784582
0x00000000
0x00000000
0x00000000
0x00000000
0x037841f4
0x0378423e
0x03784241
0x037845c0
0x037845c4
0x00000000
0x037845ca
0x037845ca
0x00000000
0x037ce207
0x037ce20f
0x00000000
0x00000000
0x00000000
0x00000000
0x037845d1
0x00000000
0x00000000
0x037845ca
0x00000000
0x03784247
0x03784247
0x03784247
0x03784249
0x03784249
0x03784249
0x03784251
0x03784251
0x03784257
0x0378425f
0x0378426e
0x03784270
0x0378427a
0x037ce219
0x037ce219
0x03784280
0x03784282
0x03784456
0x037845ea
0x00000000
0x037845f0
0x037ce223
0x00000000
0x037ce223
0x0378445c
0x0378445c
0x00000000
0x0378445c
0x00000000
0x03784288
0x0378428c
0x037ce298
0x03784292
0x03784292
0x0378429e
0x037842a3
0x037842a7
0x037842ac
0x037ce22d
0x037842b2
0x037842b2
0x037842b9
0x037842bc
0x037842c2
0x037842ca
0x037842cd
0x037842cd
0x037842d4
0x0378433f
0x0378433f
0x037842d6
0x037842d6
0x037842d9
0x037842dd
0x037842eb
0x037ce23a
0x037842f1
0x03784305
0x0378430d
0x03784315
0x03784318
0x0378431f
0x03784322
0x0378432e
0x0378433b
0x0378433b
0x00000000
0x0378432e
0x037842eb
0x0378434c
0x0378434e
0x03784352
0x03784359
0x0378435e
0x03784361
0x0378436e
0x0378438a
0x0378438e
0x03784396
0x0378439e
0x037843a1
0x037843ad
0x037843bb
0x037843bb
0x037843ad
0x0378436e
0x037843bf
0x037843c5
0x03784463
0x03784463
0x037843ce
0x037843d5
0x037843d9
0x037843df
0x03784475
0x03784479
0x03784491
0x03784491
0x03784479
0x037843e5
0x037843eb
0x037843f4
0x037843f6
0x037843f9
0x037843fc
0x037843ff
0x037844e8
0x037844ed
0x037844f3
0x037ce247
0x00000000
0x037844f9
0x03784504
0x03784508
0x0378450f
0x037ce269
0x00000000
0x03784515
0x03784519
0x03784531
0x03784534
0x03784537
0x0378453e
0x03784541
0x0378454a
0x037ce255
0x037ce255
0x037ce25b
0x037ce25e
0x037ce261
0x037ce261
0x03784555
0x03784559
0x0378455d
0x037ce26d
0x037ce270
0x037ce274
0x037ce27a
0x037ce27d
0x037ce28e
0x037ce28e
0x03784563
0x03784563
0x03784569
0x03784569
0x00000000
0x0378455d
0x0378450f
0x00000000
0x037844f3
0x037843ff
0x03784405
0x03784405
0x03784405
0x037842ac
0x0378428c
0x03784282
0x03784407
0x0378440d
0x037ce2af
0x037ce2af
0x03784413
0x03784413
0x00000000
0x037841d4
0x00000000
0x037841c3
0x037841bd
0x03784415
0x03784415
0x03784416
0x03784417
0x03784429
0x0378416e
0x0378416e
0x03784175
0x03784498
0x0378449f
0x037ce12d
0x00000000
0x037ce133
0x00000000
0x037ce133
0x037844a5
0x037844a5
0x037844aa
0x00000000
0x037844bb
0x037844ca
0x037844d6
0x037844d7
0x037844d8
0x037844e3
0x037844e3
0x037844aa
0x0378417b
0x0378417b
0x0378417b
0x00000000
0x0378417b
0x03784175
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3c35bde6662c1c674a651f60bcf4219821e493cfd607f3932374e47b667b74
Instruction ID: 4ab5e958ab515e1e6f3083582c11e56db005a1f88705dfe574b4e8e4c0e0455d
Opcode Fuzzy Hash: 4d3c35bde6662c1c674a651f60bcf4219821e493cfd607f3932374e47b667b74
Instruction Fuzzy Hash: 41F1AD746483528BC724DF1AC484A3AF7E1FF88714F18496EF88ACB650E774D891CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0379513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0379513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x385d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E037AD0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E03782280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L03784620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E037AF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E0377FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x385b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E037AB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x03795142
0x0379514c
0x03795150
0x03795157
0x03795159
0x0379515e
0x03795165
0x03795169
0x0379516c
0x03795172
0x03795176
0x0379517a
0x0379517a
0x0379517a
0x0379517f
0x037d6d8b
0x037d6d8e
0x037d6d91
0x037d6d95
0x037d6d98
0x037d6d9c
0x037d6da0
0x037d6da3
0x037d6da7
0x037d6e26
0x037d6e26
0x037d6e2a
0x037951f9
0x037951f9
0x037951fe
0x037d6e33
0x037d6e33
0x037d6e39
0x037d6e3d
0x037d6e46
0x037d6e50
0x00000000
0x00000000
0x037d6e52
0x037d6e53
0x037d6e56
0x037d6e5d
0x00000000
0x00000000
0x00000000
0x037d6e5f
0x037d6e67
0x037d6e77
0x037d6e7f
0x037d6e80
0x037d6e88
0x037d6e90
0x037d6e9f
0x037d6ea5
0x037d6ea9
0x037d6eb1
0x037d6ebf
0x00000000
0x00000000
0x037d6ecf
0x037d6ed3
0x00000000
0x00000000
0x037d6edb
0x037d6ede
0x037d6ee1
0x037d6ee8
0x037d6eeb
0x037d6eed
0x037d6ef0
0x037d6ef4
0x037d6ef8
0x037d6efc
0x00000000
0x00000000
0x037d6f0d
0x037d6f11
0x037d6f32
0x037d6f37
0x037d6f3b
0x037d6f3e
0x037d6f41
0x037d6f46
0x00000000
0x00000000
0x037d6f4c
0x037d6f50
0x037d6f50
0x037d6f54
0x037d6f62
0x037d6f65
0x037d6f6d
0x037d6f7b
0x037d6f7b
0x037d6f93
0x037d6f98
0x037d6fa0
0x037d6fa6
0x037d6fb3
0x037d6fb6
0x037d6fbf
0x037d6fc1
0x037d6fd5
0x037d6fda
0x037d6fda
0x037d6fdd
0x037d6fe2
0x037d6fe7
0x037d6feb
0x037d6fef
0x037d6ff3
0x0379520c
0x0379520c
0x0379520f
0x03795215
0x03795234
0x0379523a
0x0379523a
0x03795244
0x03795245
0x03795246
0x03795251
0x03795251
0x037d6f13
0x037d6f17
0x037d6f17
0x037d6f18
0x037d6f1b
0x037d6f1f
0x037d6f23
0x00000000
0x037d6f28
0x03795204
0x03795204
0x03795208
0x00000000
0x03795208
0x03795185
0x03795188
0x0379518a
0x0379518e
0x03795195
0x037d6db1
0x037d6db5
0x037d6db9
0x0379519b
0x0379519b
0x0379519e
0x037951a7
0x037951a9
0x037951a9
0x037951b5
0x037951b8
0x037951bb
0x037951be
0x037951c1
0x037951c5
0x037951c9
0x037951cd
0x037951cd
0x037951d8
0x037951dc
0x037951e0
0x037d6dcc
0x037d6dd0
0x037d6dd5
0x037d6ddd
0x037d6de1
0x037d6de1
0x037d6de5
0x037d6deb
0x037d6df1
0x037d6df7
0x037d6dfd
0x037d6e01
0x037d6e05
0x037d6e09
0x037d6e0d
0x037d6e11
0x037d6e11
0x037951eb
0x037d6e1a
0x037d6e1f
0x037d6e21
0x037d6e23
0x00000000
0x037951f1
0x037951f1
0x00000000
0x037951f1

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308e720558de583325eef556c0b29307feab06e326ada4b84714443042eabdd1
Instruction ID: 1804a7fe7968fe9b4a21f379b3f5a118f7cd99b192e11a3526991ac7788158fd
Opcode Fuzzy Hash: 308e720558de583325eef556c0b29307feab06e326ada4b84714443042eabdd1
Instruction Fuzzy Hash: 7BC140B55083808FD755CF28C480A6AFBF1BF89304F188A6EF8999B352D770E845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0376C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0376C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x385d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E03776D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E037AB640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x3857b9c; // 0x0
					_t74 = L03784620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E037A9650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L037877F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E037AF3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E037A13C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L037877F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E037A9650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x0376c608
0x0376c615
0x0376c625
0x0376c62d
0x0376c635
0x0376c640
0x0376c680
0x0376c687
0x0376c688
0x0376c689
0x0376c694
0x0376c694
0x0376c642
0x0376c64a
0x0376c697
0x037d7a25
0x037d7a2b
0x037d7a2e
0x037d7a30
0x037d7bea
0x037d7bea
0x00000000
0x037d7bea
0x037d7a36
0x037d7a43
0x037d7a48
0x037d7a4c
0x037d7a4e
0x00000000
0x00000000
0x037d7a58
0x037d7a5a
0x037d7a5b
0x037d7a5c
0x037d7a5d
0x037d7a63
0x037d7a64
0x037d7a6a
0x037d7a6c
0x037d7a6e
0x037d79cb
0x037d79cb
0x037d79ce
0x037d79d0
0x037d7a98
0x037d7a9b
0x037d7a9b
0x037d7a9e
0x037d7aa1
0x037d7bbe
0x037d7bbe
0x037d7bc0
0x037d7be0
0x037d7be0
0x037d7a01
0x037d7a01
0x037d7a05
0x037d7a07
0x037d7a15
0x037d7a15
0x037d7a1a
0x00000000
0x037d7a1a
0x037d7bc2
0x037d7bc6
0x037d7bc9
0x037d7bcd
0x037d7bcf
0x037d79e6
0x037d79e6
0x037d79eb
0x037d79eb
0x037d79ef
0x037d79f1
0x00000000
0x00000000
0x037d79f3
0x037d79f5
0x037d79ff
0x037d79ff
0x00000000
0x037d79ff
0x037d79f7
0x037d79fd
0x00000000
0x00000000
0x00000000
0x037d79fd
0x037d7bd5
0x037d7bd8
0x00000000
0x00000000
0x037d7ba9
0x037d7bac
0x037d7bb0
0x037d7bb1
0x037d7bb1
0x037d7bb6
0x00000000
0x037d7bb6
0x037d7aa7
0x037d7aaa
0x00000000
0x00000000
0x037d7ab2
0x037d7ab3
0x037d7ab5
0x037d7aec
0x037d7aef
0x037d7b25
0x037d7b28
0x037d7b62
0x037d7b64
0x037d7b8f
0x037d7b92
0x037d7b96
0x037d7b98
0x00000000
0x00000000
0x037d7b9e
0x037d7b9f
0x037d7ba3
0x00000000
0x037d7ba3
0x037d7b66
0x037d7b68
0x037d7ae2
0x037d7ae2
0x00000000
0x037d7ae2
0x037d7b6e
0x037d7b72
0x037d7b75
0x037d7b81
0x037d7b85
0x037d7b87
0x00000000
0x00000000
0x037d7b31
0x037d7b34
0x037d7b3c
0x037d7b45
0x037d7b46
0x037d7b4f
0x037d7b51
0x037d7b57
0x037d7b59
0x037d7b59
0x00000000
0x037d7b59
0x037d7b77
0x00000000
0x037d7b77
0x037d7b2a
0x00000000
0x037d7b2a
0x037d7af1
0x037d7af3
0x00000000
0x00000000
0x037d7afb
0x037d7afc
0x037d7afe
0x00000000
0x00000000
0x037d7b00
0x037d7b03
0x00000000
0x00000000
0x037d7b05
0x037d7b09
0x037d7b0d
0x037d7b0f
0x00000000
0x00000000
0x037d7b18
0x037d7b1d
0x00000000
0x037d7b1d
0x037d7ab7
0x037d7ab9
0x00000000
0x00000000
0x037d7abf
0x037d7ac1
0x00000000
0x00000000
0x037d7ac3
0x037d7ac6
0x00000000
0x00000000
0x037d7ac8
0x037d7acc
0x037d7ad0
0x037d7ad2
0x00000000
0x00000000
0x037d7adb
0x00000000
0x037d7adb
0x037d79d6
0x037d79d9
0x037d79dc
0x037d7a91
0x037d7a94
0x00000000
0x037d7a94
0x037d79e2
0x00000000
0x037d79e2
0x037d7a74
0x037d7a7a
0x00000000
0x00000000
0x037d7a8a
0x037d7a21
0x037d7a21
0x00000000
0x037d7a21
0x0376c650
0x0376c651
0x0376c656
0x0376c65c
0x0376c65d
0x0376c663
0x0376c664
0x0376c66a
0x0376c66e
0x037d79c5
0x037d79c7
0x00000000
0x037d79c7
0x0376c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9bfab7e38449bf8ffcf4836f7ddca55538a07de3323d7f8dd211c6bdcc44b05
Instruction ID: debeaa27a11b064f4a6cc011938a5c7d56a8c97080fb83c7153226c13eaf4f74
Opcode Fuzzy Hash: b9bfab7e38449bf8ffcf4836f7ddca55538a07de3323d7f8dd211c6bdcc44b05
Instruction Fuzzy Hash: 0B8190766487819BCB29CF18C880B6AB7F9EB84350F18496EED469B244D331DD40CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 037FB8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E037FB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x3857b9c; // 0x0
				_t124 = L03784620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E037A9800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E037A95B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E037A95D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L037877F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E037A9910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E037A95D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x3857b9c; // 0x0
									_t92 = L03784620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E037A9910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E0376A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E037FE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E037FE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E037A95B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x037fb8d9
0x037fb8e4
0x00000000
0x037fb8e6
0x037fb8f3
0x037fb8f5
0x037fb8f5
0x037fb8f8
0x037fb920
0x037fb924
0x037fb936
0x037fb939
0x037fb93d
0x037fb948
0x037fb9a0
0x037fb9a0
0x037fb9a4
0x037fb9bf
0x037fb9c4
0x037fb9c6
0x037fb9cd
0x037fb9d1
0x037fbad4
0x037fbad8
0x037fbada
0x037fbadc
0x037fbadc
0x037fbadf
0x037fbae0
0x037fbae2
0x037fbae4
0x037fbaec
0x037fbaee
0x037fbaf0
0x037fbaf0
0x037fbaec
0x037fbafb
0x037fbafc
0x037fbafe
0x037fbb01
0x037fbb01
0x00000000
0x037fbb06
0x037fb9d7
0x037fb9db
0x037fb9db
0x037fb9de
0x037fb9de
0x037fb9e4
0x037fb9e7
0x037fb9ea
0x037fb9ec
0x037fb9ef
0x037fb9f3
0x037fba1b
0x037fba1b
0x037fba23
0x037fba24
0x037fba27
0x037fba2a
0x037fba2b
0x037fba2e
0x037fba30
0x037fba37
0x037fba3f
0x037fba9c
0x037fbaa2
0x037fbb13
0x037fbb15
0x037fbaae
0x037fbaae
0x037fbab3
0x037fbab5
0x037fbaba
0x037fbac8
0x037fbac8
0x037fbaba
0x037fbacd
0x037fbacf
0x00000000
0x037fbacf
0x037fbb1a
0x00000000
0x037fbb1c
0x037fbaa7
0x037fbb11
0x00000000
0x037fbb11
0x037fbaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x037fba41
0x037fba41
0x037fba41
0x037fba58
0x037fba5d
0x037fba62
0x00000000
0x00000000
0x037fba64
0x037fba67
0x037fba68
0x037fba69
0x037fba6c
0x037fba6f
0x037fba71
0x037fba78
0x037fba80
0x00000000
0x00000000
0x037fba90
0x037fba90
0x037fba97
0x00000000
0x037fba97
0x037fb9f5
0x037fb9f7
0x037fb9f7
0x037fb9fa
0x037fba03
0x037fba07
0x037fba0c
0x037fba10
0x037fba17
0x00000000
0x037fb9f7
0x037fb9a6
0x037fb9a8
0x037fb9af
0x037fb9b3
0x00000000
0x00000000
0x037fb9b9
0x00000000
0x037fb9b9
0x037fb94d
0x037fb98f
0x037fb995
0x037fb999
0x037fb960
0x037fb967
0x037fb968
0x037fb96a
0x00000000
0x037fb96a
0x037fb99b
0x037fb99e
0x00000000
0x00000000
0x00000000
0x037fb99e
0x037fb951
0x037fb954
0x037fb95a
0x037fb95e
0x037fb972
0x037fb979
0x037fb97d
0x037fb97f
0x037fb980
0x037fb982
0x037fb984
0x00000000
0x037fb984
0x00000000
0x037fb926
0x00000000
0x037fb926

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29a6645a87a2ae69b9327ba6a481cf308c55421f3ee2248a5d62c1cdc50e996
Instruction ID: 47c359ee887b477c7fbd6ebd308c6af8f6e5a466fd7a4a777ec02ba28e347f66
Opcode Fuzzy Hash: e29a6645a87a2ae69b9327ba6a481cf308c55421f3ee2248a5d62c1cdc50e996
Instruction Fuzzy Hash: 2E71DF36240B05EFD721DF28C889F56BBE9FB84720F284628E7558B7A0DB75E940DB50

Uniqueness

Uniqueness Score: -1.00%

Function 037652A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E037652A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E0377EEF0(0x38579a0);
					_t104 =  *0x3858210; // 0xba1cb8
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x28000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E0377EB70(_t93, 0x38579a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E037A9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E0377EEF0(0x38579a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E0377EB70(0, 0x38579a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0xba1cd002
								_t13 = _t104 + 0xc; // 0xba1cc5
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0379F0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E0377EEF0(0x38579a0);
									__eflags =  *0x3858210 - _t104; // 0xba1cb8
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x3858210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x2000ba1c
											_t95 =  *((intOrPtr*)( *_t37));
											E037E4888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E0377EB70(_t95, 0x38579a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E037A95D0();
											L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E037A95D0();
											L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E0377EB70(_t93, 0x38579a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E037A95D0();
										L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E037A95D0();
										L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x2000ba1c
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0xba1cd002
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0379F0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x037652a5
0x037652ad
0x037652b0
0x037652b3
0x037652b7
0x037652ba
0x037652bf
0x037652c4
0x037652cc
0x00000000
0x00000000
0x037652ce
0x037652d1
0x037652d9
0x037652dd
0x037652e7
0x037652f7
0x037652f9
0x037652fd
0x037c0dcf
0x037c0dd5
0x037c0dd6
0x037c0dd7
0x037c0dd8
0x037c0dd9
0x037c0dde
0x037c0ddf
0x037c0de0
0x037c0de1
0x037c0de2
0x037c0de2
0x037c0de5
0x037c0dea
0x037c0dec
0x037c0f60
0x037c0f64
0x037c0f70
0x037c0f76
0x037c0f79
0x037c0f79
0x00000000
0x037c0f64
0x037c0df2
0x037c0df7
0x037c0e04
0x037c0e04
0x037c0e0d
0x037c0e0d
0x037c0e10
0x037c0e1a
0x037c0e1c
0x037c0e4c
0x037c0e52
0x037c0e61
0x037c0e67
0x037c0e6b
0x037c0e70
0x037c0e76
0x037c0ed7
0x037c0edc
0x037c0ee0
0x037c0ee6
0x037c0eea
0x037c0eed
0x037c0ef0
0x037c0ef3
0x037c0ef6
0x037c0ef9
0x037c0efb
0x037c0efe
0x037c0f01
0x037c0f01
0x037c0f0b
0x037c0f12
0x037c0f16
0x037c0f18
0x037c0f18
0x037c0f1b
0x037c0f2c
0x037c0f31
0x037c0f31
0x037c0f35
0x037c0f39
0x037c0f3a
0x037c0f3c
0x037c0f3c
0x037c0f3f
0x037c0f50
0x037c0f55
0x037c0f55
0x037c0f59
0x037652eb
0x037652f1
0x037652f1
0x037c0e7d
0x037c0e84
0x037c0e88
0x037c0e8a
0x037c0e8a
0x037c0e8d
0x037c0e9e
0x037c0ea3
0x037c0ea3
0x037c0ea7
0x037c0eaf
0x037c0eb3
0x037c0eb9
0x037c0eb9
0x037c0ebc
0x037c0ecd
0x037c0ecd
0x00000000
0x037c0eb3
0x037c0e1e
0x037c0e21
0x037c0e25
0x037c0e2b
0x037c0e2f
0x037c0e30
0x037c0e3a
0x037c0e3f
0x037c0e41
0x00000000
0x00000000
0x037c0e47
0x00000000
0x037c0e47
0x037c0df9
0x037c0dfe
0x00000000
0x00000000
0x00000000
0x037c0dfe
0x03765303
0x03765307
0x00000000
0x03765309
0x00000000
0x03765309
0x03765307
0x037652e9
0x037652e9
0x00000000
0x037652e9
0x0376530e
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc76043dda7f1341b5033e76e88c5c38f8fd4da63ac7e9ccf963d143e13cf239
Instruction ID: 0581b041ceb980aea5e581ad05a63cf33204e43a88a3f7f80c68828cf4c0d0c6
Opcode Fuzzy Hash: cc76043dda7f1341b5033e76e88c5c38f8fd4da63ac7e9ccf963d143e13cf239
Instruction Fuzzy Hash: 3C51CB74245781DFD720EF68C848B26BBE8BF84714F14095EF8968B651E774E840DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0377EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0377EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E03769080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x77dfc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E03762D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x0377ef4b
0x0377ef4d
0x0377ef57
0x0377f0bd
0x0377f0c2
0x0377f0d2
0x0377f0d2
0x0377f0c2
0x0377ef5d
0x0377ef5f
0x0377ef67
0x0377ef6a
0x0377ef6d
0x0377ef74
0x0377ef7f
0x0377ef82
0x0377ef82
0x0377ef86
0x0377ef88
0x0377ef8c
0x0377ef8f
0x0377ef8f
0x0377ef8f
0x00000000
0x0377ef91
0x0377ef93
0x0377efc4
0x0377efc4
0x0377efc4
0x0377efca
0x0377efd0
0x0377f0a6
0x00000000
0x00000000
0x0377f0af
0x037cbb06
0x037cbb0a
0x0377f0b5
0x0377f0b5
0x0377f0b5
0x0377f0b5
0x00000000
0x0377efd6
0x0377efd9
0x0377f0de
0x0377f0e2
0x0377efdf
0x0377efdf
0x0377efdf
0x0377efe5
0x037cbafc
0x037cbafc
0x0377efe5
0x0377efeb
0x0377efed
0x0377f00f
0x0377f011
0x0377f01a
0x0377f01d
0x0377f021
0x0377f028
0x0377f029
0x0377f029
0x0377f02c
0x00000000
0x0377f02c
0x0377eff3
0x0377eff9
0x0377f0ea
0x0377f0ed
0x0377f0ef
0x00000000
0x0377f0ef
0x0377f003
0x037cbb12
0x0377f045
0x0377f049
0x0377f051
0x0377f09e
0x0377f0a0
0x0377f0a0
0x0377f09e
0x0377f053
0x0377f064
0x0377f064
0x0377f06b
0x037cbb1a
0x037cbb1a
0x0377f071
0x0377f071
0x0377f07d
0x0377f082
0x0377f08f
0x0377f08f
0x0377f009
0x0377f00d
0x00000000
0x0377f00d
0x0377efd0
0x0377ef97
0x0377efa5
0x0377efaa
0x00000000
0x0377efac
0x0377efac
0x0377efac
0x00000000
0x0377efb2
0x0377f036
0x0377f03a
0x0377f040
0x0377f090
0x00000000
0x0377f092
0x0377f042
0x00000000
0x0377f042
0x0377efb7
0x0377efb9
0x0377efbc
0x0377efb0
0x0377efb0
0x00000000
0x0377efbe
0x0377efbe
0x0377efc1
0x00000000
0x0377efc1
0x0377efbc
0x0377efaa
0x0377ef91

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 33d9127c12c207e21b8c9c011859d93b59dbf8751f7f1be811a387016838dd7e
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 7751E030A04249EFDF24CB68C2D4BAEFBB1AF05314F1C81E9D85597B81C375A98AD791

Uniqueness

Uniqueness Score: -1.00%

Function 0383740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0383740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E037BD4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E037AF380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L03784620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L03784620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E037AF3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L03784620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x0383740d
0x0383740d
0x03837412
0x03837413
0x03837416
0x03837418
0x0383741c
0x0383741f
0x03837422
0x03837422
0x03837428
0x0383742a
0x0383742a
0x03837451
0x03837432
0x0383744f
0x0383744f
0x00000000
0x03837434
0x03837438
0x03837443
0x03837517
0x03837517
0x0383751a
0x03837535
0x03837520
0x03837527
0x0383752c
0x03837531
0x03837533
0x00000000
0x03837533
0x00000000
0x03837531
0x0383754b
0x0383754f
0x0383755c
0x0383755c
0x0383755f
0x03837560
0x03837561
0x03837562
0x03837563
0x03837568
0x0383756a
0x0383756c
0x0383756d
0x0383756d
0x0383756f
0x03837572
0x03837574
0x03837577
0x0383757c
0x0383757f
0x00000000
0x03837551
0x03837551
0x03837551
0x03837553
0x03837553
0x03837449
0x03837449
0x0383744c
0x0383744c
0x00000000
0x0383744c
0x03837443
0x0383750e
0x03837514
0x03837514
0x03837455
0x03837469
0x0383746d
0x00000000
0x03837473
0x03837473
0x03837476
0x03837480
0x03837484
0x0383748e
0x03837493
0x03837493
0x03837496
0x03837499
0x038374a1
0x038374b1
0x038374b5
0x00000000
0x038374bb
0x038374c1
0x038374c1
0x038374c4
0x038374c5
0x038374c6
0x038374c7
0x038374c8
0x038374cd
0x00000000
0x038374d3
0x038374d3
0x038374d6
0x038374d8
0x038374db
0x038374dd
0x038374e0
0x038374e7
0x038374ee
0x038374ee
0x038374f4
0x038374f9
0x00000000
0x038374fb
0x038374fb
0x038374fd
0x03837500
0x03837503
0x03837505
0x03837505
0x038374f9
0x00000000
0x038374cd
0x038374b5
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: fb5719bc3fe08be08b2adb35447d8ab53fc1fc299d25f9e28402a33bd50b8c76
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 4B515AB1640606EFDB15CF54C880A96BBB9FF46304F1981EAE908DF211E371EA46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03794D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E03794D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x385d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E037AFA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x3857bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E037AB0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L03784620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E0376CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E037AB640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E037AF380(_t67 + 0xc, 0x3745138, 0x10) == 0) {
								 *0x38560d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E03794F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E03794E70(0x38586b0, 0x3795690, 0, 0) != 0) {
					_t46 = E0376CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x03794d3b
0x03794d4d
0x03794d53
0x03794d58
0x03794d65
0x03794d6c
0x03794d71
0x03794d77
0x03794d7f
0x03794d8c
0x03794d8e
0x03794dad
0x03794db0
0x03794db7
0x03794db8
0x03794db9
0x03794dba
0x03794dbb
0x03794dc1
0x03794dc8
0x03794dcc
0x03794dd5
0x03794dde
0x03794ddf
0x03794de0
0x03794de1
0x03794de6
0x03794de7
0x03794de9
0x03794df3
0x00000000
0x00000000
0x037d6c7c
0x037d6c8a
0x037d6c8a
0x037d6c9d
0x037d6ca7
0x037d6cac
0x037d6cb2
0x037d6cb9
0x00000000
0x037d6cbf
0x037d6cbf
0x00000000
0x037d6cbf
0x037d6cb9
0x03794dfb
0x037d6ccf
0x037d6cd3
0x03794e32
0x03794e39
0x037d6ce0
0x037d6cf2
0x037d6cf2
0x037d6ce0
0x03794e3f
0x03794e41
0x03794e51
0x03794e51
0x03794e03
0x03794e03
0x03794e09
0x03794e0f
0x03794e57
0x00000000
0x00000000
0x03794e1b
0x03794e30
0x03794e5b
0x03794e5b
0x00000000
0x03794e30
0x03794e11
0x03794e11
0x03794e16
0x00000000
0x03794e16
0x03794e01
0x00000000
0x03794e01
0x03794da5
0x037d6c6b
0x00000000
0x03794dab
0x03794dab
0x00000000
0x03794dab

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d575f4d212cea5d28212487f0a53958ee33978caacd58c754d053a33148ccd8
Instruction ID: 9a46707bca91bbbca92cbf343c47a516853b7e8200b77f36cf33d9c86c263891
Opcode Fuzzy Hash: 9d575f4d212cea5d28212487f0a53958ee33978caacd58c754d053a33148ccd8
Instruction Fuzzy Hash: B541F275A40318AFEF21DF15DC84FAAB7B9EB44610F0402DAE9499B280D774ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 037A3D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E037A3D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E03777B60(0, _t61, 0x37411c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E03777B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L03784620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x037a3d4c
0x037a3d50
0x037a3d55
0x037a3d5e
0x037de79a
0x00000000
0x037de79a
0x037a3d68
0x037de789
0x037a3d9d
0x037a3da3
0x037a3daf
0x037a3db5
0x037a3dbc
0x037a3dc4
0x037a3dc9
0x037a3dce
0x037de7ae
0x037de7ae
0x037a3dde
0x037a3de2
0x037a3de7
0x037a3e0d
0x037a3e13
0x037a3e16
0x037a3e1e
0x037a3e25
0x037a3e28
0x00000000
0x00000000
0x037a3e2a
0x037a3e2f
0x037a3e37
0x037a3e37
0x00000000
0x037a3e37
0x037a3e31
0x00000000
0x037a3e31
0x037a3e20
0x037a3e20
0x037a3e35
0x00000000
0x037a3de9
0x037a3de9
0x037a3de9
0x037a3dee
0x037a3dfd
0x037a3dff
0x037a3e02
0x037a3e05
0x037a3e05
0x00000000
0x037a3df0
0x037a3de7
0x037de78f
0x037de794
0x037a3d79
0x037a3d84
0x037a3d89
0x037a3d8e
0x00000000
0x037de7a4
0x037a3d96
0x037a3d9a
0x00000000
0x037a3d9a
0x00000000
0x037de794
0x037a3d6e
0x037a3d73
0x00000000
0x037de7b5
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf1d6565fbcc862d5b5d09db50638f32d2bc2480b51ff6818465be696da0045
Instruction ID: 4e9beb216b35a74f0dcae7c8620391840c761c3ed1760412b24bfe60c931ffd8
Opcode Fuzzy Hash: 2cf1d6565fbcc862d5b5d09db50638f32d2bc2480b51ff6818465be696da0045
Instruction Fuzzy Hash: 0731E03AA05A10DBE729CF2DC841A3BBBF4EF85710B09826EE849DB350E730D840D790

Uniqueness

Uniqueness Score: -1.00%

Function 0378C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0378C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E03787D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E03838D34(_v8, _t80);
					}
					E03782280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E0377FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E03838833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E0377FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E037AB180();
						if(_a4 != 0) {
							E03782280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0378BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0378BB2D(_t16, _t15);
						E0378B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E0377FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E0377FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E0377FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x0378c18d
0x0378c18f
0x0378c191
0x0378c19b
0x0378c1a0
0x0378c1d4
0x0378c1de
0x037d2d6e
0x0378c1e4
0x0378c1e4
0x0378c1e4
0x0378c1ec
0x037d2d7d
0x037d2d7d
0x0378c1f3
0x0378c1ff
0x037d2d88
0x037d2d8d
0x037d2d94
0x037d2d94
0x037d2d9f
0x037d2da4
0x037d2dab
0x037d2db0
0x037d2db2
0x037d2db3
0x037d2db4
0x037d2dbc
0x037d2dc3
0x037d2dc3
0x0378c205
0x0378c205
0x0378c208
0x0378c20e
0x0378c211
0x0378c216
0x0378c219
0x0378c21f
0x0378c222
0x0378c22c
0x0378c234
0x0378c23a
0x0378c23f
0x0378c245
0x0378c24b
0x0378c251
0x0378c25a
0x0378c276
0x0378c27d
0x0378c27d
0x0378c25c
0x0378c25c
0x00000000
0x0378c25e
0x0378c1a4
0x0378c1aa
0x0378c1b3
0x0378c265
0x0378c26c
0x0378c26c
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 1d5b35aa68237614ac1abc592f5cf3ea3ec44a2365a8be5fc53106a36d13611e
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: AB314676A4168BFEDB05FBB4C484BE9F768BF42204F08415AD41C9B341DB346A0ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 037E7016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E037E7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x385d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E037E6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E037E6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E03787D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E037A9AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E037AB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L03784620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x037e7016
0x037e701e
0x037e702b
0x037e7033
0x037e7037
0x037e703c
0x037e703e
0x037e7041
0x037e7045
0x037e704a
0x037e7050
0x037e7055
0x037e705a
0x037e7062
0x037e7062
0x037e705a
0x037e7064
0x037e7064
0x037e7067
0x037e7071
0x037e7096
0x037e709b
0x037e70a2
0x037e70a6
0x037e70a7
0x037e70ad
0x037e70b3
0x037e70b6
0x037e70bb
0x037e70c3
0x037e70c3
0x037e70c6
0x037e70cd
0x037e70dd
0x037e70e0
0x037e70e2
0x037e70e2
0x037e70ee
0x037e7101
0x037e70f0
0x037e70f9
0x037e70f9
0x037e710a
0x037e710e
0x037e7112
0x037e7117
0x037e7118
0x037e7118
0x037e70bb
0x037e711d
0x037e7123
0x037e7131
0x037e7131
0x037e7136
0x037e713d
0x037e713e
0x037e713f
0x037e714a
0x037e714a
0x037e7084
0x037e7088
0x00000000
0x037e708e
0x037e708e
0x037e7092
0x00000000
0x037e7092

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6b1b83394cb2d8af419837846d4f574d718ce26b1fbf726295e3461924d272e
Instruction ID: 714f86e8d782932f61fdf6de2861cb4612b4337f70a45e3b4283fa54acd6d2d7
Opcode Fuzzy Hash: c6b1b83394cb2d8af419837846d4f574d718ce26b1fbf726295e3461924d272e
Instruction Fuzzy Hash: 9031C4766047959BC324DF68C940A6AB3E5FFCC700F184A29F8958B690E730E904CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 037A8EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E037A8EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x385d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E03794E70(0x38586e4, 0x37a9490, 0, 0);
					if( *0x38553e8 > 5 && E037A8F33(0x38553e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x38553e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x38553e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x374bc46;
						_t48 = E037E7B9C(0x38553e8, 0x374bc46, _t67, 0x38553e8, _t70,  &_v140);
					}
				}
				return E037AB640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x037a8ec7
0x037a8ed9
0x037a8edc
0x037a8ee6
0x037a8ee9
0x037a8eee
0x037a8efc
0x037a8f08
0x037e1349
0x037e1353
0x037e135d
0x037e1366
0x037e136f
0x037e1375
0x037e137c
0x037e1385
0x037e1390
0x037e1391
0x037e139c
0x037e139d
0x037e13a6
0x037e13ac
0x037e13b2
0x037e13b5
0x037e13bc
0x037e13bf
0x037e13c2
0x037e13c5
0x037e13c8
0x037e13cb
0x037e13ce
0x037e13d1
0x037e13d4
0x037e13d7
0x037e13da
0x037e13dd
0x037e13e0
0x037e13e3
0x037e13e6
0x037e13e9
0x037e13f6
0x037e1400
0x037e1400
0x037a8f08
0x037a8f32

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2c5a0d905e1ed4416afc546b856abcb7a415ef317a809d971371c8d66d1f2b
Instruction ID: 135fee0a8a4e764345b4df14abcbe7d34ca5725f3229177045d3fc5bedf446b1
Opcode Fuzzy Hash: 8a2c5a0d905e1ed4416afc546b856abcb7a415ef317a809d971371c8d66d1f2b
Instruction Fuzzy Hash: 204190B1D00718AEDB24CFAAD981AADFBF4FB89310F5041AEE519A7200E7745A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0379E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0379E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E037A9670() < 0) {
					L037BDF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x3857b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L03784620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0379E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x0379e730
0x0379e736
0x0379e738
0x0379e73d
0x0379e73e
0x0379e740
0x0379e749
0x0379e765
0x0379e76a
0x0379e76b
0x0379e76c
0x0379e76d
0x0379e76e
0x0379e76f
0x0379e775
0x0379e777
0x0379e77e
0x037db675
0x0379e784
0x0379e784
0x0379e789
0x0379e7a8
0x0379e7ac
0x0379e807
0x0379e7ae
0x0379e7ae
0x0379e7b1
0x0379e7b4
0x0379e7b9
0x0379e7c0
0x0379e7c4
0x0379e7ca
0x0379e7cc
0x00000000
0x0379e7d3
0x0379e7d6
0x00000000
0x00000000
0x0379e7ff
0x0379e802
0x00000000
0x00000000
0x0379e7f9
0x0379e7fc
0x00000000
0x00000000
0x0379e7f3
0x0379e7f6
0x00000000
0x00000000
0x0379e7ed
0x0379e7f0
0x00000000
0x00000000
0x0379e7e7
0x0379e7ea
0x00000000
0x00000000
0x037db685
0x037db688
0x00000000
0x00000000
0x037db682
0x00000000
0x00000000
0x0379e7cc
0x0379e7d9
0x0379e7dc
0x0379e7de
0x0379e7de
0x0379e7ac
0x0379e7e4
0x0379e74b
0x0379e751
0x0379e759
0x0379e761
0x0379e761

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba6798fe9de5eefeb7a6720a007a2805576af9da1236cc97a2ca7da60c85ae5
Instruction ID: db65c10476a55bdb424a76219fd3a8cd0db9a135f8c2ad46ff095d39c3610035
Opcode Fuzzy Hash: dba6798fe9de5eefeb7a6720a007a2805576af9da1236cc97a2ca7da60c85ae5
Instruction Fuzzy Hash: A3318D75A14249EFEB04CF58D840F9AB7E4FB09310F1482AAF904CB741E631E880CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0379BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0379BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x3856100; // 0x11
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E03782280(0xd, 0x119af1a0);
				_t41 =  *0x38560f8; // 0x0
				if(_t41 != 0) {
					 *0x38560f8 =  *_t41;
					 *0x38560fc =  *0x38560fc + 0xffff;
				}
				E0377FFB0(_t41, 0x800, 0x119af1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x38560f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L03784620(0x3856100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x3856100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x0379bc36
0x0379bc42
0x0379bc45
0x0379bc4a
0x0379bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x0379bc50
0x0379bc50
0x0379bc58
0x0379bc5a
0x0379bc60
0x00000000
0x00000000
0x037da4f2
0x037da4f6
0x00000000
0x00000000
0x00000000
0x037da4fc
0x0379bc79
0x0379bc7e
0x0379bc86
0x0379bd16
0x0379bd20
0x0379bd20
0x0379bc8d
0x0379bc94
0x0379bcbd
0x0379bcca
0x0379bccb
0x0379bccc
0x0379bccd
0x0379bcce
0x0379bcd4
0x0379bcea
0x0379bcee
0x0379bcf2
0x0379bd00
0x0379bd04
0x00000000
0x0379bc96
0x0379bcab
0x0379bcaf
0x0379bd2c
0x0379bd2c
0x0379bd09
0x00000000
0x0379bd09
0x0379bcb1
0x0379bcb5
0x0379bcbb
0x00000000
0x00000000
0x00000000
0x0379bcbb

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936d08013dac2066a66da99b783ae0cf5bef851ab1b393e11ccadae218318ebf
Instruction ID: 7acebe37214b415b66595761c2aac387ff9cb81ea837533c2735f229ea15ac17
Opcode Fuzzy Hash: 936d08013dac2066a66da99b783ae0cf5bef851ab1b393e11ccadae218318ebf
Instruction Fuzzy Hash: 1231E336A00B159BDF11EF58E4807A6B3B4FB19311F4401BAED44EB205FB74D945CB80

Uniqueness

Uniqueness Score: -1.00%

Function 03769100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E03769100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x383f6e8);
				E037BD0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E038388F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E037BD130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x38586c0; // 0xba07b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x38586b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E03782280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E038388F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E037AAFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x385b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x38584c0;
										if(_t69 >=  *0x38584c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E03839063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E0376922A(_t82);
							_t53 = E03787D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E03838B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x38586c0; // 0xba07b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x38586b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x38586bc;
										_t72 = 0x38586b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E03769240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x38586c4;
									_t72 = 0x38586c0;
									L18:
									E03799B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x03769100
0x03769100
0x03769100
0x03769100
0x03769102
0x03769107
0x0376910c
0x03769110
0x03769115
0x03769136
0x03769143
0x037c37e4
0x037c37e4
0x03769149
0x0376914e
0x0376914e
0x03769117
0x0376911d
0x00000000
0x00000000
0x0376911f
0x03769125
0x00000000
0x03769151
0x03769158
0x0376915d
0x03769161
0x03769168
0x037c3715
0x00000000
0x0376916e
0x0376916e
0x03769175
0x03769177
0x0376917e
0x0376917f
0x03769182
0x03769182
0x03769187
0x03769187
0x0376918a
0x0376918d
0x0376918f
0x03769192
0x03769195
0x03769198
0x03769198
0x03769198
0x0376919a
0x00000000
0x00000000
0x037c371f
0x037c3721
0x037c3727
0x037c372f
0x037c3733
0x037c3735
0x037c3738
0x037c373b
0x037c373d
0x037c3740
0x00000000
0x00000000
0x037c3746
0x037c3749
0x00000000
0x00000000
0x037c374f
0x037c3751
0x00000000
0x00000000
0x037c3757
0x037c3759
0x037c375c
0x037c375c
0x037c375e
0x037c375e
0x037c3761
0x037c3764
0x00000000
0x00000000
0x037c3766
0x037c3768
0x037c37a3
0x037c37a3
0x037c37a5
0x037c37a7
0x037c37ad
0x037c37b0
0x037c37b2
0x037c37bc
0x037c37c2
0x037c37c2
0x037c37b2
0x03769187
0x03769187
0x0376918a
0x0376918d
0x0376918f
0x03769192
0x03769195
0x00000000
0x03769195
0x00000000
0x03769187
0x037c376a
0x037c376a
0x037c376c
0x037c376c
0x037c376f
0x037c3775
0x00000000
0x00000000
0x037c3777
0x037c3779
0x00000000
0x00000000
0x037c3782
0x037c3787
0x037c3789
0x037c3790
0x037c3790
0x037c378b
0x037c378b
0x037c378b
0x037c3792
0x037c3795
0x037c3795
0x037c3798
0x037c3798
0x037c379b
0x037c379b
0x037691a3
0x037691a9
0x037691b0
0x037691b4
0x037691b4
0x037691bb
0x037691c0
0x037691c5
0x037691c7
0x037c37da
0x037691cd
0x037691cd
0x037691cd
0x037691d2
0x037691d5
0x03769239
0x03769239
0x037691d7
0x037691db
0x037691e1
0x037691e7
0x037691fd
0x03769203
0x0376921e
0x03769223
0x00000000
0x03769223
0x03769205
0x03769208
0x0376920c
0x03769214
0x03769214
0x037691e9
0x037691e9
0x037691ee
0x037691f3
0x037691f3
0x037691f3
0x037691e7
0x00000000
0x037691db
0x03769187
0x03769168

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8358944a8c6f2c5cce970bbe5776225bdfece1de1737c8f2422f27c75f8e9a32
Instruction ID: 805fda0eb4666dec95c481eb0fed3991568939d3d09173f119cac41d8462068f
Opcode Fuzzy Hash: 8358944a8c6f2c5cce970bbe5776225bdfece1de1737c8f2422f27c75f8e9a32
Instruction Fuzzy Hash: C431C575A01789DFDB29DF68C5987ACFBF1BB4A310F2C818ADA0567241C334A984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03780050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E03780050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x385d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E03799ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E037AB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E03838A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E03799702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x385b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x03780055
0x0378005d
0x03780062
0x0378006c
0x0378006f
0x03780074
0x0378007a
0x0378007a
0x03780080
0x03780080
0x03780087
0x0378008d
0x0378008f
0x03780093
0x03780095
0x0378009b
0x037800f8
0x037800fb
0x037800fc
0x037800ff
0x03780108
0x03780108
0x037800a2
0x037800a6
0x037800b3
0x037800bc
0x037800c5
0x037800ca
0x037cc01e
0x00000000
0x00000000
0x037cc02d
0x037800d5
0x037800d9
0x037cc03d
0x037cc046
0x037cc046
0x037800df
0x037800e2
0x037800ea
0x037800ef
0x037800f2
0x037800f6
0x03780111
0x03780117
0x03780117
0x00000000
0x037800f6
0x037800d0
0x037800d0
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f919162004c11d28abd39cd278517b241d1bb1e7b20e4cff9f6e3a5264195a5
Instruction ID: be131cc4b16618a95882f5937221893a69f73eae44b84023b418c88818576401
Opcode Fuzzy Hash: 3f919162004c11d28abd39cd278517b241d1bb1e7b20e4cff9f6e3a5264195a5
Instruction Fuzzy Hash: 9831C131241B08DFD722DF28C844B96B3E5FF89714F1846ADE49A87790EB35AC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 037E6C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E037E6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E03787D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x3857b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L03784620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E037AF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E03787D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E037A9AE0();
						_t23 = L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x037e6c0a
0x037e6c0f
0x037e6c10
0x037e6c13
0x037e6c15
0x037e6c19
0x037e6c1c
0x037e6c21
0x037e6c28
0x037e6c3a
0x037e6c2a
0x037e6c33
0x037e6c33
0x037e6c3f
0x037e6c48
0x037e6c4d
0x037e6c60
0x037e6c65
0x037e6c69
0x037e6c73
0x037e6c79
0x037e6c7f
0x037e6c86
0x037e6c90
0x037e6c94
0x037e6ca6
0x037e6cb2
0x037e6cbd
0x037e6cbd
0x037e6cc3
0x037e6cc7
0x037e6ccb
0x037e6cd0
0x037e6cd1
0x037e6ce2
0x037e6ce2
0x037e6c69
0x037e6ced

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254ca92558fcc32c78a91c83f090dd8a42339e5b7bb0d6ea1fb1ad5e1d625d4f
Instruction ID: c35fab40fbf30e7dc0820695c71b99b4ab0287154ed528035a6d9cfbeff81b4d
Opcode Fuzzy Hash: 254ca92558fcc32c78a91c83f090dd8a42339e5b7bb0d6ea1fb1ad5e1d625d4f
Instruction Fuzzy Hash: DF219A75A00654ABC715DB68D884F2AB7E8FF48700F1400A9F905DB7A0D634E950CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 037A90AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E037A90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E037BD4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0379E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L03784620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E037AF3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0379A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x037a90af
0x037a90b8
0x037a90bb
0x037a90bf
0x037a90c2
0x037a90c2
0x037a90c8
0x037a90cb
0x037a90cd
0x037e14d7
0x037e14eb
0x037e14eb
0x00000000
0x037e14eb
0x037e14db
0x037e14e6
0x00000000
0x037e14f2
0x037e14e8
0x00000000
0x037e14e8
0x037a90d8
0x037a90da
0x037a90dd
0x037a90e5
0x00000000
0x037a9139
0x037a90fa
0x037a90fe
0x037a9142
0x00000000
0x037a9142
0x037a9104
0x037a9107
0x037a910b
0x037a9110
0x037a9118
0x037a9147
0x037a9148
0x037a914f
0x037a9150
0x037a9151
0x037a9152
0x037a9156
0x037a915d
0x037a9160
0x037a9168
0x037a916c
0x037a91bc
0x037a91be
0x00000000
0x037a91be
0x037a916e
0x037a9173
0x037a9176
0x00000000
0x00000000
0x037a917c
0x037a9180
0x037a91b5
0x00000000
0x037a91b5
0x037a9182
0x037a9185
0x037a9189
0x00000000
0x00000000
0x037a918e
0x037a9190
0x037a9198
0x00000000
0x00000000
0x037a91a0
0x00000000
0x037a91ad
0x037a91ad
0x037a91b0
0x037a91b1
0x00000000
0x037a9185
0x037a911a
0x037a911c
0x037a911f
0x037a9125
0x037a9127
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 020b36eda0844461b0378c5b663bc1e85bf9e7c15568b7cd954ca3fb2f4f579c
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 31216575A00709EFDB20DF59C844E9AF7F8EB89350F14856AEA45DB210D370ED50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 03793B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E03793B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x38584c4; // 0x0
				_v12 = 1;
				_v8 =  *0x38584c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L03784620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x38584c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E037AAA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E037AFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x38584c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x38584c4; // 0x0
					L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x03793b89
0x03793b96
0x03793ba1
0x03793bab
0x03793bb5
0x03793bb9
0x037d6298
0x03793bbf
0x03793bc2
0x03793bc3
0x03793bc9
0x03793bca
0x03793bcc
0x03793bcd
0x03793bd4
0x03793bd6
0x03793bdb
0x03793bea
0x03793bf7
0x03793bfb
0x03793bff
0x03793c09
0x03793c0a
0x03793c0b
0x03793c0f
0x03793c14
0x03793c18
0x03793c18
0x03793bfb
0x03793c1b
0x03793c30
0x03793c30
0x03793c3d

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fafc2a645046d32375e95f8d70366258fa8e138f5ae1f7b4fdba6ae61fe7b90
Instruction ID: 095017b8db45ab67261588f73a426f7ff6cd03bddb4c4eca7d178be485c309a1
Opcode Fuzzy Hash: 3fafc2a645046d32375e95f8d70366258fa8e138f5ae1f7b4fdba6ae61fe7b90
Instruction Fuzzy Hash: B221C672B00604AFDB04EF98DD81F6ABBBDFB44708F1501A9E905AB251D375EE01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 037E6CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E037E6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E03787D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E03787D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x3745c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E0379F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E0379F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E037E7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L03782400( &_v52);
								}
								_t21 = L03782400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x037e6cfb
0x037e6d00
0x037e6d02
0x037e6d06
0x037e6d0a
0x037e6d0e
0x037e6d19
0x037e6d2b
0x037e6d1b
0x037e6d24
0x037e6d24
0x037e6d33
0x037e6d39
0x037e6d46
0x037e6d4f
0x037e6d61
0x037e6d51
0x037e6d5a
0x037e6d5a
0x037e6d69
0x037e6d6b
0x037e6d6d
0x037e6d6f
0x037e6d6f
0x037e6d74
0x037e6d79
0x037e6d7a
0x037e6d7f
0x037e6d82
0x037e6d88
0x037e6d89
0x037e6d90
0x037e6d94
0x037e6da7
0x037e6db1
0x037e6db1
0x037e6dbb
0x037e6dbb
0x037e6d90
0x037e6d69
0x037e6d46
0x037e6dc6

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7e067d0958ef570bae26719873e291551164d87f3a4265ad9bbe3edeb4267b
Instruction ID: 4137c3412d651605a659f5b20209ff79d4805d1aad64ae3799f70c696bb1bd55
Opcode Fuzzy Hash: cf7e067d0958ef570bae26719873e291551164d87f3a4265ad9bbe3edeb4267b
Instruction Fuzzy Hash: F52104725007489BCB11EFA8C948B6BB7ECEF99640F480966F940EB251E734D908C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0383070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0383070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E038307DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E0382AFDE( &_v8,  &_v12);
					E03831293(_t38, _v28, _t60);
					if(E03787D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E038214FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x0383071b
0x03830724
0x03830734
0x03830738
0x0383074b
0x0383074b
0x03830753
0x03830753
0x03830759
0x0383075d
0x03830774
0x03830779
0x0383077d
0x03830789
0x03830795
0x038307a7
0x03830797
0x038307a0
0x038307a0
0x038307af
0x038307c4
0x038307cd
0x038307cd
0x038307af
0x038307dc

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: de5be1a8e271011b6aa5bd956de41f0af460792213cd53aef4aea99da883336d
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: E42125762042049FC705DF58C884A6ABBA5EFC1310F0885A9F855CB381DB30D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 037E7794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E037E7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x3857b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L03784620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E037AF3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E03787D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E037A9AE0();
					_t24 = L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x037e7799
0x037e779a
0x037e779b
0x037e77a3
0x037e77ab
0x037e77ae
0x037e77b1
0x037e77b1
0x037e77bf
0x037e77c4
0x037e77c8
0x037e77ce
0x037e77d4
0x037e77e0
0x037e77e0
0x037e77d6
0x037e77d6
0x037e77de
0x00000000
0x00000000
0x037e77de
0x037e77e5
0x037e77f0
0x037e77f3
0x037e77f6
0x037e77fd
0x037e7800
0x037e780c
0x037e7818
0x037e782b
0x037e781a
0x037e7823
0x037e7823
0x037e7830
0x037e7831
0x037e7838
0x037e783d
0x037e783e
0x037e784f
0x037e784f
0x037e785a

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f1a226227d82534f0e83d89c4a530b6e84a1eaf03aaa9f7c48213d8ba05fcb
Instruction ID: 48fc131a33b82d432a901cb1c1145bbf3d3493bdd14beb0d9b25a7f06b22bd24
Opcode Fuzzy Hash: 24f1a226227d82534f0e83d89c4a530b6e84a1eaf03aaa9f7c48213d8ba05fcb
Instruction Fuzzy Hash: 9521AE76900A44EBC729DF69DC84E6BB7A9EF8C340F14456DF50ADB750E634E900CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0378AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0378AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E03787D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E03787D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E03787D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E03787D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E037E7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x0378ae78
0x0378ae7c
0x0378ae7e
0x0378ae81
0x0378ae86
0x0378ae8d
0x037d2691
0x0378ae93
0x0378ae93
0x0378ae93
0x0378ae98
0x0378ae9d
0x037d26a2
0x037d26b4
0x037d26a4
0x037d26ad
0x037d26ad
0x037d26b9
0x00000000
0x037d26bb
0x00000000
0x037d26bb
0x0378aea3
0x0378aea3
0x0378aea3
0x0378aeaa
0x037d26c0
0x037d26c9
0x037d26c9
0x0378aeb3
0x037d26d4
0x037d26e1
0x00000000
0x00000000
0x037d26e7
0x037d26ee
0x037d26f0
0x037d26f9
0x037d26f9
0x037d2702
0x037d2708
0x037d2708
0x037d270b
0x037d270f
0x037d2711
0x037d2711
0x037d2725
0x037d2725
0x00000000
0x0378aeb9
0x0378aeb9
0x0378aebf
0x0378aebf
0x0378aeb3

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 53d3a6ec4efc86c37bcb1834a30f4510854257a09f4d9281b3ba39a44bcadaa9
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 7A21D131A41780DFD726EB29C948B2577F8EF44250F1D08E1DD049BAA2E738DC42C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 0379FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0379FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E037776E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L03784620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x0379fd9b
0x0379fda0
0x0379fda1
0x0379fdab
0x0379fdad
0x0379fdb0
0x0379fdb8
0x0379fe0f
0x0379fde6
0x0379fde9
0x0379fdec
0x037dc0c0
0x0379fdfe
0x0379fe06
0x0379fe06
0x037dc0c8
0x0379fe2d
0x0379fe2d
0x00000000
0x0379fe2d
0x037dc0d1
0x037dc0e0
0x037dc0e5
0x037dc0e5
0x037dc0e8
0x00000000
0x037dc0e8
0x0379fdf4
0x00000000
0x00000000
0x0379fdf6
0x0379fdfa
0x0379fe1a
0x0379fe1f
0x0379fe1f
0x0379fdfc
0x00000000
0x0379fdfc
0x0379fdcc
0x0379fdd0
0x0379fe26
0x00000000
0x0379fe26
0x0379fdd8
0x0379fddb
0x0379fddd
0x0379fde0
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: e4eb78fc362ce6d004a016e0a16f5e3f6c2bdd9ee003a6ccebb37df63831bd7b
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: D1217C72A40A45DFEB35CF09E540A66F7E9EB94A11F28826EE945DB614D7309C00DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0379B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0379B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E03782280(_t12, 0x3858608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E037A00C2(0x3858608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x0379b395
0x0379b3a2
0x0379b3a5
0x0379b3aa
0x0379b3b2
0x0379b3ba
0x0379b3bd
0x0379b3c0
0x0379b3c4
0x0379b3c9
0x037da3e9
0x037da3ed
0x037da3f0
0x037da3ff
0x037da403
0x037da409
0x00000000
0x00000000
0x037da40b
0x037da40b
0x037da40f
0x037da415
0x037da423
0x037da423
0x037da415
0x0379b3d1
0x0379b3e8
0x0379b3e8
0x0379b3d9

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c30da2895866e7a6a250a410ad89acaecfd3be83936820dcdefb5a69a81ce0
Instruction ID: 9ca03ace40471a400770bd23c91c1ed19ab6224106ca88a8e9db99e5fc593319
Opcode Fuzzy Hash: 25c30da2895866e7a6a250a410ad89acaecfd3be83936820dcdefb5a69a81ce0
Instruction Fuzzy Hash: F4116F373011149FCB18DA54AD4152B72ABEBCD330B29027EED16CB380CA319C01C794

Uniqueness

Uniqueness Score: -1.00%

Function 03769240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E03769240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x383f708);
				E037BD08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E037A95D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E037A95D0();
				_t33 =  *0x38584c4; // 0x0
				L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x38584c4; // 0x0
				L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x38584c4; // 0x0
				E03782280(L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x38586b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E037A95D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E037A95D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E03769325();
					_t50 =  *0x38584c4; // 0x0
					return E037BD0D1(L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x03769240
0x03769242
0x03769247
0x0376924c
0x0376924e
0x03769255
0x03769257
0x0376925a
0x0376925f
0x0376925f
0x03769266
0x03769271
0x03769276
0x03769279
0x0376927e
0x03769295
0x0376929a
0x037692b1
0x037692b6
0x037692d7
0x037692dc
0x037692e0
0x037692e6
0x037692e8
0x037692ee
0x03769332
0x03769333
0x03769337
0x03769338
0x0376933a
0x0376933a
0x0376933d
0x03769342
0x03769342
0x03769345
0x03769349
0x0376934e
0x03769352
0x03769357
0x037692f4
0x037692f4
0x037692f6
0x037692f9
0x03769300
0x03769306
0x03769324
0x03769324

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b14a86e313c1f636cb6cc4b13bd2726796d16c5f75dcf0ad10a34ca640cbffd1
Instruction ID: b4fe54c41dff366b068850034c00b3d85b322dafbf1c742c73592dc2a2d72c1f
Opcode Fuzzy Hash: b14a86e313c1f636cb6cc4b13bd2726796d16c5f75dcf0ad10a34ca640cbffd1
Instruction Fuzzy Hash: EA215735181B40DFC725FF68CA18F5AB7F9FF08704F1445A9E51A8A6A2CB38E941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 037E46A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E037E46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L03784620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E037AF3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0379D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L037877F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x037e46b7
0x037e46ba
0x037e46c5
0x037e46c8
0x037e46d0
0x037e46d4
0x037e46e6
0x037e46e9
0x037e46f4
0x037e46ff
0x037e4705
0x037e4706
0x037e470c
0x037e4713
0x037e471b
0x037e4723
0x037e4725
0x037e46d6
0x037e46d9
0x037e46db
0x037e46db
0x037e4732

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: fb6c08796dbae58888fb17f376899256af4802982633aaa31f2f74d4417b21a8
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 2B112576504208BBCB05DF5DD8809BEBBB9EF89300F1080AEF944CB350DA318D51D3A4

Uniqueness

Uniqueness Score: -1.00%

Function 0377766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0377766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E0379F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E0379F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L03784620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x03777672
0x0377767f
0x03777689
0x037776de
0x037776de
0x0377768b
0x03777691
0x03777693
0x03777697
0x00000000
0x03777699
0x037776a8
0x00000000
0x037776aa
0x037776ad
0x037776b1
0x00000000
0x037776b3
0x037776b3
0x037776b5
0x037776ba
0x037776bc
0x037776bc
0x037776c0
0x00000000
0x037776c2
0x037776ce
0x037776ce
0x037776c0
0x037776b1
0x037776a8
0x03777697
0x037776d9

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 130bc49ad23a669a3c4184231f03df795fa5f8c7734e2be98a23bd4707d421ba
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 3801AC36700259ABDF34DE5EDC85F6BB7ADEB84660F240525B908CF254DA30DD21D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 037FC450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E037FC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E037A9910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E037A95B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E037A95D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E037A95D0();
				return L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x037fc458
0x037fc45d
0x037fc466
0x037fc468
0x037fc469
0x037fc46a
0x037fc46b
0x037fc46e
0x037fc46f
0x037fc471
0x037fc476
0x037fc476
0x037fc47c
0x037fc47e
0x037fc480
0x037fc480
0x037fc483
0x037fc484
0x037fc486
0x037fc488
0x037fc48f
0x037fc491
0x037fc493
0x037fc493
0x037fc48f
0x037fc498
0x037fc49e
0x037fc4ad
0x037fc4ad
0x037fc4b2
0x037fc4b4
0x037fc4cd

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: a80a9b023d6987faf5457c6419f47dd07bbb14c2f244c11cddb57cb49e009d7f
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 16019675180A0ABFD715EF69CC85E62FB6DFF95350F144525F215466A0C721ACA0C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 03769080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E03769080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x38585ec;
				E03782280(_t48, 0x38585ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E0377FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x385538c; // 0x77f06888
					if( *_t84 != 0x3855388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x383f6e8);
						E037BD0E8(0x38585ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E038388F5(_t80, _t85, 0x3855388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x38586c0; // 0xba07b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x38586b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E03782280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E038388F5(0x38585ec, _t85, 0x3855388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E037AAFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x385b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x38584c0;
																			if(_t82 >=  *0x38584c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E03839063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E0376922A(_t99);
										_t64 = E03787D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E03838B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x38586c0; // 0xba07b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x38586b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x38586bc;
													_t87 = 0x38586b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E03769240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x38586c4;
												_t87 = 0x38586c0;
												L27:
												E03799B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E037BD130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x3855388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x385538c = _t51;
						goto L6;
					}
				}
			}

0x03769082
0x03769083
0x03769084
0x03769085
0x03769087
0x03769096
0x03769098
0x03769098
0x0376909e
0x037690a8
0x037690e7
0x037690e7
0x037690aa
0x037690b0
0x037690b7
0x037690bd
0x037690dd
0x037690e6
0x037690bf
0x037690bf
0x037690c7
0x037690cf
0x037690f1
0x037690f2
0x037690f4
0x037690f5
0x037690f6
0x037690f7
0x037690f8
0x037690f9
0x037690fa
0x037690fb
0x037690fc
0x037690fd
0x037690fe
0x037690ff
0x03769100
0x03769102
0x03769107
0x0376910c
0x03769110
0x03769113
0x03769115
0x03769136
0x0376913f
0x03769143
0x037c37e4
0x037c37e4
0x03769117
0x03769117
0x0376911d
0x00000000
0x0376911f
0x0376911f
0x03769125
0x00000000
0x03769127
0x0376912d
0x03769130
0x03769134
0x03769158
0x0376915d
0x03769161
0x03769168
0x037c3715
0x0376916e
0x0376916e
0x03769175
0x03769177
0x0376917e
0x0376917f
0x03769182
0x03769182
0x03769187
0x03769187
0x0376918a
0x0376918d
0x0376918f
0x03769192
0x03769195
0x03769198
0x03769198
0x03769198
0x0376919a
0x00000000
0x00000000
0x037c371f
0x037c3721
0x037c3727
0x037c372f
0x037c3733
0x037c3735
0x037c3738
0x037c373b
0x037c373d
0x037c3740
0x00000000
0x037c3746
0x037c3746
0x037c3749
0x00000000
0x037c374f
0x037c374f
0x037c3751
0x037c3757
0x037c3759
0x037c375c
0x037c375c
0x037c375e
0x037c375e
0x037c3761
0x037c3764
0x00000000
0x00000000
0x037c3766
0x037c3768
0x037c37a3
0x037c37a3
0x037c37a5
0x037c37a7
0x037c37ad
0x037c37b0
0x037c37b2
0x037c37bc
0x037c37c2
0x037c37c2
0x037c37b2
0x03769187
0x03769187
0x0376918a
0x0376918d
0x0376918f
0x03769192
0x03769195
0x00000000
0x03769195
0x00000000
0x037c376a
0x037c376a
0x037c376a
0x037c376c
0x037c376c
0x037c376f
0x037c3775
0x00000000
0x00000000
0x037c3777
0x037c3779
0x037c3782
0x037c3787
0x037c3789
0x037c3790
0x037c3790
0x037c378b
0x037c378b
0x037c378b
0x037c3792
0x037c3795
0x00000000
0x037c3795
0x00000000
0x037c3779
0x037c3798
0x00000000
0x037c3798
0x00000000
0x037c3768
0x037c379b
0x037c379b
0x037c3751
0x037c3749
0x00000000
0x037c3740
0x037691a0
0x037691a3
0x037691a9
0x037691b0
0x00000000
0x037691b0
0x03769187
0x037691b4
0x037691b4
0x037691bb
0x037691c0
0x037691c5
0x037691c7
0x037c37da
0x037691cd
0x037691cd
0x037691cd
0x037691d2
0x037691d5
0x03769239
0x03769239
0x037691d7
0x037691db
0x037691e1
0x037691e7
0x037691fd
0x03769203
0x0376921e
0x03769223
0x00000000
0x03769205
0x03769205
0x03769208
0x0376920c
0x03769214
0x03769214
0x0376920c
0x037691e9
0x037691e9
0x037691ee
0x037691f3
0x037691f3
0x037691f3
0x037691e7
0x00000000
0x00000000
0x00000000
0x03769134
0x03769125
0x0376911d
0x0376914e
0x037690d1
0x037690d1
0x037690d3
0x037690d6
0x037690d8
0x00000000
0x037690d8
0x037690cf

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 685a54c1de56a1445a301ed629a35d66745e9d67d7c04ce3783a5da686ee60b6
Instruction ID: 56b0b234b582fa9204f8430e8d512cb5049a5f4e437e26c4e18b3e169833c279
Opcode Fuzzy Hash: 685a54c1de56a1445a301ed629a35d66745e9d67d7c04ce3783a5da686ee60b6
Instruction Fuzzy Hash: BD01A472601B098FC315DF14D850B11B7A9EB87321F2540A6EA05CF691C774DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03834015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E03834015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E03782280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E03782280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x38586ac);
					E0376F900(0x38586d4, _t28);
					E0377FFB0(0x38586ac, _t28, 0x38586ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E0377FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x0383401a
0x0383401e
0x03834023
0x03834028
0x03834029
0x0383402b
0x0383402f
0x03834043
0x03834046
0x03834051
0x03834057
0x0383405f
0x03834062
0x03834067
0x0383406f
0x0383407c
0x0383407c
0x0383408c
0x0383408c
0x03834097

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71fbfa514793a06210a1089d530bd2756dfc0f196fcd25dcf448e7a0cb46a58
Instruction ID: d6ec46f27603ee20b4e78b03b5c1ec1fcd3cb60e8f85be85f94e7651f2e4e071
Opcode Fuzzy Hash: d71fbfa514793a06210a1089d530bd2756dfc0f196fcd25dcf448e7a0cb46a58
Instruction Fuzzy Hash: 5B018475341649BFC751FB79CD88E57B7ECEB45660B000269F508CBA11CB24EC11C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0382138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0382138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x385d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E037AFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E03787D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x0382138a
0x0382138a
0x03821399
0x038213a3
0x038213a8
0x038213aa
0x038213b5
0x038213bb
0x038213c3
0x038213c6
0x038213c9
0x038213d4
0x038213e6
0x038213d6
0x038213df
0x038213df
0x038213f1
0x038213f2
0x038213f4
0x038213f9
0x0382140e

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db8f92a754be90ae9f3788dbdae0d9ab640fbafa18560e5b27a563671b53c42
Instruction ID: 2af2c5f01208868a5c7f7b17c37f83da90a2f4cfb81cd15810663a6aadc93a99
Opcode Fuzzy Hash: 1db8f92a754be90ae9f3788dbdae0d9ab640fbafa18560e5b27a563671b53c42
Instruction Fuzzy Hash: 25019275A0071CAFCB14EFA8D889FAEBBB8EF84700F504056F900EB280D6749A40C790

Uniqueness

Uniqueness Score: -1.00%

Function 038214FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E038214FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x385d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E037AFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E03787D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x038214fb
0x038214fb
0x0382150a
0x03821514
0x03821519
0x0382151b
0x03821526
0x0382152c
0x03821534
0x03821537
0x0382153a
0x03821545
0x03821557
0x03821547
0x03821550
0x03821550
0x03821562
0x03821563
0x03821565
0x0382156a
0x0382157f

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d479470c4e5b2ce100ff49ab9878f56f993d97f039b8faceeec7089a09549c2
Instruction ID: 2fa0502c6036855886392d8e7fed2cec744985eb70fef6093a4dd24ec2544e8b
Opcode Fuzzy Hash: 9d479470c4e5b2ce100ff49ab9878f56f993d97f039b8faceeec7089a09549c2
Instruction Fuzzy Hash: 69019275A0075CAFCB14EFA8D845EAEBBB8EF85700F504096F915EB380D674DA40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0381FEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0381FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x385d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E037AFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E03787D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0381fec0
0x0381fec0
0x0381fecf
0x0381fed9
0x0381fede
0x0381fee0
0x0381feeb
0x0381fef3
0x0381fef6
0x0381fef9
0x0381ff04
0x0381ff16
0x0381ff06
0x0381ff0f
0x0381ff0f
0x0381ff21
0x0381ff22
0x0381ff24
0x0381ff29
0x0381ff3e

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bb285545c2bb05e3cfa4155e721534f6eea83697a9a0782a795ab05cb37b32
Instruction ID: e75e72c900086125e1f5ef5bd0c4d9fd4b5431d3db96913c834e657ed5127740
Opcode Fuzzy Hash: 36bb285545c2bb05e3cfa4155e721534f6eea83697a9a0782a795ab05cb37b32
Instruction Fuzzy Hash: 13018475A0071CABCB14EBA9D845FAEB7B8EF85700F444166FA01EB280EA749A11C795

Uniqueness

Uniqueness Score: -1.00%

Function 0381FE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0381FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x385d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E037AFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E03787D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x0381fe3f
0x0381fe3f
0x0381fe4e
0x0381fe58
0x0381fe5d
0x0381fe5f
0x0381fe6a
0x0381fe72
0x0381fe75
0x0381fe78
0x0381fe83
0x0381fe95
0x0381fe85
0x0381fe8e
0x0381fe8e
0x0381fea0
0x0381fea1
0x0381fea3
0x0381fea8
0x0381febd

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69512bec397d6c2c2783bd88c9c4cacf88d97c606abf3ee22899ff176bf7f346
Instruction ID: 7bdfba84ecca56b81b4daee604f83bc4b3bf2c95b656706b5136720f983eb642
Opcode Fuzzy Hash: 69512bec397d6c2c2783bd88c9c4cacf88d97c606abf3ee22899ff176bf7f346
Instruction Fuzzy Hash: 21018475A0075CABCB14EFA9D845FAEB7B8EF84704F004166F900EF281DA749911C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0377B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0377B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E03787D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E037E7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x0377b037
0x0377b039
0x0377b03b
0x0377b040
0x037ca60e
0x00000000
0x00000000
0x037ca61d
0x0377b04b
0x0377b04e
0x037ca627
0x037ca634
0x00000000
0x00000000
0x037ca641
0x037ca653
0x037ca643
0x037ca64c
0x037ca64c
0x037ca65b
0x00000000
0x00000000
0x00000000
0x037ca66c
0x0377b057
0x0377b057
0x0377b057
0x0377b046
0x0377b046
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 220c98a177f2aca3375b40cd7baf2e77d18cd56e44c0876a60f126f702a1729d
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 7F017C72214AC89FDB26C75CC988F66B7DCEF45750F0900A9F919CBA51D628DC40C621

Uniqueness

Uniqueness Score: -1.00%

Function 03831074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03831074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E0383165E(__ebx, 0x3858ae4, (__edx -  *0x3858b04 >> 0x14) + (__edx -  *0x3858b04 >> 0x14), __edi, __ecx, (__edx -  *0x3858b04 >> 0x14) + (__edx -  *0x3858b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E0382AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E03787D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E0381FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x03831074
0x03831080
0x03831082
0x0383108a
0x0383108f
0x03831093
0x038310ab
0x038310ab
0x038310c3
0x038310cf
0x038310e1
0x038310d1
0x038310da
0x038310da
0x038310e9
0x038310f5
0x038310f5
0x038310fe

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d493cd3052659af6819be5ec8b58c503f0f58c0c0a17bcc6bd7c4f097b0e55e1
Instruction ID: 94ce216647ca4bf91a08c78bae25b3bb537be2190e9526b2c92042f8166fd23c
Opcode Fuzzy Hash: d493cd3052659af6819be5ec8b58c503f0f58c0c0a17bcc6bd7c4f097b0e55e1
Instruction Fuzzy Hash: 4B0168322047419BC710FBA9C808B5AB7D9AB80600F0486A9F881D7390EE34D440CBE3

Uniqueness

Uniqueness Score: -1.00%

Function 03838ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E03838ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x385d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E03787D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x03838ed6
0x03838ee5
0x03838eed
0x03838ef0
0x03838efa
0x03838f03
0x03838f0c
0x03838f15
0x03838f24
0x03838f27
0x03838f31
0x03838f43
0x03838f33
0x03838f3c
0x03838f3c
0x03838f4e
0x03838f4f
0x03838f51
0x03838f56
0x03838f69

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3376421bded62b3a343d9ec3b37b0d7d98869cbb0336145d06740d7c386a7ff5
Instruction ID: 68ff21cfa0a2223fb3d53aec006dc972f50bdd870637531f2dabbd7841e9f118
Opcode Fuzzy Hash: 3376421bded62b3a343d9ec3b37b0d7d98869cbb0336145d06740d7c386a7ff5
Instruction Fuzzy Hash: 6D111B74A00659DFDB04DFA8D545BAEFBF4FF48300F5442AAE919EB382E6349940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03838A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E03838A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x385d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E03787D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E037AB640(E037A9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x03838a62
0x03838a71
0x03838a79
0x03838a82
0x03838a85
0x03838a89
0x03838a8c
0x03838a8f
0x03838a92
0x03838a95
0x03838a9f
0x03838ab1
0x03838aa1
0x03838aaa
0x03838aaa
0x03838abc
0x03838abd
0x03838abf
0x03838ac4
0x03838ada

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9c2411f418d818ef3936738e8861ba1d8a01599eb2ebe93d46fc355a5002a3
Instruction ID: 76af84890d127f361641074ceeb7525bad8fa203f7a1fca50872b055f62376e5
Opcode Fuzzy Hash: 0b9c2411f418d818ef3936738e8861ba1d8a01599eb2ebe93d46fc355a5002a3
Instruction Fuzzy Hash: 03012C75A0171CAFCB04DFA9D9459EEB7B8EF49310F50409AF905FB341E634A900CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0376DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0376DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E0376DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E0376E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L0376E8B0(__ecx, _t14, 0xfff);
							L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x0376db64
0x0376db66
0x0376db6b
0x0376dbaa
0x0376db71
0x0376db76
0x0376db7a
0x0376dba3
0x0376db7c
0x0376db87
0x0376db8b
0x037c4fa1
0x037c4fb3
0x037c4fb8
0x0376db91
0x0376db96
0x0376db98
0x0376db98
0x0376db8b
0x0376db7a
0x0376db9d
0x0376dba2

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 97f551efbf3235af1247d7b05fb6da4914626f6d57882bb6c42a50033bbb7d24
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 0DF0C8373516629BD332EA5549A4F27A6968F92A60F19003DB9099F648C9608C029AE0

Uniqueness

Uniqueness Score: -1.00%

Function 0376B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0376B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E03787D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E03787D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E037E7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x0376b1e8
0x0376b1ea
0x0376b1f3
0x037c4a17
0x0376b1f9
0x0376b1f9
0x0376b1f9
0x0376b201
0x037c4a21
0x037c4a2e
0x00000000
0x00000000
0x037c4a3b
0x037c4a4d
0x037c4a3d
0x037c4a46
0x037c4a46
0x037c4a55
0x00000000
0x00000000
0x00000000
0x0376b20a
0x0376b20a
0x0376b20a
0x0376b20a

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: c799fd7c7088fd5d24f15415a5a55c2be6d7e0bb22e7d21e6ed05c13eb0e15ba
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 6601D1322506C0EFD326D76AC858F69BBD8EF42754F0C00A9FD16DB6B1D678C800C264

Uniqueness

Uniqueness Score: -1.00%

Function 037FFE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E037FFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x385d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E03787D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x037ffe96
0x037ffe9e
0x037ffea1
0x037ffead
0x037ffeb3
0x037ffeb9
0x037ffec3
0x037ffed5
0x037ffec5
0x037ffece
0x037ffece
0x037ffee0
0x037ffee1
0x037ffee3
0x037ffee8
0x037ffefb

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf98d67879c337912841c6813ab5a018e48418c69b2109d200a24387b34fcc6
Instruction ID: e5c34c6fe1ac14b752d6e2e210cb2dae44ff22fd1b84f6df7f2681f4344fe7d0
Opcode Fuzzy Hash: 1cf98d67879c337912841c6813ab5a018e48418c69b2109d200a24387b34fcc6
Instruction Fuzzy Hash: 7001FF74A00748EFCB14DFA8D545A6EB7B4FF44704F54419AA915EB382DA35D901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0382131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0382131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x385d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E03787D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x0382131b
0x0382132a
0x03821330
0x03821336
0x0382133e
0x03821341
0x03821344
0x0382134f
0x03821361
0x03821351
0x0382135a
0x0382135a
0x0382136c
0x0382136d
0x0382136f
0x03821374
0x03821387

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8f14473d2c715f8f6398dcf3bd63b065928ec5117582a53fa860c2863bdde6
Instruction ID: 92ed8f3812728f1c9895b96bea43e3f1ff8ca8ae7c31e71c7f6660d8d65aba37
Opcode Fuzzy Hash: 4b8f14473d2c715f8f6398dcf3bd63b065928ec5117582a53fa860c2863bdde6
Instruction Fuzzy Hash: 40013C75A0175CAFCB04EFA9D549AAEBBF4FF48700F50409AF905EB381E6349A40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03838F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E03838F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x385d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E03787D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x03838f6a
0x03838f79
0x03838f81
0x03838f84
0x03838f8b
0x03838f91
0x03838f94
0x03838f9e
0x03838fb0
0x03838fa0
0x03838fa9
0x03838fa9
0x03838fbb
0x03838fbc
0x03838fbe
0x03838fc3
0x03838fd6

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cedf17187425c175defc95f38113bfacf6819002398cb98b5fcc4bffa9728715
Instruction ID: f0670f2e52fcf3ac92a27d4d1cbf0d3bc04eb15b78c114a41174028e907081ee
Opcode Fuzzy Hash: cedf17187425c175defc95f38113bfacf6819002398cb98b5fcc4bffa9728715
Instruction Fuzzy Hash: 9F014F74A0170CEFCB04EFA8D545AAEB7F4EF48300F50409AB905EB380EA34DA04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0378C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0378C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0378C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x37411cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E038388F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x0378c577
0x0378c57d
0x0378c581
0x0378c5b5
0x0378c5b9
0x0378c5ce
0x0378c5ce
0x0378c5ca
0x00000000
0x0378c5ca
0x0378c5c4
0x0378c5c8
0x00000000
0x00000000
0x00000000
0x0378c5ad
0x00000000
0x0378c5af

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e226614b09f157fff064463f0bd12f4d1f36fb50ee92bd88f7bf5d1181b81dcc
Instruction ID: efbb6fbae5121b527f0d0f139ac2fc1d90892ac44bb9e82403e253afac05150f
Opcode Fuzzy Hash: e226614b09f157fff064463f0bd12f4d1f36fb50ee92bd88f7bf5d1181b81dcc
Instruction Fuzzy Hash: 9CF09AB29976929EDF33F7688008B22FBE89B05670F6884A6E41687601C7A4D880C271

Uniqueness

Uniqueness Score: -1.00%

Function 037A927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E037A927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L03784620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E037AFA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E037A92C6(_t11, _t14);
				}
				return _t11;
			}

0x037a9295
0x037a9299
0x037a929f
0x037a92aa
0x037a92ad
0x037a92ae
0x037a92af
0x037a92b0
0x037a92b4
0x037a92bb
0x037a92bb
0x037a92c5

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 647f0f99bb2b0c92a5fdb079f9f5b5b09933e33e0192db536460db66017aaa70
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 0EE06532340A406BD751DE5ADC84B5776599FC2721F044179B5045E282C6E5D91987A0

Uniqueness

Uniqueness Score: -1.00%

Function 03838D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E03838D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x385d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E03787D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x03838d34
0x03838d43
0x03838d4b
0x03838d4e
0x03838d52
0x03838d5c
0x03838d6e
0x03838d5e
0x03838d67
0x03838d67
0x03838d79
0x03838d7a
0x03838d7c
0x03838d81
0x03838d94

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5b6248bd11715454ac8bdf54875033a2f0880c83a556d2090bb43fbe2a9bb1
Instruction ID: f30a76b9f159aa1bb27a0fa1db80d8e22f0c09bd4c79f5e44a9c84cc9ad61057
Opcode Fuzzy Hash: bf5b6248bd11715454ac8bdf54875033a2f0880c83a556d2090bb43fbe2a9bb1
Instruction Fuzzy Hash: 11F09074A0470C9FCB04EFA8D545A6EB7B4AB54200F508099F905EB380EA34D904C794

Uniqueness

Uniqueness Score: -1.00%

Function 03822073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E03822073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E0381FD22(__ecx);
				_t19 =  *0x385849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x3858748; // 0x0
					if(__eflags <= 0) {
						E03821C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x3858724 & 0x00000004;
							if(( *0x3858724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x3858724; // 0x0
					return E03818DF1(__ebx, 0xc0000374, 0x3855890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x03822076
0x03822078
0x0382207d
0x03822083
0x038220a4
0x038220aa
0x038220ac
0x038220b7
0x038220ba
0x038220bc
0x038220c9
0x038220c9
0x038220d0
0x038220d2
0x00000000
0x038220d2
0x038220be
0x038220c3
0x038220c5
0x038220c7
0x00000000
0x00000000
0x038220c7
0x038220bc
0x038220d4
0x03822085
0x03822085
0x038220a3
0x038220a3

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3008f28193542b74cfb21f03129480a082c1f68e63d518d42d552ce3f6933e0
Instruction ID: 3971abd57cc90ce0cb80db52c259b387f874781df4a39441934cc5d25378e6e5
Opcode Fuzzy Hash: b3008f28193542b74cfb21f03129480a082c1f68e63d518d42d552ce3f6933e0
Instruction Fuzzy Hash: BBF0A02E915BB84ADF72FBA861023E26FD9D746110B1D09C6E991DF208C63889C3CA61

Uniqueness

Uniqueness Score: -1.00%

Function 03764F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03764F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E038388F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0378C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x3741030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x03764f2e
0x03764f34
0x03764f38
0x037c0b85
0x037c0b85
0x037c0b89
0x037c0b9a
0x037c0b9a
0x037c0b9f
0x00000000
0x037c0b9f
0x037c0b94
0x037c0b98
0x00000000
0x00000000
0x00000000
0x037c0b98
0x03764f3e
0x03764f48
0x00000000
0x03764f6e
0x00000000
0x03764f70

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a3ccd8fe5e9fca3d3e6f41d746594eb6c02a82951b4e07a68bd2ac94bc5d80
Instruction ID: 9c7b5dacf32345568330d62d823e5b7222476efbf000e305aceebf6c1713eac5
Opcode Fuzzy Hash: b8a3ccd8fe5e9fca3d3e6f41d746594eb6c02a82951b4e07a68bd2ac94bc5d80
Instruction Fuzzy Hash: 54F0BE365326D8CFD761DB18CA44B22B7E8AB0077CF4845BCE4058BA20C724E884CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 03838B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E03838B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x385d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E03787D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x03838b67
0x03838b6f
0x03838b72
0x03838b7d
0x03838b8f
0x03838b7f
0x03838b88
0x03838b88
0x03838b9a
0x03838b9b
0x03838b9d
0x03838ba2
0x03838bb5

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86fe07209ea39920b5a25d72f840bb5874b00c390c79e85721ba29d77ee7443
Instruction ID: ae3dd074b6160fdcd174384e061cf51c23e30583d040cee1737e655c0908d11c
Opcode Fuzzy Hash: f86fe07209ea39920b5a25d72f840bb5874b00c390c79e85721ba29d77ee7443
Instruction Fuzzy Hash: 24F082B4A0475DABDB04EBA8D90AE6EB3B4EF44304F540599BA15EF380EA34D904C794

Uniqueness

Uniqueness Score: -1.00%

Function 0378746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0378746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E0377EB70(__ecx, 0x38579a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E037A95D0();
							L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x0378746d
0x0378746d
0x0378746d
0x03787471
0x03787488
0x037cf92d
0x0378748e
0x03787491
0x03787495
0x037cf937
0x037cf93a
0x037cf94e
0x037cf953
0x037cf956
0x037cf956
0x03787495
0x00000000
0x03787488
0x03787473
0x03787478
0x0378747d
0x03787481
0x00000000
0x03787481
0x0378747d
0x0378747a
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4f6f998032deecca4032f50e5e4d9ca1a7946dbbbfa988a5af98d1076ada8a
Instruction ID: fa2b8e5eaa03d76ae17906c48a1d94523632b78f6ae5563180f4b17a0b6100fe
Opcode Fuzzy Hash: 4e4f6f998032deecca4032f50e5e4d9ca1a7946dbbbfa988a5af98d1076ada8a
Instruction Fuzzy Hash: B6F0E9349812CCAACF09F76CC840F79BFB1AF04394F284299D8EBAF161E7649800D785

Uniqueness

Uniqueness Score: -1.00%

Function 03838CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E03838CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x385d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E03787D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E037AB640(E037A9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x03838ce5
0x03838ced
0x03838cf0
0x03838cfb
0x03838d0d
0x03838cfd
0x03838d06
0x03838d06
0x03838d18
0x03838d19
0x03838d1b
0x03838d20
0x03838d33

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ead3ff9e18632a7fb62983605beefea10e59d5a7e7278d67bc8ca4f59561d3
Instruction ID: 4714b2b73036dc7562e0d61ee47bd922101da5d8c4a38e38cc15e6eb7e15ef7f
Opcode Fuzzy Hash: 47ead3ff9e18632a7fb62983605beefea10e59d5a7e7278d67bc8ca4f59561d3
Instruction Fuzzy Hash: 26F08275A0464CABCB04EBB8D949EAEB7B4EF59204F540199F916EB380EA34D904C754

Uniqueness

Uniqueness Score: -1.00%

Function 0376F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0376F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E0379F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L03784620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x0376f35d
0x0376f361
0x0376f367
0x0376f372
0x0376f38c
0x0376f38c
0x0376f394

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 30b211e1490179eeb478bc60b00e564e265309ec25a57fdcd4f88ea4bec9fac6
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: B3E0D832A40218BBDB21EADAAD05F5ABBACDB8CA61F040156FD04DB150D5649D00D2D0

Uniqueness

Uniqueness Score: -1.00%

Function 0377FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0377FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x37411a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E038388F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E03780050(_t14);
				}
			}

0x0377ff66
0x0377ff6b
0x00000000
0x0377ff8f
0x00000000
0x0377ff8f

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6cfed06d29a0dee43c45f1a256281b5ab14cce55d5cc51ca4cf1faacd0ebcd
Instruction ID: 4a381ac2836154e1579cab89a8ea23b47fb1ed847457dca7991c0c6a12def143
Opcode Fuzzy Hash: 6f6cfed06d29a0dee43c45f1a256281b5ab14cce55d5cc51ca4cf1faacd0ebcd
Instruction Fuzzy Hash: 2BE04FB5609344DFDF34EB55D254F35779C9B42621F1D849DE408CB501CA21E882C656

Uniqueness

Uniqueness Score: -1.00%

Function 0381D380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0381D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L0376E8B0(__ecx, _a4, 0xfff);
					L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x0381d38a
0x0381d39b
0x0381d3b1
0x00000000
0x0381d3b6
0x00000000

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: e5f87e2b3336ea52f410af3b27b882c78f9bee89158c3ded2ffe7ae363537d28
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 53E0C235280348BBDB22AE84CD00F797B1ADB807A0F204071FE089EA90D6759CA1E6D4

Uniqueness

Uniqueness Score: -1.00%

Function 0379A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0379A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x38567e4 >= 0xa) {
					if(_t5 < 0x3856800 || _t5 >= 0x3856900) {
						return L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E03780010(0x38567e0, _t5);
				}
			}

0x0379a190
0x0379a1a6
0x0379a1c2
0x00000000
0x00000000
0x00000000
0x0379a192
0x0379a192
0x0379a19f
0x0379a19f

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29adf83088279db1b2fb733bd2beeb42dcad1ee53a6023c6bf1639422e9740ad
Instruction ID: 56b936ad560a3bd89a52d59b0f38f773610a926f5c273ea6733b8c48037f40b8
Opcode Fuzzy Hash: 29adf83088279db1b2fb733bd2beeb42dcad1ee53a6023c6bf1639422e9740ad
Instruction Fuzzy Hash: 04D02B219E210416DB1CF354A818B212222E7C0710F70068EF2078E5A5FB508CD8C108

Uniqueness

Uniqueness Score: -1.00%

Function 037916E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E037916E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E03791710(0x38567e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L03784620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x037916e8
0x037916ef
0x037916f3
0x037916fe
0x00000000
0x03791700
0x0379170d
0x0379170d
0x037916f2
0x037916f2
0x037916f2
0x037916f2

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603831f3908ee47e99653cf252470f78bf990154c2f34b77e9efd579291c0d24
Instruction ID: 1eccd2bed6dc0db6de8ebbe04e41dde499d10c79c1172060d2d373755a6bfc64
Opcode Fuzzy Hash: 603831f3908ee47e99653cf252470f78bf990154c2f34b77e9efd579291c0d24
Instruction Fuzzy Hash: E7D0A73124020252EE2DDB11AC09B142251DB80781F7C015DF2074D5C0DFA0CCB2E048

Uniqueness

Uniqueness Score: -1.00%

Function 0377AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0377AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x0377aab6
0x0377aabb
0x037ca442
0x00000000
0x037ca448
0x037ca454
0x037ca454
0x0377aac1
0x0377aac1
0x0377aac6
0x0377aac6

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 3098bace5563ea654c38d19bd8ee9b1d23f689216bf0ce7aeee09f8f672a66ea
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 13D0E935352A80CFD656CB1DC594B5573A8BB44B85FC904D4E501CB761E62CD944CA00

Uniqueness

Uniqueness Score: -1.00%

Function 037935A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E037935A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E0377EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x037935a1
0x037935a1
0x037935a5
0x037935ab
0x037935ab
0x037935b5
0x00000000
0x037935c1
0x037935b7

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: ba39dd7601e69aae9350fd878c0bb36bc37b1eab390c703e45657297a555f1b3
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 80D0A73D40118099FF03EB30E11C7687771BB04208F5C11A7800145861C3354909D600

Uniqueness

Uniqueness Score: -1.00%

Function 0376DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0376DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L03784620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x0376db4d
0x0376db54
0x0376db5f
0x0376db56
0x0376db56
0x0376db5c
0x0376db5c

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 4c24797fe7d0d00f2b63ab781c7cae93f084ef70ac01494ab5ecd12555e739e4
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 6CC08C303D0B01AAEB32AF20CD01B0076A0BB40B01F4800A06700DA0F0EBB8DC01EA00

Uniqueness

Uniqueness Score: -1.00%

Function 037EA537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E037EA537(intOrPtr _a4, intOrPtr _a8) {

				return L03788E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x037ea553

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 4adf7a9ecea9387c7922b840d184fe297e5bd38912e1c5265e0cb8ab6bf8417b
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 47C0123A080248BBCB12AF81CC00F067B2AFB94B60F008010BA080A5608632E970EA85

Uniqueness

Uniqueness Score: -1.00%

Function 03783A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03783A1C(intOrPtr _a4) {
				void* _t5;

				return L03784620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x03783a35

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 2e27eda8148893461098fa79c7e799887551f1586eab131dc67be5f03a1a9c77
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 72C08C32180248BBC712AF42DC00F017B29E790B60F000020B6040A5608672EC60D588

Uniqueness

Uniqueness Score: -1.00%

Function 037776E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E037776E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x037776e4
0x00000000
0x037776f8
0x037776fd

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 52597c1d6b874613ad1fe793866ce5d35d1392c31d66c7e025d89d66c3c2abf4
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 45C08C741812C05AEF3EE708CE24B303654AB08608F5C019CAB028D4A1C368A823C208

Uniqueness

Uniqueness Score: -1.00%

Function 037936CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E037936CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L03784620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x037936d2
0x037936e8
0x037936d4
0x037936e5
0x037936e5

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 0ffb0dc3ddb4032540b643cdafbf5b3337310ca6d07f2848d946f525734b826f
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: DBC02B78290440BBFB25AF30CD00F147354F700B21F6C03547220494F0E6699C00D100

Uniqueness

Uniqueness Score: -1.00%

Function 0376AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0376AD30(intOrPtr _a4) {

				return L037877F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x0376ad49

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: c52f148b7ba6a6eb7d9a2ecd28b14b0ef98cbd04b5d739c117b66459ab61b565
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: E9C08C320C0288BBC712AB45CD00F017B29E790B60F100020B6040A6618932E860D588

Uniqueness

Uniqueness Score: -1.00%

Function 03787D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E03787D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x03787d56
0x03787d5b
0x03787d60
0x03787d5d
0x03787d5d
0x03787d5d

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: ac78b0c06655fb1c82e8ad234758ac9f53b47b39935adbfa9453ffc72cb527d6
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 01B092343419808FCE1AEF18C080B1533E8BB44A44B9800D0E401CBA20D229E8008900

Uniqueness

Uniqueness Score: -1.00%

Function 037FFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E037FFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E037ACE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E037F5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E037F5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x037ffdda
0x037ffde2
0x037ffde5
0x037ffdec
0x037ffdfa
0x037ffdff
0x037ffe0a
0x037ffe0f
0x037ffe17
0x037ffe1e
0x037ffe19
0x037ffe19
0x037ffe19
0x037ffe20
0x037ffe21
0x037ffe22
0x037ffe25
0x037ffe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 037FFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 037FFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 037FFE01

Memory Dump Source

Source File: 00000010.00000002.620632898.0000000003740000.00000040.00000001.sdmp, Offset: 03740000, based on PE: true

Associated: 00000010.00000002.621210745.000000000385B000.00000040.00000001.sdmp Download File
Associated: 00000010.00000002.621228978.000000000385F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 83fede80b16e8dc2c30d1076f9552810d42542dcf4c9dc55f33f081561bc1b39
Instruction ID: 215ad567ba2a83bcdad0e392fb13d708c42d21536d618e83b7ee667b2e67f45e
Opcode Fuzzy Hash: 83fede80b16e8dc2c30d1076f9552810d42542dcf4c9dc55f33f081561bc1b39
Instruction Fuzzy Hash: 60F0F676640601BFE6249A45DC06F27BF5AEB45730F140318F7285A2E2EAA2F82096F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report pug6mtV48A.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

User Modules

Hook Summary

Function 00419E00, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Function 00419D4A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
filenativeCOMMON

Function 00419D50, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
filenativeCOMMON

Function 0040ACC0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Function 00419F2A, Relevance: 1.5, APIs: 1, Instructions: 33
memorynativeCOMMON

Function 00419F30, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Function 00419E7C, Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Function 00419E80, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Function 00408286, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60
threadwindowCOMMON

Function 0041A020, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Function 004082B3, Relevance: 1.6, APIs: 1, Instructions: 71
threadwindowCOMMON

Function 004082E9, Relevance: 1.6, APIs: 1, Instructions: 56
threadwindowCOMMON

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Function 0041A060, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON